Loading story…
NCC Group recorded 1,073 organizations worldwide as ransomware victims in August 2026, a 12% increase from 973 in July and the highest monthly total reported that year. North America represented 44% of known incidents, while industrial organizations were the most targeted sector, accounting for 31% of reported attacks.
Qilin and The Gentlemen were the most frequently attributed groups, linked to 164 and 116 incidents respectively; reported victims included Boston Dynamics and Manchester Airport Group. The report also identified a growing reliance on data theft and extortion without file encryption, reinforcing the need for tested ransomware response plans and tabletop exercises.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
NCC Group published its Cyber Threat Intelligence Report for August 2026, reporting ransomware victim and sector data and warning that some criminal groups are shifting toward data theft and extortion without encryption.
NCC Group recorded 1,073 organizations globally hit by ransomware during August 2026, a 12% increase from July and the highest monthly total of the year. Qilin and The Gentlemen were attributed to 164 and 116 incidents, respectively.
NCC Group's reporting referenced a hacker data breach affecting Manchester Airport Group during August 2026.
NCC Group's reporting referenced a cyberattack targeting Boston Dynamics during August 2026.
NCC Group recorded 973 organizations as ransomware victims globally during July 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recorded ransomware activity rose **22%** month over month to 894 victim organizations in July, the highest monthly total reported in 2026. North America and Europe accounted for 70% of incidents, with the United States representing 41%; the industrial sector was the most targeted, accounting for 28% of reported attacks. Notable reported victims included EY, Fairlife, and Analog Devices, although some public claims have not been independently verified. The Gentlemen was the most active named operation, responsible for 15% of recorded attacks, while Qilin was also among the leading groups. Newly observed group **CRPxO** claimed 36 victims but had not provided credible evidence supporting those claims, underscoring the limitations of leak-site metrics. Researchers also warned that AI-enabled capabilities, including the reportedly autonomous **JADEPUFFER** agent, could allow ransomware operators to accelerate and scale attacks.
Aug 31, 2026
Ransomware and cyber-extortion activity rose again in Q2 2026, with industry reporting showing more than 2,250 publicly named victims across roughly 90 active groups and nearly 100 countries. GuidePoint Security’s GRIT report counted 2,279 victims, up 7% from the prior quarter and 43% year over year, while ReliaQuest recorded 2,252 victims and found the United States accounted for about 49% of observed activity. **Qilin** remained a leading force in one dataset for a fifth straight quarter, while **The Gentlemen** surged into the top tier and was ranked the most active group by ReliaQuest; **DragonForce** also remained prominent despite reported declines in some rankings. Professional, scientific, and technical services stayed the most targeted sector, and researchers noted a broader shift toward **data-only extortion** and continued pressure on organizations through public leak-site exposure. Researchers also highlighted technical changes in attacker tradecraft rather than a wholesale change in ransomware operations. The quarter saw increased use of **AI and LLMs** by threat actors, including analysis of exfiltrated databases and more tailored extortion messaging, alongside continued exploitation of high-impact vulnerabilities such as `CVE-2026-50751`, `CVE-2026-48027`, `CVE-2026-46817`, and `CVE-2026-35273`. ReliaQuest identified **Deadlock** as a notable re-emerging threat after 11 months of silence, using blockchain-hosted command-and-control through a Polygon smart contract and a **BYOVD** technique to terminate EDR tools via `CVE-2024-51324`. The reports say supply-chain compromise, remote access abuse, identity attacks, lateral movement, and defense evasion remain central to ransomware operations even as payment rates decline.
Aug 11, 2026
Ransomware activity intensified in 2026 as the criminal ecosystem expanded to **146 active groups** by midyear, with **61 new groups** emerging and public victim counts rising sharply across multiple regions and sectors. Black Kite reported **7,551 victims** globally, a **55.1% year-over-year increase in Europe** during the first four months of the year, and continued dominance by a small number of operators despite broader fragmentation. **Qilin** remained the leading ransomware-as-a-service operation across much of the market, benefiting from the decline of rivals such as LockBit and ALPHV, while researchers said attackers frequently gained initial access by exploiting **critical vulnerabilities** with `CVSS >= 9` and, in some cases, through phishing and supply-chain compromise. At the same time, **The Gentlemen** emerged as one of the fastest-growing threats, especially against higher education. Comparitech counted **104 ransomware attacks** against the global education sector in the first half of 2026, with attacks increasingly concentrated on colleges and universities and the United States recording the most confirmed victims. ESET said The Gentlemen equipped affiliates with the **GentleKiller** framework, a bring-your-own-vulnerable-driver toolkit designed to disable endpoint defenses before encryption, targeting more than **400 processes** across roughly **48 security products**. The group was also linked to steep growth in university attacks, including a case at **Mount Royal University** involving a **$1.9 million** ransom demand, alleged theft of more than **10TB** of data, and destructive deletion of drives.
Aug 18, 2026