Originally published on CyberNetSec.
Executive Summary
The ransomware landscape in the second quarter of 2026 has been defined by a fierce competition between two dominant cybercrime syndicates: Qilin and The Gentlemen. According to a July 20, 2026, report from cybersecurity firm NordStellar, this rivalry is a primary driver behind a significant surge in attacks. The two groups were the most active operators, collectively responsible for a large percentage of the 2,581 ransomware incidents logged in Q2. The primary targets have been small and medium-sized businesses (SMBs) in the United States, though attacks against large enterprises have also seen a worrying 74% increase.
Threat Overview
The report, which analyzed data from over 200 threat actor leak sites, paints a clear picture of a two-sided battle for dominance in the ransomware ecosystem.
- Top Actors: Qilin was the most prolific group with 299 logged attacks in Q2 2026, followed closely by The Gentlemen with 284 attacks. The next most active group, DragonForce, lagged far behind with 147 attacks.
- Growth Trajectory: While Qilin was the overall leader, The Gentlemen showed explosive growth, increasing its activity by 39% compared to Q1 2026.
- Motivation: Security experts assess that this rivalry is driven by a desire for reputation and notoriety within the cybercriminal underworld. Successful, high-profile breaches are treated as "trophies" that attract more affiliates to their Ransomware-as-a-Service (RaaS) platforms.
This competition, combined with the increased availability of AI-powered hacking tools, has created a more aggressive and widespread threat environment.
Technical Analysis
While the report focuses on trends rather than specific TTPs, the actions of these groups follow established ransomware patterns. Both Qilin and The Gentlemen operate as RaaS platforms, providing their malware and infrastructure to affiliates who carry out the attacks in exchange for a share of the profits. Their affiliates use a variety of initial access vectors, including:
- Phishing campaigns (
T1566 - Phishing) - Exploitation of unpatched vulnerabilities in public-facing applications (
T1190 - Exploit Public-Facing Application) - Use of stolen credentials obtained from infostealer logs or dark web markets (
T1078 - Valid Accounts)
Once inside a network, they engage in lateral movement, privilege escalation, and data exfiltration before deploying their respective ransomware payloads to encrypt files (T1486 - Data Encrypted for Impact).
Impact Assessment
The primary victims of this ransomware surge are SMBs in the United States, which were targeted in 769 attacks in Q2. These organizations are often targeted because they possess valuable data but may lack the robust cybersecurity resources of larger corporations.
- Geographic Impact: The top targeted countries are the United States (769 attacks), followed by Canada (97), Germany (83), and the United Kingdom (74).
- Sector Impact: While SMBs are the most frequent victims, the report notes a 74% surge in attacks against large enterprises (over $1 billion in revenue), indicating that no organization is safe.
- Economic Impact: The high volume of attacks leads to significant economic losses from ransom payments, operational downtime, recovery costs, and reputational damage.
This trend indicates that the ransomware problem is not only growing but is also becoming more concentrated around a few highly active and competitive criminal enterprises.
IOCs — Directly from Articles
This report is a trend analysis and does not contain specific Indicators of Compromise.
Detection & Response
Detecting and responding to these threats requires a defense-in-depth approach, as the specific TTPs can vary by affiliate.
- Monitor for Common TTPs: Focus detection efforts on the common initial access vectors: monitor for phishing lures, scan for vulnerable public-facing applications, and look for suspicious login activity.
- Behavioral Detection: Use EDR and anti-ransomware tools that can detect ransomware based on its behavior (e.g., deleting shadow copies, rapid file encryption) rather than just static signatures.
- Threat Intelligence: Subscribe to threat intelligence feeds that provide up-to-date IOCs and TTPs for active groups like Qilin and The Gentlemen.
Mitigation
Defending against this wave of attacks requires fundamental cybersecurity hygiene:
- Multi-Factor Authentication (MFA): As credential-based attacks are a primary vector, enforcing MFA everywhere is the most critical mitigation. This is a direct application of D3FEND's
D3-MFA: Multi-factor Authentication. - Patch Management: A rigorous and timely patch management program is essential to close the vulnerabilities that ransomware affiliates exploit. This aligns with D3FEND's
D3-SU: Software Update. - Immutable Backups: Maintain and regularly test offline, immutable backups. This ensures that even if an attack is successful, the organization can recover its data without paying the ransom.
- Security Awareness Training: Train employees to recognize and report phishing attempts, as the human element is often the weakest link.
Top comments (0)