The Gentlemen and Qilin ransomware cartels trade top spot throughout 2026

The Gentlemen and Qilin ransomware cartels traded the top spot throughout 2026 as their rivalry pushed both groups to develop new attack techniques, a dynamic that coincided with 2894 ransomware attacks counted by Nord Security from July to September 2026.

Qilin recorded 363 attacks over the same span. The total represented an 8.6 percent rise from April to June 2026. The two groups traded places as the most common ransomware perpetrators throughout 2026.

The founder of The Gentlemen ran one of Qilin’s leading affiliate crews before a pay dispute, according to Nord Security. The company also observed underground forum activity about that history. Mantas Sabeckis, senior threat intelligence researcher at the company, said the founder launched a new group and recruited former colleagues with a 90 percent payout, far higher than the typical 70 percent to 80 percent.

The two cartels use methods that skip encryption and instead exfiltrate sensitive data to threaten publication unless victims pay. Stealing data is faster and simpler than encrypting it, letting one cartel strike many victims at once with less effort, according to Mantas Sabeckis of Nord Security. Encryption remains a factor, Sabeckis said.

The ways attackers get in have stayed broadly the same, including compromised passwords, missing multifactor authentication, and unpatched security vulnerabilities. Shutting down those common entry points still eliminates much of the risk, Noreika said. Noreika described the market as stabilizing and called current numbers the first stepping stone in a new era for ransomware. Action by police against groups including Lockbit, BlackCat, and RansomHub helped lower ransomware activity in 2025, according to researchers cited by Nord Security.

NCC Group’s Q2 2026 ranking and Comparitech’s first half 2026 list both placed Qilin and The Gentlemen in the top two spots among ransomware actors. Comparitech said The Gentlemen, reportedly a Qilin splinter, claimed more victims on leak sites than Qilin in June 2026. Halcyon described The Gentlemen as among the quickest-growing ransomware threats it has followed. Akira, DragonForce, Lockbit, and INC filled out the remaining spots in the top six most active ransomware actors on both lists.

Cisco Talos and ESET have observed Qilin and The Gentlemen, respectively, deploying tools that disable endpoint detection and response defenses. Affiliates have to build or obtain their own EDR killers, a major task that points to rising sophistication among threat groups.

NCC Group said Akira, Qilin, and The Gentlemen rely heavily on network edge flaws and credentials, particularly VPNs. Attackers have focused on devices from Fortinet, Citrix, and Check Point. VPNs and similar network edge equipment remain top targets for initial access.

NCC Group said June 2026 attacks rose compared with a year earlier, marking the fourth straight monthly increase. The Q2 2026 total was up 3 percent from the prior quarter.

Ransomware gangs hit the industrials sector 30 percent more than any other vertical in Q2 2026, according to NCC Group. Consumer discretionary came next at 24 percent, with information technology at 11 percent. Healthcare ranked fourth among targeted industries at 10 percent for Q2 2026.

An April 2026 ransomware attack on Signature Healthcare in Massachusetts knocked out ambulance services, canceled cancer treatments, and forced Brockton Hospital to rely on downtime procedures for weeks.

Comparitech counted 89 confirmed and 98 unconfirmed ransomware attacks against government bodies in the first half 2026. US agencies took the biggest share at 31 percent, a rate down 23 percent from 2H 2025.

Comparitech said transportation and healthcare attacks rose 52 percent and 35 percent respectively over the past six months. Retail climbed 28 percent and technology 23 percent over the same period.

KryBit, an emerging group first spotted in March 2026, offers ransomware-as-a-service on Windows, Linux, VMware ESXi, and NAS platforms, NCC Group said. Halcyon said KryBit’s operating model points to strong growth potential.

Sysdig researchers documented an autonomous artificial intelligence agent called JadePuffer that carried out a complete intrusion chain. JadePuffer relied on a large language model to adjust its actions and run more than 600 coordinated payloads. The agent gathered credentials, established persistence, and mapped internal services before encrypting configuration records, deleting original tables, and leaving a Bitcoin ransom demand. Sysdig researchers called JadePuffer the first documented example of agentic ransomware.

Palo Alto Networks said ransomware actors keep exploiting CVE-2026-0257, an authentication bypass flaw in PAN-OS and Prisma Access. The vulnerability carries a CVSS score of 7.8 and may permit unauthorized VPN connections. The vendor patched it in May 2026, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on May 13, 2026.

Unit 42 researchers said Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as INC, are exploiting CVE-2026-0257. ReliaQuest observed Qilin and Settra using CVE-2026-0257 in financially motivated attacks.

Unit 42 said attackers using CVE-2026-0257 gain an initial foothold, defeat multifactor authentication controls, and open a VPN session. Once inside through a VPN session, attackers use remote monitoring and management tools for internal reconnaissance. They then shift sideways through RDP and SMB, remote desktop and file-sharing protocols, and prepare tools for credential theft, data removal, and ransomware use.

Unit 42 said the biggest shift in tactics, techniques and procedures after exploiting CVE-2026-0257 is a direct move to the virtualization layer. In one incident, intruders went from a hacked VPN gateway to the vCenter management appliance. They switched off protections on ESXi hypervisors and used a custom tool to pull credentials offline from a domain controller’s virtual disk. The method bypasses endpoint detection and response inside guest systems and other protections, giving threat actors domain-wide credentials.

Attackers have combined CVE-2026-0257 exploitation with attempts to hit Veeam backup infrastructure through CVE-2023-27532. Arctic Wolf had previously flagged Qilin’s exploitation of CVE-2026-0257 in July 2026, describing attacks that ranged from fast encryption-only operations to full double-extortion.