THE STATE OF RANSOMWARE Q3 2026

August was the most active month of the quarter with 1064 victim postings, compared to a low of 855 in September. Activity declined towards the end of the quarter.

This view complements the current-quarter analysis by showing how ransomware volume and the number of active groups have moved across recent quarters. It helps separate short-term monthly noise from a broader directional trend.

Between July and September, total victim postings decreased (970 → 855). The number of active groups grew from 68 to 82, indicating continued ecosystem expansion.

This section highlights ransomware groups that either made their first appearance this quarter, or demonstrated significant month-on-month growth in victim claims. These groups warrant close monitoring - rapid growth often signals active affiliate recruitment, a new RaaS programme gaining traction, or an established actor rebranding under a new name.

Groups are flagged as Rising if their victim count grew by 50% or more between any two consecutive months this quarter. Groups are flagged as New if they had no recorded victims in the first month but appeared subsequently. A minimum of 5 total victims is required to appear in this list.

The ransomware landscape in Q3 2026 was dominated by Qilin, which claimed 362 victims - 12.5% of all activity observed this quarter. The group was followed by Thegentlemen (360) and Incransom (109), which together formed a concentrated upper tier of activity.

A total of 111 distinct groups were active this quarter. 47 of these published fewer than 10 victims, reflecting the continued fragmentation of the RaaS ecosystem as smaller and independent operators enter the landscape alongside established programmes.

Qilin ranked 1st with 362 victims (12.5% of total). [Add analyst context: recruitment activity, notable TTPs, or any intelligence on this group's operations this quarter.]

Thegentlemen ranked 2nd with 360 victims (12.5% of total). [Add analyst context: recruitment activity, notable TTPs, or any intelligence on this group's operations this quarter.]

Incransom ranked 3rd with 109 victims (3.8% of total). [Add analyst context: recruitment activity, notable TTPs, or any intelligence on this group's operations this quarter.]

The geographic distribution of victims in Q3 2026 reflects established patterns in the global ransomware ecosystem. United States remained the most targeted nation, accounting for 34.7% of all victims - consistent with historical trends driven by the concentration of high-value organisations and the perceived ability to pay significant ransoms.

Victims were recorded across 121 countries in total. The top five most affected nations - United States, Germany, United Kingdom, Italy, Brazil - collectively represented 50.4% of all activity. The United Kingdom ranked 3rd, with 111 victims recorded.

Beyond the United States, Germany and United Kingdom ranked second and third respectively, accounting for a combined 9.2% of all victims. [Add analyst note: any notable new entrants to the top 10, focused regional campaigns, or geopolitical context for targeting patterns.]

The sector distribution of victims in Q3 2026 reflects the broad and opportunistic nature of modern ransomware operations. Manufacturing was the most affected sector, accounting for 16.4% of all victims, followed by Professional Services (13.6%) and Technology (12.6%).

Healthcare organisations accounted for 285 victims (9.9% of total), reflecting the continued targeting of the sector despite informal avoidance policies observed among some RaaS operators.

The concentration of attacks across 13 sectors underscores the indiscriminate nature of most modern ransomware campaigns. Sectors with high operational dependency on data - such as Manufacturing, Professional Services, and Technology - remain disproportionately attractive targets due to the urgency of restoring access and the sensitivity of the data at risk.

Ransom payment data sourced from Coveware's quarterly incident response case data provides important context on the financial impact of ransomware beyond victim counts. In Q3 2026, the average ransom payment stood at $1,025,278 - -45% compared to Q2 2026 - while the median payment was $400,000 (+167% quarter-on-quarter). The divergence between average and median figures reflects the continued presence of large-payment outliers skewing mean values upward, while most organisations settle at significantly lower sums.

Overall, 28% of affected organisations made a ransom payment this quarter - continuing a multi-year downward trend from a peak of 85% in early 2019. This declining payment rate reflects improved organisational resilience through offline backup capability, as well as increased awareness of sanctions exposure and the reputational risk of payment.

Data exfiltration-only (DXF) cases - where threat actors steal data without deploying encryption - showed a payment rate of 21% this quarter. DXF payment rates tend to be more volatile than encryption-based attacks, as the primary leverage is limited to reputational and regulatory risk. Organisations should weigh this dynamic carefully when developing their ransomware response frameworks.

The following incidents were selected for the severity of disclosed impact, novelty of threat actor behaviour, or relevance to organisations operating in the UK and EMEA region. This list is not exhaustive.

Based on victim trajectory data and month-on-month growth patterns observed this quarter, the following groups show momentum indicators that suggest elevated activity in the coming period. Groups are scored on a combination of recent growth rate, total victim volume, and quarter-end trajectory.

Based on the threat actor activity and targeting patterns observed in Q3 2026, Bridewell recommends organisations - particularly those operating in Manufacturing and adjacent sectors - prioritise the following defensive measures.

The ransomware ecosystem in Q3 2026 demonstrated both the resilience and adaptability that have defined the threat landscape in recent years. With 2,889 victims recorded across 111 active groups, activity remained at a level that demands sustained organisational vigilance - particularly in Manufacturing and Professional Services, which together represented 30.0% of all victims.

Qilin's dominance this quarter - accounting for 12.5% of all activity - reflects the continued ability of established RaaS programmes to attract affiliates and sustain operational tempo despite law enforcement pressure. The persistence of 111 active groups, 47 of which published fewer than 10 victims, signals that the ecosystem remains fragmented but highly active.