Ransomware is a form of malware that encrypts files on a device, making the files and the systems that rely on them unusable. CISA notes that attackers also steal victim data and threaten to release it, known as double extortion. MITRE ATT&CK lists the encryption step as Data Encrypted for Impact (T1486). This page introduces the Brandefense Ransomware Trends Report Q3 2026.
2,898 Confirmed Victims. 109 Active Ransomware Groups. One Quarter.
Ransomware activity didn’t just continue in Q3; it widened.
Discover which threat groups gained momentum, why attackers shifted toward new industries, and what the latest intelligence reveals about the campaigns expected to shape Q4 2026.
According to the report, confirmed ransomware incidents increased 15.5% compared to Q2 2026 (2,509). Behind that growth are 109 active threat groups, a tightening race at the top, and a broader field of mid-sized operators.
Key Findings of the Ransomware Trends Report Q3 2026
The report covers ransomware activity in the third quarter of 2026 (period ending October 1, 2026). It collected 3,152 raw victim posts, excluded 254 duplicate, masked or non-victim records, and analysed the remaining 2,898 confirmed incidents from 109 groups.
- Confirmed incidents rose 15.5% from 2,509 in Q2 2026 to 2,898 in Q3 2026, and active groups rose from 91 to 109.
- Qilin led with 366 victims and TheGentlemen followed with 353. The gap between them shrank from 66 victims in Q2 to 13.
- Manufacturing returned to first place with 435 victims (15.1%), ahead of technology (362) and business services (340). Education rose from 112 to 214 victims.
- The United States accounted for 1,173 victims (40.5%), followed by Germany (149) and Canada (106).
- Cl0p rose from 3 victims in Q2 2026 to 74 in Q3. The report ties the disclosures to exploitation of a PTC Windchill/FlexPLM zero-day (CVE-2026-12569).
- Monthly victim posts went from 953 in July to 1,113 in August and 832 in September.
The full PDF adds a forecast for Q4 2026, strategic recommendations by time frame, MITRE ATT&CK technique mapping and indicators of compromise for the five most active groups.
The Brandefense Ransomware Trends Report Q3 2026 analyzes 2,898 confirmed ransomware incidents to reveal who is driving today’s campaigns, where attackers are focusing next, and what security teams should prioritize before Q4.
What You’ll Discover
- How TheGentlemen closed the gap with Qilin from 66 victims to 13
- Why Manufacturing returned as the #1 target (435 victims)
- How Cl0p went from 3 victims in Q2 to 74 in Q3
- Why Education nearly doubled (112 → 214)
- MITRE ATT&CK techniques for Qilin, TheGentlemen, INC Ransom, Deadlock and Akira
- Strategic recommendations and our Q4 2026 forecast
Why Does This Ransomware Report Matter?
Threat actors are adapting faster than ever.
Affiliate programs continue to mature, attack volumes keep climbing, and ransomware operators are expanding into new industries while refining their techniques. Relying on historical data is no longer enough.
This report provides a data-driven view of the current ransomware landscape, helping CISOs, SOC teams, and security leaders understand where the ecosystem is heading and how to prepare for what comes next.
For a month-by-month view built from Atlas leak-site data, read Ransomware in September 2026.
