Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target

The top 5 ransomware groups in Q2 2026 were Qilin, TheGentlemen, Akira, DragonForce and LockBit5. They were ranked by confirmed victims. The count covers 2,509 cases across 91 groups tracked by the Brandefense CTI team in the quarter ending July 3, 2026. Qilin led with 305 victims. The post says most of the five gain access through stolen credentials or edge device flaws.

The Brandefense CTI team monitored 2,509 confirmed ransomware victims across 91 distinct threat actor groups during Q2 2026, the period ending July 3, 2026.

Every one of those 2,509 cases was independently verified before inclusion. Modern operators now publish proof-of-exfiltration data samples alongside victim listings to establish negotiation credibility. This makes the confirmation rate in this dataset 100%.

The headline number tells part of the story. Q2 2026 saw a 17.5% increase in confirmed victims compared to Q1 2026. June 2026 produced 919 victim posts, the highest single-month total in the current Brandefense tracking window. The monthly trajectory across the quarter moved in one direction: up.

Behind those numbers are 91 active groups. They range from established platforms with mature affiliate networks to newly launched operations running commodity builders. The top 10 groups accounted for 53.4% of all attributed victims. The top 5 held 28.4%.

This blog profiles each of those five groups in detail:

• Their origins
• How they gain access
• What makes them technically distinctive
• Which sectors and countries they target
• What the Q2 2026 data reveals about their current trajectory

Origins and Platform Profile

Qilin emerged in 2022 under the name Agenda. It was first written in Go and moved to Rust in 2023. The shift to Rust was deliberate. It enables cross-platform compilation for Windows, Linux, and VMware ESXi from a single codebase. Rust binaries are also significantly harder to reverse-engineer than Go equivalents, which reduces the value of signature-based detection. The rebranding to Qilin, which takes its name from a mythological Chinese creature, came with a major expansion of the affiliate program.

Qilin operates under the RaaS model. The core team develops and maintains infrastructure while affiliates conduct attacks. The affiliate revenue split is one of the most competitive in the ecosystem: affiliates keep the large majority of each ransom payment. This rate has been a primary driver of affiliate recruitment. This is true particularly after the disruption of LockBit, ALPHV/BlackCat, and RansomHub. Their displaced affiliates largely migrated to Qilin throughout 2025.

How Qilin Gets In

The most frequently observed initial access vector in confirmed Qilin intrusions is valid account abuse. These are VPN and RDP credentials procured from dark web access brokers and infostealer log markets.

Spearphishing with weaponized Office or LNK documents is a secondary vector. It is less common than credential-based access but has been observed across multiple intrusion chains. In 2026, social engineering campaigns using fake CAPTCHA pages have also been documented. They are a lure that leads to credential theft and then VPN access.

Technical Capabilities

Qilin’s encryptor uses two-pass ChaCha20 plus AES-256 encryption with BCryptGenRandom key generation. The ESXi variant halts virtual machines before encrypting VMDK files. This hits all hosted VMs at once. Thirteen major operators in Q2 2026 deploy dedicated ESXi encryptors. Qilin’s remains best-in-class among active RaaS platforms.

Defense evasion includes:

• XOR-based custom unpacking with in-memory payload decryption
• CPUID hypervisor bit inspection for sandbox detection
• Password-protected execution that prevents re-deployment on already-encrypted hosts
• PowerShell-based event log clearing after encryption

The encryptor self-deletes after execution to minimize forensic artifacts. In 2025, Qilin added a DDoS capability. This gave affiliates a third pressure lever alongside encryption and data leaking. It also introduced a ‘Call Lawyer’ feature in the negotiation panel to increase settlement pressure.

What Q2 2026 Data Shows

Since launch, Qilin has claimed approximately 1,500 total victims, with more than 500 in 2026 alone. Qilin’s most consequential known attack targeted Synnovis, a pathology provider serving major NHS trusts in London, in June 2024. It resulted in documented patient harm. In 2026, the group listed a global commercial real estate firm on its leak site.

Sector and Geographic Focus

Origins and Platform Profile

TheGentlemen is the most significant ransomware emergence story of 2025 and 2026. The group launched in 2025 and recorded only 18 incidents in Q4 2025. By Q1 2026 that figure had risen to 183. In Q2 2026 it reached 239. That is a 30.6% quarter-on-quarter increase and the highest growth rate among any top-5 operator in the period. Two consecutive quarters at Rank 2 confirm the group’s move from emerging to established RaaS platform status.

