Guest Post: Ransomware attacks surge 50% year-over-year as The Gentlemen and Qilin amplify attacks
The latest ransomware report reveals that attacks have reached an all-time high, signaling a shift from a volatile, unstable landscape to a booming market where new players regularly emerge — it’s a golden age for attackers.
● 2,894 ransomware incidents were recorded from July to September 2026, up 50% from Q3 2025 and 8.6% from Q2 2026.
● The Gentlemen and Qilin have both ramped up their activity sharply, reaching 383 and 363 attacks respectively.
● Our expert issues a warning for the last months of 2026: In Q4 2025, ransomware actors ramped up attacks, exploiting end-of-year vulnerabilities, and are likely to take advantage of seasonal weaknesses this year as well.
The latest findings from NordLayer Intelligence by NordStellar, a threat exposure management platform, reveal that ransomware attacks reached record highs in Q3 2026. Experts warn these findings show the ransomware market has moved past its volatile, rebuilding phase and became a thriving landscape that now enables attacks at unprecedented scale.
According to findings from NordLayer Intelligence, 2,894 ransomware incidents were recorded from July to September 2026. The number reflects a 50% year-over-year increase from the 1,933 attacks recorded in Q3 2025 and a 8.6% increase in attacks from Q2 2026 (2,664 incidents). The latest Q3 2026 attack numbers mark an all-time high for ransomware across NordLayer Intelligence’s monitoring, which dates back to 2020.
“A year ago, the ransomware ecosystem was still rebuilding after LockBit’s takedown, and the shutdowns of BlackCat and RansomHub left affiliates without a home,” says Vakaris Noreika, cybersecurity expert at NordLayer Intelligence. “Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era. The market has found its footing — going forward, it’s likely that even more new players will emerge, and attack numbers will continue to climb.”
The Gentlemen and Qilin amplify attacks
A thriving market has allowed ransomware groups to grow and new threat actors to emerge, fueling competition. Findings from NordLayer Intelligence show that two groups alone accounted for 746 attacks this quarter: The Gentlemen with 383 and Qilin with 363.
“The rivalry between The Gentlemen and Qilin plays out like a 1980s soap opera,” explains Mantas Sabeckis, cybersecurity expert at Nord Security, a global cybersecurity powerhouse. “Based on underground forum activity we observed, The Gentlemen’s founder appears to have previously run one of Qilin’s top affiliate crews before a dispute over an unpaid cut, which he took to an underground forum and lost. His answer was to start a new group and lure his former colleagues away with a 90% payout, well above the usual 70% to 80%. This quarter, the breakaway The Gentlemen group edged past Qilin by 20 attacks.”
Sabeckis notes that beyond the fight for dominance, evolving techniques are another driver of rising attack numbers. He explains that some extortion groups are skipping encryption entirely to save time.
“Stealing data is faster and simpler, so one group can hit many victims at once with far less effort,” says Sabeckis. “This shift is likely a big part of why attack volumes keep climbing. But that doesn’t mean encryption is going away. Some groups still lock files and nothing else, others combine encryption with data extortion, and a growing number, like Cl0p, skip encryption entirely, betting that the threat of a leak is enough to force the target of the attack to pay the ransom.”
A warning for the end of the year
According to data analyzed by NordLayer Intelligence, small and medium-sized businesses (SMBs) with up to 200 employees and under $25 million in revenue, operating in the manufacturing sector, remain the most targeted by ransomware attacks — a trend expected to hold through year-end as well.
“Attackers follow the money, so the strongest economies remain the biggest targets. North America accounted for almost half of all attacks we could locate, and Europe for more than a quarter, which means nearly three in four attacks hit those two regions alone,” says Sabeckis.
Noreika urges companies to stay on high alert for the remaining months of 2026. Last year, ransomware attacks peaked in Q4 as threat actors exploited end-of-year vulnerabilities and holiday staff shortages — the same seasonal weaknesses they are likely to exploit this year.
“There’s no single ransomware model to defend against anymore,” says Noreika. “INC Ransom has stayed in the top five groups all year by concentrating its attacks, hitting a run of law firms in quick succession. Akira relies on speed instead, exploiting exposed VPN credentials and weak multi-factor authentication to encrypt data within hours, a method it has used against small firms for over a year. Each approach needs a different defense, which is a heavy load for small businesses that often don’t have a dedicated security team.”
Still, Noreika notes that while attack methods are multiplying, the doors attackers use have barely changed. “The names on the most prolific ransomware group list regularly change, but the way they get in doesn’t,” he says. “Stolen logins protected by weak multi-factor authentication keep working, and known vulnerabilities in widely used enterprise products remain one of the most common entry points. What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk.”
Methodology
NordLayer Intelligence continuously monitors over 200 blogs run by ransomware groups, with incidents observed as early as 2020. Analyzing the listings published by attackers, NordLayer Intelligence discovered 2,894 ransomware attacks from July to September 2026. The full methodology can be found in the report, located here: https://nordlayer.com/intelligence/ransomware-statistics/.
ABOUT NORDLAYER INTELLIGENCE
NordLayer Intelligence by NordStellar is a next-generation threat exposure management platform that helps companies to detect and respond to cyber threats before they escalate. NordLayer Intelligence offers visibility into how threat actors work and what they do with compromised data. NordLayer Intelligence was created by Nord Security, a global cybersecurity powerhouse behind one of the world’s most popular digital privacy tools, NordVPN. For more information, visit nordlayer.com/intelligence/.
