Ransomware Trends Report | Q3 2026

2,898 Confirmed Victims. 109 Active Ransomware Groups. One Quarter.

Ransomware activity didn’t just continue in Q3; it widened.

Discover which threat groups gained momentum, why attackers shifted toward new industries, and what the latest intelligence reveals about the campaigns expected to shape Q4 2026.

Confirmed ransomware incidents increased 15.5% compared to Q2 2026 (2,509). Behind that growth are 109 active threat groups, a tightening race at the top, and a broader field of mid-sized operators.

The Brandefense Ransomware Trends Report Q3 2026 analyzes 2,898 confirmed ransomware incidents to reveal who is driving today’s campaigns, where attackers are focusing next, and what security teams should prioritize before Q4.

What You’ll Discover

• How TheGentlemen closed the gap with Qilin from 66 victims to 13
• Why Manufacturing returned as the #1 target (435 victims)
• How Cl0p went from 3 victims in Q2 to 74 in Q3 (vendor reporting links it to a PTC Windchill/FlexPLM zero-day)
• Why Education nearly doubled (112 → 214)
• MITRE ATT&CK techniques for Qilin, TheGentlemen, INC Ransom, Deadlock and Akira
• Strategic recommendations and our Q4 2026 forecast

Why This Report Matters

Threat actors are adapting faster than ever.

Affiliate programs continue to mature, attack volumes keep climbing, and ransomware operators are expanding into new industries while refining their techniques. Relying on historical data is no longer enough.

This report provides a data-driven view of the current ransomware landscape, helping CISOs, SOC teams, and security leaders understand where the ecosystem is heading and how to prepare for what comes next.