The Ransomware Ecosystem in Q2 2026: More Players, Same Leaders
Analytics2026-08-21, 06:32
The Ransomware Ecosystem in Q2 2026: More Players, Same Leaders
Check Point Research published The State of Ransomware, Q2 2026. The baseline picture documented back in Q1 (we covered it earlier) has not fundamentally changed: the market is still largely shaped by major groups, while overall activity remains at historically high levels.
At the same time, several notable shifts have emerged within the ecosystem — from the expansion of the "middle tier" of groups to further changes in the economics of extortion:
-
The number of victims barely changed, but the market became slightly less concentrated. In Q2, leak sites listed 2,139 new victims — just 0.8% more than in Q1, but 33% more year over year. Meanwhile, the share of the top 10 groups fell from 71% to 57.6%, while the number of active groups rose from 71 to a record 93.
-
The Gentlemen nearly caught up with Qilin in victim count. The Qilin group has remained the leader for the fourth consecutive quarter, but its victim count fell from the previous quarter by 17% to 279. By contrast, The Gentlemen's victim count rose by 62% to 269 victims, and the group even overtook Qilin in June.
The leak from The Gentlemen's infrastructure also showed how much the barrier to entry into the upper tier of RaaS has fallen. The operation's core consisted of around nine people, while the GLOCKER control panel was developed by the group's administrator in approximately three days with the help of DeepSeek and Qwen.
-
Fewer victims are paying, so criminals are shifting toward data theft. The share of victims who paid fell to approximately 23%, compared with 85% in 2019. The average payment rose 15% to $680,000, while the median fell 7% to $301,000 — large companies can still afford to pay substantial sums, while mid-sized businesses are increasingly refusing to do so.
-
The geographic scope of attacks is gradually expanding beyond the United States. The share of US victims fell from 50% to 42% over the quarter, largely due to the growth of groups with a more global profile. We also noted earlier that this may be driven by operators' desire to conduct their activities away from jurisdictions most actively involved in international operations against cybercriminals.
Q2 highlights several significant parallel trends. Leaders retain control over a substantial share of the market, but the barrier to entry for new players is falling. Fewer victims are willing to pay, increasing the value of stolen data. In addition, law enforcement is beginning to put greater pressure on shared services relied upon by multiple groups at once (you can read more about this in the full report). The ecosystem is becoming not so much more fragmented as more accessible to new operators, while established RaaS platforms retain their advantage.
Vendors
Products