Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Ransomware-as-a-service keeps fragmenting as Qilin and The Gentlemen lead

Leak-site groups reached 93 in Q2 2026. RansomHub vanished, Qilin led four quarters and The Gentlemen overtook it, while payment rates hit record lows. Harden edge devices, identity and hypervisors now.

Download the PDF, 777 KB Talk to the SOC

At a glance

RW-06 · Ransomware ecosystem

  • 93 active leak-site groups in Q2 2026[1]
  • 2,139 leak-site victims in Q2 2026[1]
  • $820M+ on-chain ransomware payments in 2025[2]
  • 28% of victims paid in 2025, a record low[2]
Status
Active. Check Point counted 2,139 leak-site victims from 93 active groups in the second quarter of 2026, up 33 percent on a year earlier.[1]
Active groups
93 on leak sites in Q2 2026, up from 71 in Q1[1]
Top operations
Qilin 279 victims, The Gentlemen 269 and ahead of Qilin in June[1]
Payments
More than $820 million on-chain in 2025; only 28 percent of victims paid[2]
Entry points
Phishing and social engineering lead again; access is increasingly identity driven[3]
Data theft
Exfiltration in 76 percent of cases; exfiltration-only payment rate 15 percent[3]
Most reported to FBI
Akira, Qilin, then INC, Lynx and Sinobi in 2025[4]

What happened

The original edition argued that the early-2024 takedowns of ALPHV/BlackCat and LockBit split the market into many smaller operations while fewer victims paid. Both points held through 2025 and 2026, but the names at the top changed: RansomHub stopped operating in April 2025, Qilin led from the third quarter of 2025, and The Gentlemen, launched in September 2025, overtook it in June 2026. Volume stayed near record levels while the share of victims who paid fell to its lowest on record.

  • Claimed ransomware victims rose about 50 percent in 2025, the most active year on record, and Check Point logged a record 2,416 leak-site victims in the fourth quarter of 2025; the second quarter of 2026 held at 2,139, and NCC Group recorded 1,073 attacks in August 2026, the highest month of that year.
  • On-chain payments exceeded $820 million in 2025, about 8 percent below Chainalysis's restated 2024 total of $892 million; the share of victims paying fell to a record 28 percent while the median payment rose 368 percent to $59,556.
  • RansomHub, which had averaged about 75 listed victims a month, stopped operating in early April 2025; many affiliates moved to Qilin, whose monthly postings nearly doubled, and DragonForce claimed RansomHub had joined its cartel. Barracuda reports Qilin claimed more than 1,000 leak-site victims in 2025.
  • Qilin led four straight quarters through mid-2026, with 338 victims in Q1 and 279 in Q2, until The Gentlemen reached 269 in Q2 and outpaced it in June. Check Point says The Gentlemen was founded by a former Qilin affiliate and that leaked chats show a core team of about nine operators who built their management panel with AI coding assistants in about three days.
  • CISA and the FBI report Akira's claimed proceeds at about $244 million by late September 2025 and count roughly 900 entities affected by Play as of May 2025, while the FBI's IC3 ranked Akira, Qilin and INC, Lynx and Sinobi as the three most reported variants of 2025.
  • Enforcement targeted infrastructure and people: the FBI seized the RAMP ransomware forum in January 2026, an Operation Endgame phase neutralized 326 servers and 142 domains in June 2026, including the SocGholish loader often used to install ransomware, Japan arrested a 28-year-old Russian national on a German warrant over a Qilin-linked attack (Japan's police confirmed it in October 2026), and two Scattered Spider members were sentenced to five years and six months each in July 2026.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Get in through edge devices

    MITRE ATT&CK T1190 (opens in a new tab)

    Affiliates buy or exploit access: Akira likely abused a SonicWall flaw (CVE-2024-40766), Check Point assessed with medium confidence that a Qilin affiliate used a VPN authentication bypass (CVE-2026-50751), and Play-linked brokers exploited SimpleHelp. Check Point reports The Gentlemen holds roughly 14,700 pre-exploited FortiGate devices.

