Reports. In‑Depth Research.
Quarterly ransomware trend reports, malware technical analyses and country reports from the Brandefense research team.
Latest Reports
Ransomware Trends Report | Q3 2026
The Brandefense Ransomware Trends Report Q3 2026 analyzes 2,898 confirmed ransomware incidents across 109 active threat groups, covering top operators, sector and country targeting, MITRE ATT&CK techniques, and Q4 forecasts.
Read The Report →Ransomware Trends Report | Q2 2026
Ransomware in U.S. Healthcare: Threat Landscape, Impact, and Mitigation Strategies
Ransomware Trends Report | Q1 2026
Fog Ransomware Technical Analysis
All Reports. Three Groups.
64- Mint Stealer Technical Analysis
- Ransomware Trends Report | Q1 2025
- BlackBasta Ransomware Technical Analysis
- KageNoHitobito Ransomware Technical Analysis
- UNC1549 MINIBUS Backdoor Technical Analysis
- Ransomware Trends Report | Q4 2025
- Xeno Rat Technical Analysis
- Phemedrone Stealer Technical Analysis
- Cactus Ransomware Technical Analysis
- Ransomware Trends Report | Q3 2024
- Sandworm’s New Arsenal: Kapeka Backdoor Technical Analysis
- Gotham Stealer Technical Analysis
- Indonesia Cybersecurity Threat Landscape and Strategic Insights: Mid-Year 2024
- Technical Analysis of Cylance Ransomware
- Ransomware Trends Report | Q2 2024
- Invicta Stealer Technical Analysis
- APT34’s New Backdoor SideTwist Variant Technical Analysis
- Private Loader as a RisePro Stealer Dropper Technical Analysis
- Technical Analysis of Mystic Stealer
- Technical Analysis of Snatch Ransomware
- Ransomware Trends Report | Q1 2024
- Echida Stealer Technical Analysis
- Godfather Android Banking Trojan Technical Analysis
- Technical Analysis of Stop/Djvu Ransomware
Questions and answers
01What reports does Brandefense publish?
Three kinds: the quarterly Ransomware Trends Report, malware analysis reports on single malware families, and country reports on the threats facing one market.
02How often does the Ransomware Trends Report come out?
Every quarter. The newest edition on this page is Q3 2026, published in October 2026.
03Do I have to fill in a form to get a report?
The Ransomware Trends Reports and the country reports ask for a short form before the PDF opens. The malware analysis reports are not behind a form.
04What does a malware analysis report cover?
Each one is a technical analysis of one malware family or ransomware strain, for example the Fog Ransomware, Strela Stealer and Grandoreiro Trojan analyses.
05How do I get new reports by email?
Use the email box in the Our Research, By Email section on this page and tick the consent box.
06Where can I find official ransomware guidance?
CISA runs the StopRansomware program and the FBI IC3 publishes annual reports. Both are linked here.
CISA StopRansomware ↗FBI IC3 ↗07How many reports are on the Reports page?
The page currently lists 64 public reports: 6 Country Reports, 15 Ransomware Trends Reports, 43 Malware Analysis Reports.
08What does the Q3 2026 Ransomware Trends Report cover?
It analyzes 2,898 confirmed ransomware incidents across 109 active threat groups. It covers top operators, sector and country targeting, and MITRE ATT&CK. It was published in October 2026.
09How did ransomware activity change between Q2 and Q3 2026?
The Q2 2026 report analyzes 2,509 confirmed incidents across 91 active groups. The Q3 2026 report analyzes 2,898 incidents across 109 groups. Both reports are listed on the Reports page.
10Is there a report on ransomware in healthcare?
Yes. The report is called Ransomware in U.S. Healthcare: Threat Landscape, Impact, and Mitigation Strategies. It is listed on the Reports page.
Research Is General. Your Exposure Is Not.
A demo of the platform, run on your own domain.
Request A Demo →