ReportRansomware Trends ReportsThreat Intelligence Researches
Published 9 Jul 2026Updated 18 Oct 2026
2,509 Confirmed Victims. 91 Active Ransomware Groups. One Quarter.
The Ransomware Trends Report Q2 2026 analyzes 2,509 confirmed ransomware incidents from one quarter. It reports that ransomware activity rose 17.5% compared with the previous quarter, with 91 active threat groups. It also covers which groups gained momentum, which industries were targeted, MITRE ATT&CK techniques, and predictions for Q3 2026.
Key Findings of the Ransomware Trends Report Q2 2026
The report covers ransomware activity in the second quarter of 2026 (period ending July 3, 2026). It monitored 2,509 victim posts from 91 threat actor groups, all confirmed as incidents.
- Confirmed incidents rose 17.5% from 2,135 in Q1 2026 to 2,509 in Q2 2026, and active groups rose from 68 to 91.
- Qilin led with 305 victims (12.2%), followed by TheGentlemen (239, up 30.6% from Q1) and Akira (169).
- Business services overtook manufacturing as the most targeted sector, with 384 victims against 291 for manufacturing and 290 for technology.
- The United States accounted for 1,064 victims (42.4%), followed by Germany (112) and Canada (109).
- Monthly victim posts rose from 750 in April to 840 in May and 919 in June.
- DragonForce (144 victims) and Lockbit5 (115) entered the top five, replacing IncRansom and Cl0p.
The full PDF adds a forecast for Q3 2026, strategic recommendations by time frame, MITRE ATT&CK technique mapping and indicators of compromise for the five most active groups.
The ransomware ecosystem didn’t slow down in Q2; it accelerated.
Discover which threat groups gained momentum, why attackers shifted toward new industries, and what the latest intelligence reveals about the campaigns expected to shape Q3 2026.
Ransomware activity increased 17.5% compared to the previous quarter. Behind that growth are 91 active threat groups, rapidly shifting affiliate ecosystems, new sector targeting strategies, and increasingly sophisticated attack techniques.
The Brandefense Ransomware Trends Report Q2 2026 analyzes 2,509 confirmed ransomware incidents to reveal who is driving today’s campaigns, where attackers are focusing next, and what security teams should prioritize before Q3.
What Does the Ransomware Trends Report Q2 2026 Cover?
- Why ransomware activity surged 17.5% in a single quarter
- The operators gaining momentum beyond Qilin and Akira
- Why Business Services overtook Manufacturing as the #1 target
- Which countries and industries face the highest risk
- MITRE ATT&CK techniques used by today’s most active ransomware groups
- Strategic recommendations to reduce ransomware exposure before attackers strike
Why This Report Matters
Threat actors are adapting faster than ever.
Affiliate programs continue to mature, attack volumes keep climbing, and ransomware operators are expanding into new industries while refining their techniques. Relying on historical data is no longer enough.
This report provides a data-driven view of the current ransomware landscape, helping CISOs, SOC teams, and security leaders understand where the ecosystem is heading and how to prepare for what comes next.
Frequently Asked Questions.
- What is the Ransomware Trends Report Q2 2026?+
It is a quarterly report that analyzes 2,509 confirmed ransomware incidents. It covers active groups, targeted industries and countries, MITRE ATT&CK techniques and Q3 predictions.
- How much did ransomware activity grow in Q2 2026?+
The report says activity increased 17.5% compared with the previous quarter. It counts 91 active threat groups.
- Which industry was targeted most?+
According to the report, Business Services overtook Manufacturing as the number one target.
- What is ransomware?+
CISA describes ransomware as malware designed to encrypt files on a device, making them and the systems that rely on them unusable. MITRE ATT&CK describes the encryption step as Data Encrypted for Impact.