Ransomware did not slow down in the third quarter of 2026 - it accelerated sharply. New analysis from Nord Security counted 2,894 ransomware attacks between July and September, a 50% jump compared with the same period in 2025 and an 8.6% rise from the previous quarter. The findings suggest that an industry many assumed was wounded by law enforcement crackdowns has instead regrouped and found new ways to multiply its victims.
A market disrupted, then reborn
Throughout 2025, coordinated international operations against major ransomware networks such as LockBit, BlackCat and RansomHub appeared to have genuinely dented criminal activity. Infrastructure was seized, affiliates scattered, and attack volumes dipped. According to Nord Security's report, published October 21, that disruption was real but temporary. "Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware's new era," said Vakaris Noreika, the company's VP of product research and development. Rather than collapsing, the ecosystem reorganized around new leadership and new business models.
Two gangs, one rivalry, and a leadership split
Two groups now dominate the landscape: The Gentlemen, responsible for 383 attributed attacks, and Qilin, close behind with 363. Inc Ransom trailed in third place with 110 incidents, while Krybit, Akira, Deadlock and Clop Leaks each recorded activity approaching the 100 mark. The rivalry between the top two is not incidental. Mantas Sabeckis, senior threat intelligence researcher at Nord Security, explained that The Gentlemen's founder is believed to have previously led a top affiliate crew within Qilin before a dispute over payment split away from the group. He then launched his own operation, offering affiliates a 90% cut of ransom proceeds - well above the industry standard of 70% to 80% - to lure talent away from his former partners. That aggressive recruitment strategy appears to be paying off: The Gentlemen edged past Qilin by 20 attacks this quarter.
Why extortion without encryption is spreading
A notable shift in tactics helps explain the rising volume. Traditional ransomware locks victims out of their own systems through encryption, a process that takes time and technical coordination. Increasingly, both leading groups skip that step entirely. Instead, they steal sensitive data and threaten to publish it unless paid - a method that is faster, simpler, and allows a single group to target many victims with comparatively little effort. "Stealing data is faster and simpler, so one group can hit many victims at once with far less effort. This shift is likely a big part of why attack volumes keep climbing," Sabeckis said, though he cautioned that encryption-based extortion is far from obsolete.
The entry points have not changed
What has remained constant, researchers stressed, is how attackers get inside networks in the first place. Compromised passwords, accounts lacking multi-factor authentication, and unpatched software vulnerabilities continue to serve as the primary gateways for intrusion. "The names on the most prolific ransomware group list regularly change, but the way they get in doesn't," Noreika said. "What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk." For organizations and individuals alike, that points to a clear and unglamorous conclusion: basic security hygiene - strong authentication, timely patching, and credential management - remains the most effective defense against a threat that keeps evolving everywhere else.