THE 'State of Ransomware Q2 2026' report by Check Point Research reveals a notable shift in ransomware dynamics, highlighting that while leading Ransomware-as-a-Service (RaaS) groups continue to dominate, the number of active groups has increased significantly. Key findings include: 1) The top 10 ransomware groups now account for 57.6% of victims, a decline from 71% in Q1, with active groups rising from 71 to 93. 2) A total of 2,139 victims were recorded, showing a slight increase from the previous quarter.
3) Qilin remained the top operator with 279 victims, despite a 17% decrease, while The Gentlemen surged with 269 victims. 4) An internal leak from The Gentlemen revealed their use of AI in developing ransomware. 5) Ransom payment rates continue to decline, now at around 23%. 6) Law enforcement's focus has shifted to disrupting shared infrastructure used by multiple actors. 7) The US share of ransomware victims has decreased to 42%. 8) The speed of exploit development has intensified, with AI accelerating this process.