  2. Take over identities

    Coveware sees access shift toward identity: MFA and password-reset abuse, help desk manipulation, OAuth grants and stolen credentials. Cisco Talos traced one Qilin case to leaked administrator credentials on a VPN with no MFA.

  3. Steal data before encrypting

    Exfiltration appeared in 76 percent of Coveware's second-quarter cases. Only 15 percent of exfiltration-only victims paid, and Coveware ties its largest Q2 payments to data-theft extortion, including vishing campaigns against law firms.

  4. Evade defenses

    MITRE ATT&CK T1027 (opens in a new tab)

    Play recompiles its binary for every deployment so each hash is unique, and ReliaQuest says The Gentlemen's affiliate kit bundles an attack playbook, tunneling tools and single-host SMB encryption.

  5. Encrypt servers and hypervisors

    Play carries an ESXi variant that powers off virtual machines, and in a June 2025 incident Akira was seen encrypting Nutanix AHV virtual disks for the first time.

  6. Extort and split the proceeds

    Operators recruit affiliates to run intrusions; Akira alone claimed about $244 million in proceeds by late September 2025. Play victims receive unique contact addresses and some are called by phone.

Who is at risk

Any organization with an exposed VPN or remote management tool, a help desk that resets credentials on a phone call, or a virtual estate that cannot be restored quickly is in scope, whatever its size. The FBI says the ten most reported variants most affected critical manufacturing, healthcare and public health, and government facilities.

  • Industrial (31 percent), consumer goods and services (18 percent), healthcare (12 percent) and information technology (11 percent) led NCC Group's August 2026 attack counts, and North America took 44 percent of them.
  • CISA names a notable Akira preference for educational institutions, and says it mainly targets small and medium-sized businesses while also hitting larger ones.
  • Healthcare remains a standing target: the Qilin attack on pathology provider Synnovis in June 2024 contributed to more than 10,000 cancelled appointments, and Barracuda says Qilin affiliates are not disciplined about avoiding healthcare providers.
  • Outside critical sectors, the FBI received more than 1,400 ransomware complaints, with legal services (18 percent) and contracting services (17 percent) the most reported industries; Coveware ties a spike in large payments to vishing campaigns against law firms.
  • Organizations that hold data in cloud platforms are exposed to data-theft crews, as the 2024 Snowflake campaign showed: credentials stolen by infostealers on accounts without MFA affected well over 150 organizations.

Sectors in scope

  • Critical manufacturing
  • Industrial and consumer goods
  • Healthcare and public health
  • Government facilities
  • Education
  • Legal and professional services
  • Information technology
  • Financial services
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition8 changes

  1. RansomHub, the fastest-growing group in the original edition, stopped operating in early April 2025 with no explanation. Its affiliates, who averaged about 75 listed victims a month, largely moved to Qilin, and DragonForce claimed RansomHub had joined its cartel, a claim Check Point could not verify.

    Source 5

  2. The leaders changed. Qilin was the most prolific group for a fourth straight quarter in Q2 2026 with 279 victims, down 17 percent, while The Gentlemen rose 62 percent to 269 and outpaced Qilin in June.

    Source 1

  3. The market fragmented further. Active groups rose from 71 to 93 between Q1 and Q2 2026 and the top ten's share of victims fell from 71 percent to 57.6 percent, so the original edition's 85-plus operations is now a floor that moves each quarter.

    Source 1

  4. LockBit came back despite the 2024 takedown. LockBit 5.0 launched on the RAMP forum in September 2025, charged new affiliates a deposit of about $500, and posted 163 victims in Q1 2026, up 106 percent on Q4 2025 and fourth place overall.

    Source 6

  5. Payments fell further while attack volume rose. Chainalysis restated 2024 payments from $813 million to $892 million, put 2025 at more than $820 million (down 8 percent), recorded a payment rate of 28 percent, and said claimed victims rose 50 percent.

