Brandefense Cybercrime Report 2026 · Ransomware

9,203 Claims. 177 Groups. Ransomware Report.

Leak-site claims read beside the crews’ own ads: partner splits up to 95%, a builder advertised at $50.

9,203: Ransomware leak-site claimsDistinct (group, victim) pairs, 1 Jan to 27 Oct 2026. One group, 0APT, is left out.
177: Groups with at least one claimQilin (1,146 claims) and The Gentlemen (1,012) hold 23.4% of all claims.
95%: Highest partner split advertisedNova 2.0, above 1M in revenue (currency not stated). The splits we found run from 70% to 95%.

Contents

1Ransomware in 2026: 9,203 Claims, 177 Groups and Splits up to 95%
2Ransomware Negotiation for Sale: Staff, Affiliates and Portals
3EDR Killer Offers in 2026: Builds, Custom Work and Limited Slots
4RAMP Forum Seizure: Two Ransomware Crews Announced Forum Partnerships
5Where Ransomware Data Reappears After Alleged Failed Talks
6Ransomware Builder Prices in 2026: Changing Packages in 59 Days
7Ransomware Affiliate Terms: Shares, Entry Gates and Different Responsibilities
8Method and evidence boundaries

Edition 1.3

Brandefense Cybercrime Report 2026 · Ransomware Advertised Work and Concentrated Claims. Seven complete investigations: programme roles, entry conditions, distribution and different tool rights beside 9,203 canonical claims from 177 groups.

Cybercrime Report 2026Edition 1.3

Web edition Full-year PDF · early 2027

Free Download

Get Ransomware Report.

The complete ransomware chapter: analysis, original charts, source notes and collection limits.

PDF

Full-year edition The full-year PDF edition follows in early 2027.

HTML 99.8 KB

Accessible HTML Edition Contains the complete investigations, chart sources and aggregate tables.

Ransomware 2026: Full Research Edition Open the accessible edition

Data kit 74.9 KB

Data & Dictionary Definitions, units and checks for the downloadable aggregate files.

CSV · JSON · UTF-8 Open the data dictionary

Data kit files monthly-claims.csv324 B group-claims.csv5.0 KB group-monthly-claims.csv34.7 KB ransomware-data.json34.9 KB

Edition 1.3 · 1 Jan–27 Oct 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.

01Inside The Report

Seven Ransomware Investigations. Read From The Ads, Not Only The Claims.

Public trackers list who was claimed. This report puts the crews’ own recruitment posts next to the claims: what they offer partners, what they charge, and the rules they publish.

Two results inside: 33 of 177 groups account for 5,950 of 9,203 canonical claims (64.7%); selected programme descriptions assign negotiation to different roles. The full-year PDF edition follows in early 2027. The accessible HTML edition contains the complete investigations, chart sources and aggregate tables.

64.7% 33 of 177 groups account for 5,950 of 9,203 canonical claims.

5,950 claims · 33 groups9,203 claims

02From The Report

Two Tables You Get In The Report.

Report table Data · advertised-splits.csv1.3 KB

What Crews Offered Partners

As stated by the seller

GroupAd first seenPartner shareEntry fee or other cost

Nova 2.0 22 Apr 75%, rising to 85% after five months, 90% after a year and 95% above 1M (currency not stated) Not stated

Gunra 11 Apr 85% (operator fee 15%, lower by target) Not stated

The Gentlemen 15 May 90% $1,500 refundable deposit or files from a prepared target

KittyKatKrew 1 Jun 90% $200 for the stub; optional negotiation portal $100 setup + $30 a month

CRPX0 1 Jul 70% (commission on every successful payment) Not stated

FLOCKER 7 Oct 90% $170 invitation fee

VanHelsing kit (resold) 6 Mar 80% (claimed) $5,000 deposit (claimed); the kit itself was advertised for 700 Telegram Stars

Nova 2.022 Apr

Partner share: 75%, rising to 85% after five months, 90% after a year and 95% above 1M (currency not stated)
Entry fee or other cost: Not stated

Gunra11 Apr

Partner share: 85% (operator fee 15%, lower by target)
Entry fee or other cost: Not stated

The Gentlemen15 May

Partner share: 90%
Entry fee or other cost: $1,500 refundable deposit or files from a prepared target

KittyKatKrew1 Jun

Partner share: 90%
Entry fee or other cost: $200 for the stub; optional negotiation portal $100 setup + $30 a month

CRPX01 Jul

Partner share: 70% (commission on every successful payment)
Entry fee or other cost: Not stated

FLOCKER7 Oct

Partner share: 90%
Entry fee or other cost: $170 invitation fee

VanHelsing kit (resold)6 Mar

Partner share: 80% (claimed)
Entry fee or other cost: $5,000 deposit (claimed); the kit itself was advertised for 700 Telegram Stars

Six programme ads plus one separate kit resale (VanHelsing), as in the report’s split table. Dates are when we first saw the post, 2026.

Report · Price list Data · advertised-prices.csv2.2 KB

Selected Asking Prices

As written, no currency named

$890 "Industrial" ransomware builder 23 Apr 2026
$50 Ransomware builder with decryptor and web panel 29 Apr 2026
$100 + $30/mo Hosted negotiation portal (KittyKatKrew) 1 Jun 2026
$5,000 White-label RaaS platform, buyer keeps all profit (CRPX0) 23 Jul 2026
$550 Standalone EDR killer (CRPX0) 18 Aug 2026

In the order we first saw them. Amounts are shown as the ads give them; none of these ads names a currency, so we do not convert or rank them. Selected BLACKNET-00 offers appeared in one Telegram channel. We group them for comparison; common seller identity is an inference, not an authenticated identity.

The selected 2026 ads put a price list around ransomware: partner splits advertised up to 95 percent, a negotiation portal from $100 and a builder at $50.

— Brandefense Research Team

03Who It Is For

Written For People Who Act On Ransomware.

01 Security Leaders Numbers and plain wording for a board: how many claims, how many groups, and what the crews charge.

02 SOC And Cyber Threat Intelligence (CTI) Teams Group-by-group findings, and a checklist for the day your name or a supplier appears in a claim.

03 Incident Response Teams The pressure rules and negotiation offers the crews publish, and the limits of public-signal timing.

04 Risk And GRC Teams What a claim is and is not: claims, not confirmed breaches, with every limit of the count stated.

04Method And Limits

How We Counted.

Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.

Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.

AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.

01Source: Brandefense Blackhole, our cybercrime database. It collects posts mostly from Telegram and has no direct feed of ransomware leak sites; claims reach it through aggregator relay bots.
02A claim is one distinct (group, victim) pair posted on a leak site. It is not a confirmed breach.
03Period: 1 Jan to 27 Oct 2026, so October is partial. The count leaves out 190 claims from one group, 0APT, that posted in January and February and then stopped. GuidePoint assesses that its list mixed fabricated names with real organisations that were not breached; Halcyon describes inflated claims. Nine pairs of spelling variants that share victims are merged, which gives 177 groups.
04The week of 22–28 July is sampled; October is partial. After excluding 0APT, 171 duplicate group–victim pairs were removed across spelling variants.
05Ads, splits, fees and prices are attributed descriptions from the edited 60-item catalogue. Some items combine posts or threads; this selected inventory does not measure market prevalence or a complete retrieval count.