Ransomware activity has climbed to its highest level in recent memory, with nearly 2,900 attacks recorded worldwide between July and September 2026. That figure, drawn from an analysis by Nord Security published on October 21, represents a 50% jump compared with the same three months last year and continues an upward trend from the previous quarter.
A market resetting itself
The numbers mark a reversal from the relative lull seen in 2025, when coordinated law enforcement operations disrupted several of the ransomware world's most notorious operators, including Lockbit, BlackCat and RansomHub. Those takedowns forced criminal networks to scatter, regroup and rebuild their infrastructure, temporarily suppressing attack volumes. According to Nord Security, that disruption has run its course. Vakaris Noreika, the company's VP of product research and development, described the current figures as "merely the first stepping stone in ransomware's new era," suggesting the ecosystem has not just recovered but reorganized into something more resilient.
Two gangs, one rivalry, and a defection story
Much of the quarter's activity traces back to two groups: The Gentlemen and Qilin, which together accounted for 746 of the attacks that could be attributed to a specific actor. Inc Ransom followed at a distance with 110 incidents, while Krybit, Akira, Deadlock and Clop Leaks each logged activity approaching the 100 mark.
What makes The Gentlemen and Qilin notable is not just their volume but the apparent personal history behind their competition. Mantas Sabeckis, senior threat intelligence researcher at Nord Security, said underground forum activity suggests The Gentlemen's founder once ran a top affiliate crew for Qilin before a dispute over an unpaid cut drove him to break away. He reportedly lured former colleagues with a 90% payout share, well above the industry-standard 70% to 80%, a financial incentive that appears to be fueling aggressive expansion. The Gentlemen edged ahead of Qilin by 20 attacks this quarter, a margin Nord Security frames as evidence of a direct contest between the two for affiliates and victims alike.
Why encryption is losing its place at the center
A quieter but arguably more consequential shift is underway in how these attacks are carried out. Traditional ransomware locks victims out of their own systems through encryption, forcing a payment in exchange for a decryption key. Increasingly, groups are skipping that step entirely, simply exfiltrating sensitive data and threatening to publish it unless paid. Sabeckis noted that this approach is "faster and simpler," letting a single group strike many victims with far less operational effort, which he said is a significant driver behind rising attack counts. Encryption has not disappeared, but its role as the default extortion mechanism is clearly eroding.
Old doors, still open
Despite the shifting tactics and infighting among criminal groups, the initial point of compromise has barely changed. Nord Security's findings point to the same recurring weaknesses: stolen or weak passwords, accounts without multi-factor authentication, and unpatched software vulnerabilities. Noreika summed up the pattern by noting that while the names atop the ransomware leaderboard change constantly, the methods of entry do not. For organizations, the implication is straightforward: closing those familiar gaps remains one of the most effective defenses available, regardless of which group or technique happens to be dominant in a given quarter.