/
← Voltar ao feed
medium

Nord Security: 2,894 ransomware attacks in Q3 2026, up 50% YoY, led by rival groups The Gentlemen and Qilin

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 09:00 · coletado há 2 dias

Nord Security reports 2,894 ransomware attacks between July and September 2026, a 50% increase year over year and an 8.6% rise over Q2 2026. Researchers attribute the rebound to the market stabilizing after law enforcement takedowns of LockBit, BlackCat and RansomHub, which suppressed activity during 2025. The Gentlemen (383 attacks) narrowly overtook Qilin (363) as the most prolific group, followed by Inc Ransom (110). Krybit, Akira, Deadlock and Clop Leaks each recorded close to 100 attacks. Nord Security assesses that the rivalry between The Gentlemen and Qilin is pushing both to develop new attack techniques.

Detalhes técnicos

  • Both leading groups increasingly skip encryption and run pure data-theft extortion, threatening to publish stolen data unless a ransom is paid. Researchers say this is faster and simpler and lets one group hit many victims at once, though encryption is not going away.
  • According to Nord Security's underground forum monitoring, The Gentlemen's founder allegedly ran a top Qilin affiliate crew before a dispute over an unpaid cut. He then founded The Gentlemen and lured affiliates away with a 90% payout, versus the usual 70-80%.
  • Initial access vectors are broadly unchanged: compromised passwords, accounts without multi-factor authentication, and unpatched vulnerabilities.

Remediação

  • Enforce MFA on all accounts and remediate credential compromise.
  • Prioritize patching of known vulnerabilities, since closing these familiar entry points removes a large share of the risk.
  • Plan for data-theft extortion scenarios, not only encryption.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 21/10/2026 09:00 · coletado 21/10 10:01 primeiro registro

    Nord Security: 2,894 ransomware attacks in Q3 2026, up 50% YoY, led by rival groups The Gentlemen and Qilin

    ler a análise desta fonte

    Nord Security reports 2,894 ransomware attacks between July and September 2026, a 50% increase year over year and an 8.6% rise over Q2 2026. Researchers attribute the rebound to the market stabilizing after law enforcement takedowns of LockBit, BlackCat and RansomHub, which suppressed activity during 2025. The Gentlemen (383 attacks) narrowly overtook Qilin (363) as the most prolific group, followed by Inc Ransom (110). Krybit, Akira, Deadlock and Clop Leaks each recorded close to 100 attacks. Nord Security assesses that the rivalry between The Gentlemen and Qilin is pushing both to develop new attack techniques.

    Technical Details

    • Both leading groups increasingly skip encryption and run pure data-theft extortion, threatening to publish stolen data unless a ransom is paid. Researchers say this is faster and simpler and lets one group hit many victims at once, though encryption is not going away.
    • According to Nord Security's underground forum monitoring, The Gentlemen's founder allegedly ran a top Qilin affiliate crew before a dispute over an unpaid cut. He then founded The Gentlemen and lured affiliates away with a 90% payout, versus the usual 70-80%.
    • Initial access vectors are broadly unchanged: compromised passwords, accounts without multi-factor authentication, and unpatched vulnerabilities.

    Remediation

    • Enforce MFA on all accounts and remediate credential compromise.
    • Prioritize patching of known vulnerabilities, since closing these familiar entry points removes a large share of the risk.
    • Plan for data-theft extortion scenarios, not only encryption.