Nord Security counts 2,894 ransomware attacks in third quarter
Original title: Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
The July–September total is up 50% year over year and 8.6% from the prior quarter, led by The Gentlemen and Qilin.
Nord Security reported 2,894 ransomware attacks from July to September 2026, a 50% rise from the same quarter last year and an 8.6% rise from April to June. Among attributed cases, The Gentlemen accounted for 383 attacks and Qilin for 363, with Inc Ransom at 110. Researchers said both leading groups are shifting toward data theft and publication threats rather than encryption, while initial access still relies on compromised passwords, missing multi-factor authentication, and unpatched flaws.
Unconfirmed: The Gentlemen–Qilin split and unpaid-cut dispute rest on Nord Security’s reading of underground forum activity.
- Krybit, Akira, Deadlock, and Clop Leaks each had almost 100 attacks.
- Nord attributes the rebound partly to the market stabilizing after 2025 takedowns of LockBit, BlackCat, and RansomHub.
- Nord says The Gentlemen’s founder previously ran a top Qilin affiliate crew and now offers a 90% payout.
- Both leading groups are dropping encryption in favor of steal-and-leak extortion.
Impact: Stolen data held for ransom without encryption
- 1.Close common entry points: compromised passwords, accounts without multi-factor authentication, and unpatched flaws.
- ATT&CK
- T1078 Valid Accounts
- Organizations
- Nord Security
From the original article
3 min read at infosecurity-magazine.com
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks - and both are evolving their tactics in an attempt to outdo one another
By Danny Palmer · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.