The affiliate gets the larger share.
Six programme ads state or imply a split. Entry charges, proof and deposits add conditions to the headline offer.
Read the partner terms →
Brandefense Cybercrime Report 2026 · Ransomware
1 January–27 October 2026 · Research edition 1.3
Inside The Ransomware Economy.
Ransomware has a public claim trail and an advertised service economy. We read the crews’ own ads beside 9,203 leak-site claims collected by Brandefense Blackhole, our cybercrime database.
The persistent core 64.7%
of claims came from just 33 of 177 groups.01The visible claims
A Crowded Field. A Concentrated Output.
177 groups appear in the collection. Qilin and The Gentlemen alone account for 23.4% of its claims. A changing list of names does not mean activity is evenly distributed.
9,203 canonical group–victim claims
50 groups appear in only one month, accounting for 260 claims
85.4% of claims appear in multiple relays; repetition is not independent confirmation
Observed claims · monthly
Canonical group–victim claimsAugust has the highest observed monthly count.
January–July range: 761–963 claims. August: 1,321. The series measures the collected relay posts; it is not a global incident trend.
Jan 784
Feb 793
Mar 963
Apr 844
May 761
Jun 820
Jul† 874
Aug 1,321
Sep 954
Oct* 1,089
Observed monthHighest observed month† Sampled week · * Partial month
† July includes a sampled week. * October ends on 27 October. No extrapolation. Recruitment timing does not establish that an ad caused later claims.
Source: Brandefense Blackhole, 1 Jan–27 Oct 2026. Claims, not confirmed breaches. Coverage varies; the series is not a global incident census.
Download monthly dataCSV · 324 BOriginal chartSVG · 99.8 KB
+View as table
| Month (2026) | Claims | Active groups | Note |
|---|---|---|---|
| Jan | 784 | 58 | |
| Feb | 793 | 60 | |
| Mar | 963 | 62 | |
| Apr | 844 | 60 | |
| May | 761 | 63 | |
| Jun | 820 | 69 | |
| Jul | 874 | 66 | sampled week |
| Aug | 1,321 | 92 | |
| Sep | 954 | 85 | |
| Oct | 1,089 | 85 | partial month |
02The advertised business
The Locker Is Only Part Of The Offer.
The posts describe recruitment, tools, negotiation and publication as separate services. These are seller statements from selected posts, not verified purchases or estimates of the whole market.
01 · Recruit 70–95% Advertised partner shares in six programme ads
02 · Equip $50 One advertised builder with decryptor and web panel; no currency named
03 · Negotiate $100 setup One hosted portal offer; $30 monthly is separate
The underground review uses 60 retained catalogue items from a keyword-led selection; some items combine multiple posts or threads.
Pressure comes with support.
A hosted portal was offered for $100 setup and $30 a month. Other selected descriptions assign talks to the affiliate or crew staff.
Examine negotiation services →One builder, six dated listings.
Six dated listings across 59 days change the builder package and access terms. Two June source-code offers name USD; other dollar denominations stay unspecified. These are asking prices, not verified sales.
Explore the builder offers →Five offers. Very different products.
Five dated EDR-killer offers distinguish per-build pricing, custom work and limited access rights. Different products and unnamed dollar denominations do not form a common price range.
Compare the advertised terms →Keys and applications are different offers.
Vect promised an affiliate key to every forum member. The Gentlemen invited teams and access brokers as an official forum partner; neither announcement proves new intrusions.
Read the forum evidence →Release, reposting and sale are different routes.
Selected catalogue descriptions distinguish unpriced publication, later reposting and sale offers. Composite catalogue items are not independently verified cases and cannot predict payment outcomes.
Compare the data routes →03The groups in the evidence
Seven Profiles. Different Patterns.
Read each profile alongside its observed claim count. These seven were selected for the research; they are not a ranking of all 177 groups.
GroupObserved claims, 1 Jan–27 Oct 2026
Qilin
Group profileThe Gentlemen
Group profileCl0p
Group profileAkira
Group profileNova
Short profileVect
Short profileVanHelsing
Research article04From observation to decision
What Should Change In A Defender’s Workflow?
Our interpretation follows the evidence. It does not promise a fixed warning window or establish when a compromise began.
-
Treat a claim as a verification trigger.
Preserve the observation time, validate it against internal evidence, and involve incident response. Multiple relays can repeat the same allegation.
Evidence85.4% of claims appeared in more than one relay. -
Track the persistent groups and their services.
Prioritise relevant group activity, advertised access requirements and negotiation patterns. Keep observed activity separate from a seller’s claimed capability.
Evidence33 groups produced 64.7% of this collection’s claims. -
Bring earlier public signals into the same record.
Pair vulnerability and exploitation notices with exposure checks and response ownership. A public advisory and a relayed claim need an event-level join before their dates can define an incident interval.
Evidenceclaim timing measures first relay observation; it does not identify compromise.
Module
Dark Web Monitoring
See when your company's passwords, data or name show up on criminal forums and markets.
See how it works →
Free exposure check
Request a demo
Check Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
05 / From research to monitoring
From Research To Monitoring.
06Method & limits
Every Number Has A Boundary.
- Source
- Brandefense Blackhole.
- Period
- 1 January–27 October 2026, UTC.
- Version
- 1.3.
One canonical group–victim pair, assigned to its first UTC appearance in the collected relay posts. Aliases are merged before de-duplication. We removed 171 duplicate pairs and excluded 190 claims attributed to 0APT.
Victim names, contact handles and illicit service links are omitted.
07The research, ready to inspect
Read It. Check It. Use The Evidence.
HTMLEdition 1.3 The research reportAccessible edition · analysis, charts, source notes and method HTML11.3 KB Charts & press kitDownloadable SVG / PNG charts and attribution HTML8.9 KB The underlying aggregatesCSV files, field definitions and collection limits
Original aggregate data and chart assets: CC BY 4.0. Retain the source, period and limitations when reusing them.
31 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
08 / All chapters
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.
02 · Fraud 831 of 2,448 retained financial-account posts match one narrow recruitment signature (33.9%) 03 · Data Breach & Leaks 63% of Blackhole-collected posts that mention "data breach" are news retellings, not leak posts 04 · Stolen Accounts & Combolists 6.3% of hand-read Botnet Log posts are strict stealer-log clouds (weighted estimate) 05 · Infostealers 97.5% of January-April raw "stealer" keyword posts carried one brand's notification template 06 · Initial Access Offers 38.2% → 4.9% Share of posts under Blackhole's "Initial Access Selling" label that were access offers: 1 Jan–31 Aug vs 12 Sep–27 Oct 2026 07 · Exploits, Tooling & AI 37 of 93 exploit seller posts using the word 0-day that were coded as unnamed-exploit claims 08 · Hacktivism & DDoS 578 distinct NoName057(16) DDoS claim events (1 Jan–27 Oct 2026), carrying 2,920 claimed target entries All eight chapters Open the Cybercrime Report 2026 Eight chapters. Eight units.