started · updated
Ransomware landscape shifts as active groups hit record high in Q2 2026
Ransomware activity in Q2 2026 shows a shifting landscape characterized by a record number of active groups and the integration of artificial intelligence into criminal operations. While the total number of victims recorded on data leak sites remained relatively stable at 2,139, this represents a 33% increase compared to the previous year. The market is becoming more fragmented; the top 10 ransomware groups accounted for 57.6% of victims, a decrease from 71% in the first quarter. The number of active groups rose from 71 to 93 during this period.
Qilin remains the most prolific operator, marking its fourth consecutive quarter at the top with 279 victims. However, The Gentlemen group saw significant growth of 62%, reaching 269 victims and briefly overtaking Qilin in June. Leaked data from The Gentlemen revealed that a core team of approximately nine people used AI coding assistants to develop their ransomware management panel in just three days, highlighting how AI is lowering the barrier to entry for sophisticated cybercrime.
New technical threats are also emerging, such as the DeadLock ransomware group, which utilizes Polygon blockchain smart contracts to create resilient extortion infrastructures that are difficult for authorities to dismantle. Similarly, the Aeternum botnet uses the Polygon network for command-and-control mechanisms to resist conventional takedowns. Despite these evolving threats, ransom payment rates have reached a multi-year low of approximately 23%.
Entities
Check Point Research · DEADLOCK · Microsoft · Polygon · Qilin · The Gentlemen · Wasabi · Zeta88
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 2 SOURCES] The Gentlemen group used AI coding assistants to build its ransomware management panel in approximately three days. nationalcybersecurity.com · research.checkpoint.com
- [● 3 SOURCES] Data leak sites recorded 2,139 ransomware victims in Q2 2026, representing a 33% increase year over year. nationalcybersecurity.com · research.checkpoint.com · www.infopoint-security.de
- [DISPUTED] Qilin was the most prolific ransomware operator for the fourth consecutive quarter with 279 victims. nationalcybersecurity.com · research.checkpoint.com · www.infopoint-security.de
- [● 3 SOURCES] The top 10 ransomware groups accounted for 57.6% of victims in Q2 2026. nationalcybersecurity.com · research.checkpoint.com · www.infopoint-security.de
- [○ 1 SOURCE] Ransom payment rates fell to a multi-year low of approximately 23% in Q2 2026. research.checkpoint.com
- [● 3 SOURCES] The number of active ransomware groups rose from 71 to 93 in the second quarter of 2026. nationalcybersecurity.com · research.checkpoint.com · www.infopoint-security.de
- [● 2 SOURCES] The Gentlemen ransomware group grew by 62% during the quarter, reaching 269 victims. nationalcybersecurity.com · research.checkpoint.com