Rival Ransomware Gangs Fuel Surge in Attacks, Shifting Tactics to Data Theft
Ransomware attacks saw a 50% year-over-year increase in Q3 2026, driven by intense competition between The Gentlemen and Qilin gangs who are increasingly prioritizing data exfiltration over encryption.
Ransomware attacks experienced a significant surge in the third quarter of 2026, with nearly 3,000 incidents recorded between July and September. This figure represents a 50% increase compared to the same period in the previous year, according to analysis by Nord Security. The quarter also saw a slight rise of 8.6% in attacks compared to the preceding April-to-June period, indicating an escalating threat landscape.
Researchers attribute this uptick in ransomware activity, in part, to the stabilization of the market following successful law enforcement takedowns of major groups like Lockbit, BlackCat, and RansomHub in 2025. While these actions temporarily curbed activity, the current numbers suggest a "new era" for ransomware, with threat actors adapting and regrouping.
The most prolific ransomware groups during this period were identified as The Gentlemen and Qilin, who have been vying for dominance throughout 2026. The Gentlemen accounted for 383 attacks, while Qilin was close behind with 363. Inc Ransom followed as the third most active, with other notable groups including Krybit, Akira, Deadlock, and Clop Leaks each conducting nearly 100 attacks.
This intense rivalry between The Gentlemen and Qilin is reportedly pushing both groups to innovate their attack techniques to capture more victims. Intelligence suggests a personal dispute may have fueled the creation of The Gentlemen, with its founder allegedly offering a higher payout to former affiliates of Qilin, thereby edging them out in attack volume for the quarter.
A key tactical shift observed among these leading groups is the move away from traditional data encryption. Instead, attackers are increasingly focusing on stealing sensitive data and threatening its public release unless a ransom is paid. This strategy is seen as more efficient, allowing threat actors to target a larger number of victims with less effort.
Despite the evolving methods, the initial entry points for these attacks remain largely consistent. Common vectors include the exploitation of compromised credentials, a lack of multi-factor authentication, and unpatched security vulnerabilities. Experts emphasize that closing these familiar access points remains a critical defense measure.
While the names of the most active ransomware operators may change, the fundamental pathways they exploit have remained relatively stable. The shift in post-breach tactics, however, highlights the need for organizations to bolster their data exfiltration defenses alongside traditional encryption protection measures.
The ongoing competition and adaptation within the ransomware ecosystem underscore the persistent and evolving nature of this threat. As groups like The Gentlemen and Qilin innovate, organizations must remain vigilant, focusing on foundational security practices while also preparing for sophisticated data theft and extortion schemes.