Ransomware Groups 2026: Qilin Leads, and a Gang First Seen Last September Is Now Second

The most active ransomware groups of 2026 are Qilin, with 1,023 victims posted on its leak site from January to September, and The Gentlemen, with 892, a group first seen in September 2025. Together they posted 24% of all victims. 161 ransomware groups posted at least once, up from 124 in the same months of 2025.

The most active ransomware groups of 2026

Victims named on each group’s leak site, deduplicated, January to September 2026, by date first seen. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.

The top ten groups posted 52% of all 2026 victims, about the same as the 51% of a year earlier. The change is at the very top: the two largest groups posted 24% of victims in 2026, against 16% for the top two in the same months of 2025. Qilin has led since 2025 and nearly doubled. The Gentlemen went from 38 victims in their first weeks of activity in 2025 to 892. LockBit 5, whose leak site first appeared on 2025-12-05, entered at #6. For the month-by-month totals behind these groups, see our ransomware statistics for 2026.

Risers and fallers

Groups in the top 10 of either period, ordered by victims on each side; numbers are victims posted. Red: more victims in 2026. Grey: fewer. Thick lines: a change of 150 or more. Same months in both years, January to September.

The biggest risers were The Gentlemen (38 to 892), Qilin (556 to 1,023), LockBit 5 (0 to 258), DragonForce (145 to 323). The biggest fallers were RansomHub (236 to 0), Babuk-Bjorka (213 to 0), Lynx (241 to 61), Cl0p (418 to 245). Cl0p’s 2025 figure is inflated by mass postings in February 2025 (235 victims on a single day), so its drop says more about that campaign than about a slowdown. Several 2025 leaders went quiet altogether: RansomHub (236 victims in 2025, last post 2025-04-01), Babuk-Bjorka (213 victims in 2025, last post 2025-04-04), Cactus (94 victims in 2025, last post 2025-03-17), FunkSec (91 victims in 2025, last post 2025-03-19) have posted nothing in 2026.

How many ransomware groups are there?

Groups with at least one leak-site post in the year (light) and the subset first seen that year (dark). *2026 is January to September. First seen uses RansomLook’s earliest record for each leak-site name. 2021 is omitted because tracking began that year.

The number of groups posting victims has grown every year in our data, from 61 in 2022 to 140 in 2025, and 161 have posted in the first nine months of 2026. Churn is high: 84 groups were first seen in 2026, and groups first seen in 2025 or 2026 posted 55% of 2026 victims. The long tail is thin: 46 of the 161 groups active in 2026 have posted five victims or fewer, while the top ten account for 52%.

A “new” group is not always new people. Leak sites rebrand, split, and relaunch, and the FBI’s 2025 report lists INC, Lynx, and Sinobi as a single entry: together they posted 507 victims in 2026, against 524 in the same months of 2025, as Lynx posts fell and INC Ransom and Sinobi rose. Counts here are by leak-site name.

Is ransomware getting more concentrated?

Share of each year’s deduplicated leak-site victims posted by the single largest group (red, named under the year), the next four, the next five, and every other group. *2026 is January to September. 2022 includes bulk backfills. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.

In 2022 the ten largest groups posted 77% of victims, and LockBit 3.0 alone posted 37%. By 2025 the top ten held 50% and the leader 12%. The field fragmented as dozens of smaller groups opened leak sites. 2026 shows a small reversal: the top ten’s share is back to 52%, and the largest five groups hold 37%, up from 34% in 2025, driven by Qilin and The Gentlemen.

How long do new groups last?

Groups whose first RansomLook post falls in the year and that posted that year, and how many of them posted at least one victim in each later year. *2026 is January to September. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.

Between half and three in five of each year’s new groups post again the following year: 19 of 34 from 2022, 24 of 39 from 2023, 32 of 56 from 2024, and 39 of 78 from 2025. Few last long. Only 6 of the 34 groups that appeared in 2022 have posted in 2026. A group going quiet does not mean its members stopped; many reappear under a new name.

Group dossiers: the top 10

“Latest post” and years tracked are as of 2026-10-13, counted from the first post RansomLook holds for the name (RansomLook began in 2021, so older groups are understated). CISA links verified on cisa.gov in October 2026. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.

CISA and its partners have published #StopRansomware advisories for only three of these ten groups under their current names. None of the top two has one. The advisories that do exist are still useful for defense: we coded every one by the way attackers got in, in our analysis of ransomware initial access vectors.

