A New Ransomware Threat Actor Emerges Every Week, Warns Report
More than one new ransomware group is appearing every week as the criminal ecosystem surrounding extortion attacks becomes increasingly more fragmented and continues to expand.
Published on July 21, the Black Kite Ransomware Report 2026 identified 146 active ransomware groups which have publicly announced at least one victim of an attack, as of June 2026.
The figure marks a significant increase compared to the number of ransomware groups marked as active a year earlier, when the figure stood at 105 ransomware operations.
According to the study, 2026 alone has seen the emergence of 61 new ransomware groups, the equivalent of more than one a week.
Black Kite noted that ransomware operations can disappear as quickly as they emerge, with the average lifespan of an active group standing at 4.9 months, compared with over a year in 2024.
“Previous years were often defined by a dominant ransomware group or a single major event. This year was different,” said Ferhat Dikbiyik, chief research and intelligence officer at Black Kite.
“We saw more groups enter the market, while established operators continued to scale and attack volume accelerated in the second half. Those shifts fundamentally changed the shape of the ransomware landscape.”
Read more: Why Ransomware Remains One of Cybersecurity’s Most Persistent and Costly Threats
Despite the fragmentation of the ransomware ecosystem, it is a handful of ransomware groups which continue to dominate the market, with the top five operations accounting for almost half (44%) of 7551 public disclosed victims between March 2025 and March 2026.
This period was dominated by Qilin, which claimed 1358 victims, followed by Akira (749) INC Ransom (436), Play (422) and SafePay (324).
Such is the constantly fluctuating nature of the ransomware landscape that The Gentlemen, reported as the most prolific ransomware threat in July 2026, ranked only seventh during the period examined, with 286 victims.
The Black Kite report detailed the names of the 19 ransomware operations which claimed the most victims during the period, from Qilin with its over 1000 victims, down to Rhysida, which claimed 80 victims.
A combined total of 108 threat actors accounted for 1918 confirmed attacks.
While the different threat groups each have their own methods of operating, the report noted that there are several common cybersecurity vulnerabilities which were exploited in ransomware attacks.
Black Kite has recommended that organizations prioritize patching operation systems and software as soon as possible after new vulnerabilities emerge, especially those with a Common Vulnerability Scoring System (CVSS) score of 9 or higher.
Despite being classified as critical, these vulnerabilities were exploited to gain initial access to the network in 44% of attacks, laying the groundwork for a subsequent ransomware attack.
To help further defend against ransomware attacks, the Black Kite report also recommended strengthening identity verification, help desk escalation paths, employee reporting, vendor verification, and executive impersonation controls.