    Source 2

  6. Incident-response data tells a different story from leak sites. Coveware's Q2 2026 caseload was led by lone-wolf actors (17 percent), ShinyHunters (12 percent), Akira (9 percent) and The Gentlemen (8 percent); phishing and social engineering returned to the top of the entry list, and the average payment of $1.88 million sat far above the $150,000 median.

    Source 3

  7. Akira grew well past the original edition's $42 million. CISA's November 2025 update puts its claimed proceeds at about $244 million as of late September 2025, adds exploitation of SonicWall CVE-2024-40766, and records the first Akira encryption of Nutanix AHV virtual disks.

    Source 7

  8. The FBI took down the RAMP forum, first noticed on January 28, 2026. It was a hub where new and mid-tier ransomware groups advertised and where LockBit, Qilin, DragonForce and others are understood to have operated, although analysts expect little effect on top-tier groups.

    Source 8

What to do now

In priority order, highest impact first.

  1. Do firstPatch or isolate internet-facing VPNs, firewalls and remote management tools within days of a CISA Known Exploited Vulnerabilities listing, and retire end-of-support gateways.

    Akira, Qilin and Play-linked brokers each broke in through a named edge or remote-management flaw, and four of the Check Point branches affected by CVE-2026-50751 are end of support.

  2. Require phishing-resistant MFA on every VPN, email and administrative account, and use IKEv2 with machine certificate authentication on VPN gateways instead of allowing legacy clients.

    Talos found a Qilin intrusion through a VPN with no MFA, and the Check Point VPN bypass worked where machine certificates were not required.

  3. Tighten help desk identity checks for password resets, MFA changes and new device enrollment, and review OAuth app consents.

    Coveware reports access is increasingly identity driven, including help desk manipulation, MFA and password-reset abuse, and OAuth grants.

  4. Keep offline, immutable backups that include hypervisor-level copies, and test a full restore every quarter.

    Play and Akira both ship encryptors for VMware ESXi and Akira has now encrypted Nutanix AHV, so a backup on the same virtual estate is not a backup.

  5. Restrict hypervisor and backup management interfaces to a separate admin network with its own credentials.

    One compromised host can encrypt dozens of servers, and Talos documented Qilin changing ESXi root passwords and enabling SSH.

  6. Run EDR with tamper protection on servers and endpoints, and alert on bulk archiving, staging and large outbound transfers to cloud storage.

    Data theft occurs in 76 percent of cases and happens before encryption, which is the window in which an intrusion can still be stopped.

  7. Decide your ransom policy with counsel and an OFAC sanctions check before an incident, and plan notification on the assumption that stolen data will be published.

    Only 15 percent of exfiltration-only victims paid in Q2 2026, and paying does not guarantee deletion.

  8. Report incidents to the FBI and CISA and keep a current, tested incident response plan; Z7 Solutions™ provides 24/7 monitoring and Microsoft 365 posture review for mid-size organizations, school districts and public agencies.

