Nord Security: Ransomware Attacks Surge 50% in Q3 2026 as Gangs Compete
Ransomware incidents rose to 2,894 in the third quarter of 2026, driven by a rivalry between The Gentlemen and Qilin groups.
Key points
- Ransomware attacks increased by 50% year-over-year in Q3 2026, reaching 2,894 incidents.
- The Gentlemen and Qilin were the most active groups, accounting for over 740 attributed attacks combined.
- A dispute over affiliate payouts led to the formation of The Gentlemen, intensifying competition.
Ransomware attacks surged by 50 percent during the third quarter of 2026 compared to the same period last year, according to an analysis by Nord Security. The research firm recorded 2,894 ransomware incidents between July and September 2026, marking a significant acceleration in criminal activity after a period of relative stability.
This quarterly total also represents an 8.6 percent increase from the April-to-June period of the same year. The Nord Security report, published on October 21, suggests that the market is stabilizing following previous law enforcement disruptions. This current spike appears to be the beginning of a new era for ransomware operations, rather than a temporary anomaly.
Market Dynamics and Group Rivalry
The Gentlemen and Qilin emerged as the two most prolific ransomware groups during this reporting period. Among attacks that could be attributed to specific actors, The Gentlemen were responsible for 383 incidents. Qilin followed closely with 363 recorded attacks, indicating a tight competition for market share between these two dominant threat actors.
Inc Ransom ranked third in activity, accounting for 110 attacks during the quarter. Several other groups demonstrated significant operational capacity, with Krybit, Akira, Deadlock, and Clop Leaks each conducting nearly 100 ransomware attacks. However, The Gentlemen and Qilin remain far ahead of these competitors in terms of total volume and visibility.
Origins of the Competition
The intense rivalry between The Gentlemen and Qilin stems from internal disputes within the ransomware ecosystem. According to Nord Security researcher Mantas Sabeckis, the founder of The Gentlemen previously managed a top affiliate crew for Qilin. A disagreement over an unpaid commission led the founder to challenge Qilin on an underground forum, a dispute he ultimately lost.
In response to losing the forum argument, the founder launched a new group to recruit former colleagues from Qilin. The Gentlemen offered a 90 percent payout to affiliates, which is significantly higher than the industry standard of 70 to 80 percent. This financial incentive successfully lured talent away from Qilin, allowing The Gentlemen to surpass Qilin by 20 attacks in the third quarter.
What should you do?
Organizations should monitor underground forums and threat intelligence feeds for indicators of compromise related to The Gentlemen and Qilin. Security teams must ensure that backup systems are isolated and regularly tested to mitigate the impact of potential encryption events.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: The Gentlemen
- Verify that offline backups are current and accessible to ensure rapid recovery without paying ransoms.
- Review affiliate payout structures in threat intelligence reports to anticipate recruitment tactics by rival groups.
- Implement strict network segmentation to limit lateral movement if an initial compromise occurs.
- Monitor for unusual administrative activity that may indicate credential theft or internal pivoting.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many ransomware attacks occurred in Q3 2026?
Nord Security recorded 2,894 ransomware attacks between July and September 2026.
Which ransomware groups were most active in 2026?
The Gentlemen and Qilin were the most active, with 383 and 363 attributed attacks respectively.
Why did The Gentlemen form as a separate group?
The founder left Qilin after a dispute over unpaid cuts and offered higher affiliate payouts.