The FBI’s list vs the leak sites

The FBI ranks groups by complaints filed with its Internet Crime Complaint Center, not by leak-site posts. Its 2025 report names ten variants that together account for 56.8% of ransomware complaints and identifies 63 new variants during the year. Seven of the FBI’s ten are also in the 2025 leak-site top 10. The exception that stands out is BianLian.

IC3 rank from the FBI 2025 IC3 Annual Report. Leak-site counts from RansomLook; for combined entries the counts are summed and the best-ranked member is shown.

BianLian is fourth on the FBI’s complaint list but posted only 32 victims on its leak site in 2025. That gap is a reminder that leak sites capture groups that publish, not every group that attacks. Total complaints are covered in our five-year trend of ransomware reported to the FBI.

Full leaderboard

Deduplicated leak-site victims by group. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.

As an independent check on the rankings, we applied the same counting rule to ransomwatch, an open tracker archived in 2025. It names the same leading group as RansomLook in both years it fully covers (LockBit 3.0 in 2023 and RansomHub in 2024), and 8 and 9 of its top ten groups match RansomLook’s top ten for those years.

What this means for MSPs

• Plan for the top five, not one headline group. Qilin, The Gentlemen, Akira, INC Ransom, and DragonForce posted 37% of 2026 victims. Their CISA coverage is uneven, so build detections from the advisories that exist and from the techniques they share.
• Remote access tools are a known route to MSP clients. CISA’s June 2025 advisory on unpatched SimpleHelp RMM describes ransomware actors reaching the customers of a software provider through the tool, and cites research tying DragonForce actors to an attack on an MSP. Keep RMM and remote support software patched and behind MFA.
• Expect new names. With 84 groups first seen this year, blocklists keyed to group names age fast. Controls that stop the common entry points age much more slowly.

Frequently asked questions

What are the top 10 ransomware groups in 2026?

By victims posted on leak sites from January to September 2026: Qilin (1,023), The Gentlemen (892), Akira (390), INC Ransom (360), DragonForce (323), LockBit 5 (258), NightSpire (250), Cl0p (245), Play (209), Coinbase Cartel (177). Together they account for 52% of all posts.

What is the most active ransomware group?

Qilin. It posted 1,023 victims from January to September 2026, 13% of all leak-site posts and up from 556 in the same months of 2025. The FBI’s IC3 ranked Qilin the second most reported variant in 2025.

How many ransomware groups are there?

161 groups posted at least one victim on a leak site from January to September 2026, up from 124 in the same months of 2025. 84 of them were first seen in 2026. Many are small: 46 posted five victims or fewer.

Who are The Gentlemen ransomware group?

The Gentlemen first appeared on RansomLook on 2025-09-09. They posted 892 victims from January to September 2026, second only to Qilin, and posted in every month of 2026 so far, peaking at 162 victims in August. There is no CISA #StopRansomware advisory on the group as of October 2026.

Which ransomware groups have CISA advisories?

Of the ten most active groups in 2026, three have a #StopRansomware advisory under the same name: Akira (AA24-109A), Cl0p (AA23-158A), and Play (AA23-352A). CISA’s LockBit 3.0 advisory (AA23-075A) predates the LockBit 5 leak site. Qilin, The Gentlemen, INC Ransom, DragonForce, NightSpire, and Coinbase Cartel have none.

Which ransomware groups did the FBI see most in 2025?

The FBI’s 2025 IC3 report lists Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay, and Medusa as the most reported variants, together 56.8% of ransomware complaints. BianLian ranks fourth there but posted only 32 victims on its leak site in 2025.

Methodology

References

1. RansomLook, public API (ransomlook.io/doc), licensed CC BY 4.0. Accessed October 2026.
2. ransomwatch, posts.json (archived, Unlicense). Accessed October 2026.
3. FBI Internet Crime Complaint Center, 2025 IC3 Annual Report. Accessed October 2026.
4. CISA, #StopRansomware official alerts and statements. Accessed October 2026.
5. CISA AA23-075A, #StopRansomware: LockBit 3.0. Accessed October 2026.
6. CISA AA23-158A, #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability. Accessed October 2026.
7. CISA AA23-352A, #StopRansomware: Play Ransomware. Accessed October 2026.
8. CISA AA24-109A, #StopRansomware: Akira Ransomware. Accessed October 2026.
9. CISA AA25-163A, Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider. Accessed October 2026.