    The FBI's IC3 relies on victim reports to act on groups such as BlackSuit, and early reporting also speeds recovery.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
behavior Ransom contact addresses at gmx.de or web.de that are unique to each victim, and a recompiled binary with a unique hash for each deployment (Play) [9]
behavior Remote access VPN gateways using IKEv1 without machine certificate authentication, and unexpected authentication bypasses on Check Point Remote Access, Mobile Access and Spark gateways (CVE-2026-50751) [10]
behavior SonicWall VPN access through CVE-2024-40766, stolen credentials or brute forcing, followed by encryption of VMware, Hyper-V or Nutanix AHV virtual disks (Akira) [7]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    The State of Ransomware, Q2 2026 (opens in a new tab) Check Point Research · August 13, 2026 · research.checkpoint.com
  2. [2]
    Crypto Ransomware: 2026 Crypto Crime Report (opens in a new tab) Chainalysis · February 26, 2026 · chainalysis.com
  3. [3]
  4. [4]
    Internet Crime Report 2025 (opens in a new tab) FBI Internet Crime Complaint Center · annual report covering 2025; publication date not printed · ic3.gov
  5. [5]
    The State of Ransomware, Q2 2025 (opens in a new tab) Check Point Research · July 31, 2025 · research.checkpoint.com
  6. [6]
    The State of Ransomware, Q1 2026 (opens in a new tab) Check Point Research · May 11, 2026 · research.checkpoint.com
  7. [7]
    #StopRansomware: Akira Ransomware (AA24-109A) (opens in a new tab) CISA and FBI · updated November 13, 2025 · cisa.gov
  8. [8]
    FBI Takes Down RAMP Ransomware Forum (opens in a new tab) Infosecurity Magazine · January 29, 2026 · infosecurity-magazine.com
  9. [9]
    #StopRansomware: Play Ransomware (AA23-352A) (opens in a new tab) CISA and FBI · updated June 4, 2025 · cisa.gov
  10. [10]
  11. [11]
    LockBit Returns, and It Already Has Victims (opens in a new tab) Check Point Research · October 2025 · blog.checkpoint.com
  12. [12]
    Cost of a Data Breach Report 2026 (opens in a new tab) IBM · 2026 edition; publication date not printed · ibm.com
  13. [13]
  14. [14]
    Two Scattered Spider Hackers Sentenced to Jail in UK (opens in a new tab) SecurityWeek · July 16, 2026 · securityweek.com
  15. [15]
    Scattered Spider affiliate sentenced to 10 years in prison (opens in a new tab) The Record (Recorded Future News) · August 21, 2025 · therecord.media
  16. [16]
    Change Healthcare Responding to Cyberattack (opens in a new tab) HIPAA Journal · page updated through November 17, 2025 · hipaajournal.com
  17. [17]
  18. [18]
    The State of Ransomware, Q3 2025 (opens in a new tab) Check Point Research · November 13, 2025 · research.checkpoint.com
  19. [19]
    #StopRansomware: ALPHV Blackcat (AA23-353A) (opens in a new tab) CISA and FBI · updated February 27, 2024 · cisa.gov
  20. [20]
  21. [21]
  22. [22]
    Japan confirms arrest of Russian Qilin operative, extradition to Germany (opens in a new tab) The Record (Recorded Future News) · October 9, 2026 · therecord.media
  23. [23]
    Uncovering Qilin attack methods exposed through multiple cases (opens in a new tab) Cisco Talos · October 26, 2025 · blog.talosintelligence.com
  24. [24]
    Qilin ransomware surges into 2026 (opens in a new tab) Barracuda Networks · January 15, 2026 · blog.barracuda.com
  25. [25]
    The State of Ransomware 2026 (opens in a new tab) Sophos · 2026 edition; publication date not printed · sophos.com
  26. [26]

Z7 Weekly Intelligence

We aim for one email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • SE-01Social engineering crew disrupted

    Scattered Spider convicted, help desk playbook lives

    TakeawayHarden resets and MFA now.

    • $115M+ ransoms the DOJ alleges victims paid
    • 5.5 yrs sentence each for Jubair and Flowers, July 16, 2026
    • Scattered Spider
    • Social engineering crew
    • Retail
    PDF819 KB
  • RW-07Ransomware ecosystem ongoing risk

    Most dangerous cybercrime groups, re-ranked

    TakeawayPatch edge devices, require phishing-resistant MFA and test backups first.

    • 2,139 leak-site victims in Q2 2026, up 33 percent year over year
    • 93 active groups in Q2 2026, a record for a quarter
    • Most dangerous cybercrime groups
    • Ransomware ecosystem
    • Manufacturing
    PDF820 KB
  • RW-05Ransomware group dormant

    ALPHV BlackCat dormant, Change breach 192.7M

    TakeawayRequire MFA on remote access and vet your vendors.

    • 192.7M people in the Change Healthcare breach, final estimate
    • $395.3M ALPHV/BlackCat ransom payments reported to FinCEN
    • ALPHV BlackCat
    • Ransomware group
    • Healthcare and health insurance
    PDF801 KB

What does this mean for your security?

Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.

Book a security conversationAsk Zeus Call 844-974-8669
Ask Zeus AI assistant