This entry was posted on October 21, 2026 at 9:10 am and is filed under Commentary with tags NordLayer. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Guest Post: Ransomware attacks surge 50% year-over-year as The Gentlemen and Qilin amplify attacks
The latest ransomware report reveals that attacks have reached an all-time high, signaling a shift from a volatile, unstable landscape to a booming market where new players regularly emerge — it’s a golden age for attackers.
● 2,894 ransomware incidents were recorded from July to September 2026, up 50% from Q3 2025 and 8.6% from Q2 2026.
● The Gentlemen and Qilin have both ramped up their activity sharply, reaching 383 and 363 attacks respectively.
● Our expert issues a warning for the last months of 2026: In Q4 2025, ransomware actors ramped up attacks, exploiting end-of-year vulnerabilities, and are likely to take advantage of seasonal weaknesses this year as well.
The latest findings from NordLayer Intelligence by NordStellar, a threat exposure management platform, reveal that ransomware attacks reached record highs in Q3 2026. Experts warn these findings show the ransomware market has moved past its volatile, rebuilding phase and became a thriving landscape that now enables attacks at unprecedented scale.
According to findings from NordLayer Intelligence, 2,894 ransomware incidents were recorded from July to September 2026. The number reflects a 50% year-over-year increase from the 1,933 attacks recorded in Q3 2025 and a 8.6% increase in attacks from Q2 2026 (2,664 incidents). The latest Q3 2026 attack numbers mark an all-time high for ransomware across NordLayer Intelligence’s monitoring, which dates back to 2020.
“A year ago, the ransomware ecosystem was still rebuilding after LockBit’s takedown, and the shutdowns of BlackCat and RansomHub left affiliates without a home,” says Vakaris Noreika, cybersecurity expert at NordLayer Intelligence. “Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era. The market has found its footing — going forward, it’s likely that even more new players will emerge, and attack numbers will continue to climb.”
The Gentlemen and Qilin amplify attacks
A thriving market has allowed ransomware groups to grow and new threat actors to emerge, fueling competition. Findings from NordLayer Intelligence show that two groups alone accounted for 746 attacks this quarter: The Gentlemen with 383 and Qilin with 363.
“The rivalry between The Gentlemen and Qilin plays out like a 1980s soap opera,” explains Mantas Sabeckis, cybersecurity expert at Nord Security, a global cybersecurity powerhouse. “Based on underground forum activity we observed, The Gentlemen’s founder appears to have previously run one of Qilin’s top affiliate crews before a dispute over an unpaid cut, which he took to an underground forum and lost. His answer was to start a new group and lure his former colleagues away with a 90% payout, well above the usual 70% to 80%. This quarter, the breakaway The Gentlemen group edged past Qilin by 20 attacks.”
Sabeckis notes that beyond the fight for dominance, evolving techniques are another driver of rising attack numbers. He explains that some extortion groups are skipping encryption entirely to save time.
“Stealing data is faster and simpler, so one group can hit many victims at once with far less effort,” says Sabeckis. “This shift is likely a big part of why attack volumes keep climbing. But that doesn’t mean encryption is going away. Some groups still lock files and nothing else, others combine encryption with data extortion, and a growing number, like Cl0p, skip encryption entirely, betting that the threat of a leak is enough to force the target of the attack to pay the ransom.”
A warning for the end of the year
According to data analyzed by NordLayer Intelligence, small and medium-sized businesses (SMBs) with up to 200 employees and under $25 million in revenue, operating in the manufacturing sector, remain the most targeted by ransomware attacks — a trend expected to hold through year-end as well.
“Attackers follow the money, so the strongest economies remain the biggest targets. North America accounted for almost half of all attacks we could locate, and Europe for more than a quarter, which means nearly three in four attacks hit those two regions alone,” says Sabeckis.
Noreika urges companies to stay on high alert for the remaining months of 2026. Last year, ransomware attacks peaked in Q4 as threat actors exploited end-of-year vulnerabilities and holiday staff shortages — the same seasonal weaknesses they are likely to exploit this year.
“There’s no single ransomware model to defend against anymore,” says Noreika. “INC Ransom has stayed in the top five groups all year by concentrating its attacks, hitting a run of law firms in quick succession. Akira relies on speed instead, exploiting exposed VPN credentials and weak multi-factor authentication to encrypt data within hours, a method it has used against small firms for over a year. Each approach needs a different defense, which is a heavy load for small businesses that often don’t have a dedicated security team.”
Still, Noreika notes that while attack methods are multiplying, the doors attackers use have barely changed. “The names on the most prolific ransomware group list regularly change, but the way they get in doesn’t,” he says. “Stolen logins protected by weak multi-factor authentication keep working, and known vulnerabilities in widely used enterprise products remain one of the most common entry points. What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk.”
Methodology
NordLayer Intelligence continuously monitors over 200 blogs run by ransomware groups, with incidents observed as early as 2020. Analyzing the listings published by attackers, NordLayer Intelligence discovered 2,894 ransomware attacks from July to September 2026. The full methodology can be found in the report, located here: https://nordlayer.com/intelligence/ransomware-statistics/.
ABOUT NORDLAYER INTELLIGENCE
NordLayer Intelligence by NordStellar is a next-generation threat exposure management platform that helps companies to detect and respond to cyber threats before they escalate. NordLayer Intelligence offers visibility into how threat actors work and what they do with compromised data. NordLayer Intelligence was created by Nord Security, a global cybersecurity powerhouse behind one of the world’s most popular digital privacy tools, NordVPN. For more information, visit nordlayer.com/intelligence/.
Share this:
Like this:
Related
This entry was posted on October 21, 2026 at 9:10 am and is filed under Commentary with tags NordLayer. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.