A new report on the state of ransomware in Q2 2026 indicates a shifting landscape, with a growing number of active groups and a narrowing window for exploiting vulnerabilities. While the ransomware ecosystem remains concentrated among a few dominant operations, the number of active groups reached a new high of 93, up from 71 in the previous quarter. The top 10 groups were responsible for 57.6% of all victims, a decrease from 71% in Q1.
Data leak sites recorded 2,139 victims in Q2, a figure consistent with Q1 and representing a 33% increase year-over-year, maintaining the elevated levels seen throughout 2025. Qilin remained the most prolific operator for the fourth consecutive quarter with 279 victims, despite a 17% decline in its activity. The Gentlemen, however, saw a significant 62% surge, reaching 269 victims and surpassing Qilin in June.
An internal leak provided insight into The Gentlemen's operations, revealing chat logs and platform data. This material confirmed a core team of approximately nine operators supported by a broader affiliate network. Notably, the leak also provided evidence that the group utilized AI coding assistants to develop its ransomware management panel in roughly three days, demonstrating AI's role in accelerating malicious tool development.
Ransom payment rates continued their six-year decline, falling to a multi-year low of approximately 23% in Q2, down from 85% in 2019. Despite this, on-chain ransomware payments still exceeded $820 million in 2025. The payer market is segmenting, with average payments increasing while the median payment decreases. This suggests that large enterprises continue to pay substantial ransoms, while mid-market organizations are increasingly resisting or negotiating smaller settlements.
Law enforcement efforts in Q2 focused on disrupting shared infrastructure rather than targeting individual ransomware groups. Actions included the takedown of a cryptocurrency laundering platform used by multiple actors, sanctions against major Iranian digital asset exchanges, the dismantling of a malware signing service abused by several Ransomware-as-a-Service (RaaS) operations, and disruptions to large infostealer and VPN anonymization networks relied upon by many groups.
The geographic distribution of victims also shifted significantly. The United States' share of victims decreased from 50% to 42% quarter-over-quarter. This change is largely attributed to the fastest-growing groups in Q2, such as The Gentlemen and the newly active Krybit, targeting the U.S. less frequently than the overall ecosystem average.
The report also highlights a continuing trend of a narrowing exploitation window, with AI increasingly cited as a contributing factor. Vulnerabilities are now being weaponized within hours or days of their disclosure, reducing the cost of exploit development and giving ransomware operators an advantage in reaching victims quickly.
