NORD Security recorded 2,894 ransomware attacks worldwide between July and September 2026, a 50% increase on the same period in 2025 and an 8.6% rise compared with April to June. Its report, published on 21 October, suggests activity has rebounded after law-enforcement takedowns of groups including LockBit, BlackCat and RansomHub helped reduce attacks during 2025. Nord’s Vakaris Noreika described the market as stabilising and the current figures as an early sign of a “new era” for ransomware.
Among incidents attributed to a group, The Gentlemen led with 383 attacks, followed by Qilin with 363 and Inc Ransom with 110. Krybit, Akira, Deadlock and Clop Leaks each recorded almost 100 attacks. Nord researchers say The Gentlemen and Qilin have alternated as the most active groups during 2026, and suggest rivalry between them is encouraging new techniques.
Researcher Mantas Sabeckis said The Gentlemen’s founder had previously run a Qilin affiliate crew before a dispute, then recruited former colleagues with a reported 90% payout, compared with the usual 70% to 80%.
Both leading groups have used attacks that steal data and threaten to publish it rather than encrypt files, a quicker approach that can allow attackers to target more victims, Nord said. Researchers cautioned that encryption has not disappeared. The report identifies compromised passwords, accounts without multi-factor authentication and unpatched vulnerabilities as familiar routes into victims’ systems.