The group’s intelligence profile carries a lower confidence rating than Qilin, Akira, or LockBit5. This reflects its recent emergence and limited independent vendor corroboration. The data does make one thing clear. The group shows operational consistency, targeting across many sectors, and expanding geographic reach. These are traits of experienced affiliates running a purpose-built platform rather than an improvisational collective.

For the vendor reports on its tools, entry methods and defenses, see our The Gentlemen ransomware profile. On 26 October 2026, our dark web monitoring saw 38 victim entries credited to the group in one day, claims we have not verified.

How TheGentlemen Gets In

TheGentlemen’s primary initial access vector is valid accounts. These are credentials acquired from dark web brokers and infostealer logs. This fits the ecosystem-wide shift away from direct vulnerability exploitation toward credential-based access. The group has also been observed exploiting FortiGate vulnerabilities, specifically CVE-2024-55591. This pattern was also observed in Nightspire intrusions. It is associated with targeting Japan and Turkey in Q1 2026 data.

Encoded PowerShell scripts are used for payload staging, AMSI bypass, and persistence establishment. The group uses rclone and MEGAsync to stage stolen data before encryption. This fits double extortion as a baseline operational step.

What Q2 2026 Data Shows

The Brandefense Q3 forward outlook rates a potential Rank 1 transition from TheGentlemen as MEDIUM CONFIDENCE. Two conditions make this possible: TheGentlemen’s 30.6% growth rate and Qilin’s two-quarter volume decline. Year-to-date through May 2026, TheGentlemen held 335 total victims across five months. This firmly establishes it as the second most active operation globally.

Sector and Geographic Focus

Origins and Platform Profile

Akira was first observed in March 2023 and has kept up top-tier activity since. The group operates a double extortion model. It steals data before encryption and threatens publication on its Tor-based leak site. Unlike Qilin and LockBit5, Akira appears to operate without an affiliate program on the standard RaaS model. It works more as a closed or semi-closed operation with a stable, experienced team.

Akira’s encryption uses ChaCha20-Poly1305 for Windows targets. It uses a Rust variant that targets ESXi .vmdk, .vmem, and .vswp files. CISA reports that, as of late September 2025, Akira had claimed approximately $244.17 million in ransomware proceeds.

How Akira Gets In

Akira’s defining and most consistently observed initial access vector is exploitation of Cisco AnyConnect SSL VPN in environments without MFA enforcement, specifically CVE-2023-20269. The CISA and FBI joint advisory AA24-109A remains the definitive public reference for Akira mitigation controls. In 2025 and 2026, Akira affiliates have expanded to additional edge device vulnerabilities. Cisco IOS XE (CVE-2025-20188) and Palo Alto GlobalProtect (CVE-2024-3400) are both observed as emergent initial access vectors in recent Akira-attributed intrusions.

After access, Akira uses Advanced IP Scanner and SoftPerfect Network Scanner for internal network mapping. The group’s most distinctive defensive evasion technique is Bring Your Own Vulnerable Driver (BYOVD). RTCore64.sys, the driver associated with MSI Afterburner, is deployed to blind EDR solutions at kernel level before encryption. This technique severely limits the detection and response window. Backdoor local admin accounts are created on domain controllers for persistent re-access. They survive initial incident response attempts.

What Q2 2026 Data Shows

Sector and Geographic Focus

Origins and Platform Profile

DragonForce has been active since 2023. It built its technical foundation on the leaked LockBit 3.0 builder, which became publicly available in September 2022. Builder-derivative groups are frequently low-sophistication operations. DragonForce stands out through operational strategy rather than technical originality. The group has positioned itself as a cartel operator and publicly announced an umbrella organization for multiple sub-brands. The branding approach reflects genuine marketing investment and affiliate recruitment sophistication.

DragonForce’s genuine technical innovation is a data audit service. It analyzes stolen datasets exceeding 300 GB to identify the highest-value information for targeted extortion leverage. This service is offered to affiliates. It is a meaningful advance in the extortion model beyond standard data leak threats.

