Ransomware Surge: Attacks Climb 50% as Rivalry Between Top Gangs Intensifies

The global cybersecurity landscape is grappling with a significant resurgence in malicious activity, as new data reveals a sharp uptick in ransomware incidents throughout the third quarter of 2026. According to a comprehensive analysis published by Nord Security on October 21, the period between July and September saw nearly 3,000 ransomware attacks—a stark indicator that the threat landscape is not only recovering from recent law enforcement pressure but is entering a new, more aggressive phase of evolution.

The report identifies 2,894 confirmed ransomware incidents during the quarter, representing a 50% increase compared to the same three-month window in 2025. This momentum suggests a clear upward trend, with the third quarter also outpacing the previous three months of 2026; there was an 8.6% rise in activity compared to the April-to-June period. As these figures climb, security experts are closely monitoring how the "ransomware-as-a-service" ecosystem is shifting in response to international disruption efforts.

The Stabilization of the Ransomware Market

For much of 2025, the ransomware ecosystem faced considerable headwinds. High-profile, coordinated law enforcement operations against dominant cartels—most notably the disruption of the Lockbit infrastructure, the forced shutdown of BlackCat’s servers, and the volatility surrounding the RansomHub group—created a period of temporary fragmentation and uncertainty. These operations, while effective in the short term, appear to have inadvertently set the stage for a period of consolidation.

Vakaris Noreika, VP of product research and development at Nord Security, noted that the current surge is not a random spike but a structural change in the industry. "Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era," Noreika explained. The lull observed in 2025 has given way to a competitive environment where new and rebranded groups are vying for market share, leading to an increase in both the frequency and the sophistication of attacks.

Rivalry Between "The Gentlemen" and "Qilin" Drives Volatility

At the heart of this surge is an intense, personal rivalry between two of the most prolific threat actors currently operating: a group known as "The Gentlemen" and the long-standing Qilin collective. Throughout 2026, these two groups have consistently traded the top spot in terms of attack volume, pushing each other to refine their methodologies to maximize impact and victim count.

The data for the third quarter highlights this battle for dominance. Of the incidents that could be definitively attributed to a specific threat actor, The Gentlemen were responsible for 383 attacks, narrowly edging out Qilin, which recorded 363 attacks. The sheer volume of activity generated by these two entities underscores how a small number of highly motivated groups can disproportionately affect the global security landscape.

The rivalry is reportedly rooted in internal disputes within the underground cybercrime economy. Mantas Sabeckis, a senior threat intelligence researcher at Nord Security, pointed to activity on various dark-web forums as the catalyst for the current tension. According to Sabeckis, the founder of The Gentlemen is believed to have previously operated a high-performing affiliate crew under the Qilin banner. A dispute over an unpaid financial cut—which allegedly played out publicly on an underground forum—prompted the leader to break away and establish a competing operation.

The strategy employed by The Gentlemen to capture market share was remarkably effective: they lured former colleagues away from Qilin by offering a 90% payout share, significantly higher than the industry-standard 70% to 80% split. This move not only siphoned off experienced talent from a major rival but also incentivized a higher tempo of operations to ensure the group remained profitable and visible. The result is a competitive feedback loop where both groups are forced to innovate their attack techniques to maintain their standing and revenue streams.

Beyond the Top Tier: The Broader Threat Landscape

While The Gentlemen and Qilin dominate the headlines, they are not the only actors contributing to the record-high figures. The third most active group during the quarter was Inc Ransom, which was responsible for 110 attacks. The list of active participants continues with several other groups, including Krybit, Akira, Deadlock, and Clop Leaks, each of which recorded approximately 100 attacks during the quarter.

The presence of these diverse groups suggests that the barriers to entry for launching a ransomware campaign remain relatively low, even as the "big-name" gangs engage in a high-stakes power struggle. This diversification makes it increasingly difficult for organizations to adopt a "one-size-fits-all" defense strategy, as they must contend with a variety of tactics, techniques, and procedures (TTPs) originating from multiple, highly active threat clusters.

The Shift Toward Data Extortion

One of the most concerning trends identified by researchers is a strategic shift in how these groups conduct their business. There is a growing trend among attackers to abandon the time-consuming and technically difficult process of file encryption in favor of pure data exfiltration.

In these "encryption-less" attacks, the threat actors infiltrate a network, steal sensitive corporate or personal data, and then threaten to publish the information on a leak site unless a ransom is paid. By bypassing the encryption phase, attackers can execute their campaigns much faster and with significantly less effort, allowing them to target a larger number of victims simultaneously.

"Stealing data is faster and simpler, so one group can hit many victims at once with far less effort," Sabeckis noted. "This shift is likely a big part of why attack volumes keep climbing." However, he cautioned that this does not signal the end of traditional encryption-based ransomware. Rather, it represents a diversification of tactics, where groups use extortion as a primary weapon while keeping encryption in their arsenal for cases where it provides higher leverage.

The Persistence of Basic Vulnerabilities

Despite the evolution of the threat actors and their internal rivalries, the fundamental ways in which these groups gain access to corporate networks remain stubbornly consistent. Researchers have observed that the overwhelming majority of successful ransomware incidents can be traced back to basic security failures that organizations have struggled to address for years.

The entry points most frequently exploited include the use of compromised credentials, a lack of robust multi-factor authentication (MFA) protocols, and the failure to patch known security vulnerabilities in software and network infrastructure. These are not sophisticated "zero-day" exploits that require state-level resources to deploy, but rather well-known gaps that provide an open door to attackers who are willing to perform the necessary reconnaissance.

Noreika emphasized that while the identities of the most active groups shift, the path to defense remains clear. "The names on the most prolific ransomware group list regularly change, but the way they get in doesn’t," Noreika said. "What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk."

As the year draws to a close, the data suggests that the ransomware threat is not abating but rather maturing. With rivalries between gangs like The Gentlemen and Qilin driving increased activity, and the shift toward streamlined data extortion tactics, the cybersecurity community faces a complex environment. The findings underscore that in an era of persistent threats, the most effective defense remains a rigorous, consistent approach to foundational security practices, such as patching and identity management, which continue to be the most effective deterrents against the rising tide of ransomware.