Ransomware victim concentration remained dominated by the top five operations
Trend
Summary
Hide ▲
Show ▼
Ransomware victimization remained concentrated across March 2025 to March 2026, with 7,551 public disclosed victims and the top five operations responsible for 44% of them. A small set of groups continued to account for a disproportionate share of extortion harm against organizations. The pattern shows that ransomware impact was still being driven by a few high-volume operators even as the wider ecosystem kept changing.
Related Happenings
Higher education ransomware attacks rose in H1 2026
Trend
H score86
First: 24.07.2026 12:15
Last: 24.07.2026 12:15
Sources 1
About this happening:
Ransomware attacks on higher education providers rose 8% in H1 2026, increasing disruption and extortion risk across universities and colleges. The period also saw...
Higher education ransomware attacks rose in H1 2026
TrendAbout this happening: Ransomware attacks on higher education providers rose 8% in H1 2026, increasing disruption and extortion risk across universities and colleges. The period also saw...
AI is increasing ransomware effectiveness against ransomware-hit organizations
Trend
H score33
First: 23.07.2026 11:00
Last: 23.07.2026 11:00
Sources 1
About this happening:
A Proofpoint survey found AI is making ransomware more effective against ransomware-hit organizations, increasing the risk of successful phishing, impersonat...
AI is increasing ransomware effectiveness against ransomware-hit organizations
TrendAbout this happening: A Proofpoint survey found AI is making ransomware more effective against ransomware-hit organizations, increasing the risk of successful phishing, impersonat...
Ransomware ecosystem fragments as new groups emerge weekly
Threat Actor Meta
H score47
First: 21.07.2026 16:00
Last: 21.07.2026 16:00
Sources 1
How related:
More than one new ransomware group is appearing every week as the criminal ecosystem surrounding extortion attacks becomes increasingly more fragmented and continues to expand.
About this happening:
Ransomware operations are fragmenting and expanding, with more than one new group per week entering the market and increasing extortion volatility. As of June 2026...
Ransomware ecosystem fragments as new groups emerge weekly
Threat Actor MetaHow related: More than one new ransomware group is appearing every week as the criminal ecosystem surrounding extortion attacks becomes increasingly more fragmented and continues to expand.
About this happening: Ransomware operations are fragmenting and expanding, with more than one new group per week entering the market and increasing extortion volatility. As of June 2026...
Qilin consolidates into dominant RaaS position as ransomware market reconcentrates
Threat Actor Meta
H score39
First: 03.07.2026 16:00
Last: 03.07.2026 16:00
Sources 1
About this happening:
Qilin is consolidating into a dominant RaaS position as the ransomware ecosystem shifts back from fragmentation to concentration, increasing affiliate scale and victim vol...
Qilin consolidates into dominant RaaS position as ransomware market reconcentrates
Threat Actor MetaAbout this happening: Qilin is consolidating into a dominant RaaS position as the ransomware ecosystem shifts back from fragmentation to concentration, increasing affiliate scale and victim vol...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor Meta
H score26
First: 10.06.2026 17:03
Last: 10.06.2026 17:03
Sources 1
About this happening:
The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor MetaAbout this happening: The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
Timeline
-
21.07.2026 16:00 2 articles · 13d ago
Black Kite finds top ransomware groups accounted for 44% of 7,551 victims
Campaign Scope UpdateBlack Kite's Ransomware Report 2026 says ransomware victimization remained concentrated between March 2025 and March 2026, with the top five operations accounting for 44% of 7,551 public disclosed victims. Qilin led the period with 1,358 victims, followed by Akira, INC Ransom, Play, and SafePay, showing that a small set of operators continued to drive much of the observed harm even as the broader ecosystem fragmented.
Show sources
- A New Ransomware Threat Actor Emerges Every Week, Warns Report — www.infosecurity-magazine.com — 21.07.2026 16:00
- A New Ransomware Threat Actor Emerges Every Week, Warns Report — www.infosecurity-magazine.com — 21.07.2026 16:00