How DragonForce Gets In

DragonForce’s most operationally significant initial access vector is supply chain compromise via MSP and MSSP targeting. The group uses compromised managed service providers as launchpads to attack their clients. A single MSP intrusion can potentially yield dozens of downstream victims. This approach is mapped to MITRE ATT&CK T1195.002. It gives exponential victim multiplier potential. It is the primary reason DragonForce-attributed incidents should be treated as potential supply chain exposure events.

Windows Command Shell with batch automation scripts deploys the ransomware payload to network shares and remote systems via PsExec. 7-Zip is used to compress and stage exfiltrated data. The archives are split to evade DLP size thresholds. The encryptor binary self-deletes after execution and includes a custom wiper component to minimize forensic artifacts. The Linux variant specifically targets ESXi VM datastore paths.

What Q2 2026 Data Shows

DragonForce was also directly implicated in the Marks and Spencer attack in April 2025, one of the highest-profile retail breaches of the year. It caused significant operational disruption across the retailer’s online and in-store systems. The attack was attributed to DragonForce-affiliated actors. It demonstrated the group’s capacity for high-impact retail sector targeting.

Sector and Geographic Focus

Origins and Platform Profile

LockBit is the most consequential ransomware brand of the past five years. At its peak in 2023, LockBit was among the most active ransomware brands globally. Operation Cronos was the international law enforcement action in February 2024. It seized LockBit’s infrastructure, disrupted its operations, and led to the arrest of key affiliates. Most analysts assessed LockBit as a collapsed operation following Cronos.

That assessment proved incorrect. Residual LockBit affiliates and rebuilt infrastructure reconstituted under successive designations. Brandefense classifies the current iteration as LockBit5. This reflects the operational lineage while distinguishing it from prior versions. The re-entry into the Q2 2026 top-5 at Rank 5 with 115 victims signals that the LockBit ecosystem has successfully reconstructed platform-level operations, not merely individual affiliate activity.

LockBit5 supports Windows, Linux, macOS, VMware ESXi, and FreeBSD targets. This is the broadest platform coverage of any group in the top 5. The encryptor uses Salsa20 cipher with StealBit, a custom exfiltration tool, for data theft before encryption. The ‘LockBit Black’ variant is based on the leaked Conti and LockBit 3.0 builder.

How LockBit5 Gets In

LockBit5’s initial access vectors span multiple edge device vulnerabilities. Citrix Bleed (CVE-2023-4966), Palo Alto PAN-OS (CVE-2024-3400), and Fortinet exploits from prior periods remain relevant. In 2025 and 2026, affiliates have actively exploited Ivanti Connect Secure (CVE-2025-0282) and Palo Alto Expedition (CVE-2024-9474). The wide range of exploited vulnerabilities reflects the diverse technical profiles of LockBit’s affiliate network. It does not reflect a single standardized access methodology.

Pages on flaws named in this post: Citrix Bleed (CVE-2023-4966), PAN-OS GlobalProtect (CVE-2024-3400), Ivanti Connect Secure (CVE-2025-0282) and FortiOS (CVE-2024-55591).

LockBit5’s most operationally disruptive technique is Group Policy Object abuse. It mass-deploys the ransomware payload across an entire Active Directory domain at once. This is mapped to MITRE ATT&CK T1484.001. A single execution can encrypt every domain-joined machine in an environment without per-host deployment. Privilege escalation uses Kerberoasting and AS-REP Roasting to obtain domain admin Kerberos tickets. This works in environments where privileged accounts authenticate from general-purpose workstations.

What Q2 2026 Data Shows

By June 2026, LockBit5 was posting victims at an accelerating rate, with a reported 87% increase month-over-month in the most recent tracking period. Top targeted sectors in the current period include Business Services (47 victims), Manufacturing (45), Technology (36), Healthcare (27), and Agriculture and Food Production (23). The most frequently targeted countries are the United States, Brazil, Italy, Germany, and Mexico.

Sector and Geographic Focus

What Do the Top 5 Ransomware Groups Have in Common in Q2 2026?

The five operators have different tooling, different affiliate structures, and different targeting preferences. Even so, three attack patterns appear consistently. They are common enough to be structural features of the current threat landscape rather than group-specific tactics.

Q3 2026 Forward Outlook: What Brandefense CTI Forecasts

The Q2 2026 data supports the following forward assessments for Q3. They are drawn directly from the Brandefense Ransomware Trends Report:

How Brandefense Tracks These Groups