Qilin, The Gentlemen and Akira now top the most dangerous cybercrime groups

The original edition, written in January 2026, sorted the field into tiers led by Scattered Spider, LockBit, ALPHV, Clop, RansomHub and Qilin. Nine months later the order has changed: Qilin still leads on most counts but The Gentlemen passed it for part of 2026, Akira and DragonForce sit in the top five, LockBit came back, and data-theft crews such as ShinyHunters and Clop hurt victims without encrypting anything. ALPHV, RansomHub and Black Basta have not listed a victim since early 2025 or earlier.

• How the ranking is built: Z7 weighs recent leak-site volume, damage per incident, staying power under enforcement and speed of adaptation. Check Point counted 2,139 victims across 93 active groups in Q2 2026, with the top ten's share down to 57.6 percent from 71 percent, and GuidePoint found the five busiest groups claimed more than 40 percent of attacks.
• Ranks 7 to 10 and why: Clop for mass exploitation (Oracle E-Business Suite in 2025, PTC Windchill in July 2026) despite weak monetization and a September 2026 defacement of its leak site by ShinyHunters; Play, with 1,329 victims listed but lower output in Q2 2026; the INC, Lynx and Sinobi family, third among the FBI's most reported variants; Medusa and SafePay, with over 500 critical infrastructure victims for Medusa and a SafePay recovery in Q2 2026.
• Off the list and why: ALPHV (about $395 million in US-reported payments from 2022 to 2024 per FinCEN, last listed victim March 2024; two incident response professionals who acted as its affiliates were sentenced and a third pleaded guilty), RansomHub (last listed victim March 31, 2025), Black Basta (collapsed, its alleged leader on Europol and Interpol lists), BlackSuit (disrupted in a coordinated action the DOJ announced on August 11, 2025) and Scattered Spider (sentenced and effectively halted).
• Fewer victims pay, so groups push volume and data theft: Chainalysis measured over $820 million in 2025 payments, down 8 percent, and Coveware recorded a record low payment rate in Q2 2026 with a median payment of $150,000.
• Enforcement is landing on infrastructure and on travelers, not on Russia-based leaders: Europol's Endgame actions hit loaders and stealers in November 2025 and June 2026, Treasury sanctioned the Media Land bulletproof host, Project Compass produced 30 arrests in The Com, and suspects were detained in Japan, Greece and Finland.
• The FBI's 2025 report counts $20.877 billion in losses across 1,008,597 complaints, up 26 percent, and ranks the ten most reported ransomware variants: Akira, Qilin, INC/Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay and Medusa.

Any organization with internet-facing VPN or firewall appliances, a help desk that resets credentials by phone, or a virtualized server estate is a candidate, and the mid-market is as exposed as the enterprise.

• Manufacturing, professional services, technology, healthcare and retail lead 2026 leak-site listings, with 1,405, 1,330, 1,050, 727 and 602 listings so far this year.
• Government and education organizations: 283 government and defense and 270 education listings in 2026, the FBI says its top ten variants most affected critical manufacturing, healthcare and public health, and government facilities, and in August 2026 the ATF confirmed a breach of a standalone system after Qilin listed the agency.
• Smaller firms outside critical sectors, where the FBI's non-critical complaints came mostly from legal services (18 percent), contractors (17 percent) and engineering firms (10 percent).
• Organizations running unpatched enterprise applications: Oracle E-Business Suite and PTC Windchill for Clop, Oracle PeopleSoft for ShinyHunters (a zero-day that Mandiant and Google reported in September 2026, per Krebs on Security), and any VPN gateway on the CISA exploited list.
• Customers of managed service providers and outsourced help desks, which DragonForce and ShinyHunters-branded crews use as a way in.

In priority order, highest impact first.

1. 01

   Do firstPatch, inventory and harden every internet-facing VPN, firewall and remote access gateway (Check Point, Palo Alto, SonicWall, Fortinet, Cisco), reset credentials on devices that ever ran vulnerable firmware, and enforce MFA.

   Qilin, Akira and The Gentlemen all enter through these devices, and patched systems have carried live attacker sessions.

2. 02

   Move administrator, VPN and remote management access to phishing-resistant MFA (FIDO2 keys or passkeys) and remove SMS and push approval for admins.

   ShinyHunters-branded vishing captures one-time codes and registers the attacker's own device.

3. 03

   Require callback verification and manager approval before any password or MFA reset, including by your outsourced help desk, and rehearse the vishing call.

   Help desk impersonation is the entry point for the crews that inherited Scattered Spider's playbook.

4. 04

   Keep immutable, offline backups, separate backup credentials, and harden ESXi and Veeam hosts.

   Akira, The Gentlemen and DragonForce target hypervisors and backup servers to make recovery fail.

5. 05

   Turn on EDR tamper protection and the Microsoft vulnerable driver blocklist, and alert on driver loads, security tool stops and event log clearing.

   EDR killers and signed vulnerable drivers are standard in Akira and The Gentlemen cases.

6. 06

   Patch and hunt on enterprise and file-transfer applications within days: Oracle E-Business Suite and PeopleSoft, PTC Windchill and any managed file transfer product.

   Clop and ShinyHunters monetize mass exploitation and data theft without encrypting anything.

7. 07

   Audit SaaS tenants and vendor access, including Salesforce guest permissions, MSP remote monitoring tools and contractor accounts.

   DragonForce and ShinyHunters-branded crews reach victims through providers and misconfigured cloud apps.

8. 08

   If nobody watches VPN logins, sign-on anomalies and backups overnight, Z7's 24/7 SOC and Microsoft 365 posture review cover that gap.

   Breakout from first access to encryption is measured in days at best and often happens outside business hours.