Ransomware Ecosystem Sees 61 New Groups in 2026

Originally published on CyberNetSec.

Executive Summary

A new report from Black Kite reveals a dramatic fragmentation of the ransomware ecosystem in 2026. The first half of the year saw the emergence of 61 new ransomware groups, bringing the total number of active groups to 146 as of June 2026. This rapid proliferation, averaging more than one new group per week, coincides with a 20% year-over-year increase in overall attacks. Despite the influx of new players, the landscape remains top-heavy, with the five most dominant groups accounting for 44% of the 7,551 victims posted between March 2025 and March 2026. The Qilin group was the most prolific during this period. A key finding is the shrinking lifespan of these groups, which has dropped to an average of just 4.9 months, suggesting a trend of rapid branding, operation, and dissolution or rebranding.

---

Threat Overview

The ransomware market is no longer defined by a single dominant player like LockBit or Conti once were. Instead, it has become a highly dynamic and fractured ecosystem. This 'shattering' effect makes tracking and defending against threats more complex for organizations.

Key Statistics:

• New Groups in H1 2026: 61
• Total Active Groups (June 2026): 146 (up from 105 in June 2025)
• Overall Attack Increase: Up 20% in H1 2026 compared to H1 2025.
• Average Group Lifespan: 4.9 months.

Top 5 Most Active Groups (Mar 2025 - Mar 2026):

1. Qilin: 1,358 victims
2. Akira: 749 victims
3. INC Ransom: 436 victims
4. Play
5. LockBit (still in top 5 despite disruptions)

This data indicates that while the barrier to entry for starting a ransomware operation may be lowering (likely due to the proliferation of RaaS platforms), achieving sustained, high-volume success remains concentrated among a few well-organized and resourced groups.

Technical Analysis

The fragmentation trend is largely driven by the Ransomware-as-a-Service (RaaS) model. Core developer groups create the malware and infrastructure, which they then lease to affiliates who carry out the attacks. This allows for rapid scaling and makes the ecosystem resilient to takedowns of individual affiliates or brands.

Common TTPs across these groups include:

• Initial Access: Exploiting vulnerabilities in VPNs and other edge devices (T1190), spearphishing (T1566), and using stolen credentials purchased from initial access brokers.
• Defense Evasion: Using legitimate tools like BitLocker and SysInternals to perform malicious actions ('Living off the Land'). Disabling security products (T1562.001).
• Impact: Employing double extortion (data exfiltration and encryption) as standard practice. Some groups are moving to triple extortion, adding DDoS attacks or direct harassment of customers and employees.

The short lifespan of groups (4.9 months) is a strategic choice. Groups may disband after a successful run to evade law enforcement, only to rebrand under a new name with the same core members and tools. This complicates attribution and tracking.

Impact Assessment

The primary victims of this surge in ransomware activity are concentrated in specific industries. The report identifies the following as the most targeted sectors:

1. Manufacturing
2. Professional, Scientific, and Technical Services
3. Construction
4. Healthcare

The geographic distribution of victims is also concentrated, with the United States being the most heavily impacted, followed by Canada, the United Kingdom, Germany, and France. The 20% increase in attacks translates to significant financial and operational costs for businesses in these sectors, including downtime, recovery expenses, and potential ransom payments. The constant emergence of new groups means defenders cannot rely on reputation-based threat intelligence alone and must adopt a behavior-based detection strategy.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Detection & Response

Given the fractured landscape, signature-based detection is insufficient. Organizations must focus on detecting core ransomware TTPs.

• Behavioral Analytics: Use EDR and UEBA tools to detect anomalous behaviors indicative of a ransomware attack, regardless of the specific malware strain. This includes detecting processes that enumerate the network, disable security services, or delete volume shadow copies. (D3FEND: User Behavior Analysis)
• Decoy Technology: Deploy honeypots and honeyfiles (canary files) on the network. Any interaction with these decoys is a high-fidelity indicator of an intrusion and can provide early warning before encryption begins. (D3FEND: Decoy Object)
• Exfiltration Monitoring: Monitor for large, unexpected outbound data flows, especially to cloud storage providers or using non-standard protocols. This can detect the data theft stage of a double-extortion attack. (D3FEND: Network Traffic Analysis)

Mitigation

Defensive strategies must be robust and adaptable to this dynamic threat.

1. Attack Surface Management: Continuously identify and remediate internet-facing assets and vulnerabilities. Prioritize patching for known exploited vulnerabilities in edge devices like VPNs and firewalls. (M1051 - Update Software)
2. Identity and Access Management: Enforce strong password policies and MFA everywhere possible. Implement the principle of least privilege to limit the impact of a compromised account. (M1026 - Privileged Account Management)
3. Immutable Backups: This remains the most critical defense. Ensure backups are stored offline or in an immutable format, are tested regularly, and are segmented from the primary network to prevent them from being encrypted or deleted by attackers. (M1053 - Data Backup)
4. Third-Party Risk Management: Since many attacks originate from the supply chain, vet the security posture of all third-party vendors and partners with access to your network or data.