Ransomware in 2026: More groups, more victims, no slowdown

In 2026, the ransomware threat landscape has become increasingly fragmented, according to Black Kite's latest report. Over the past year, 61 new ransomware groups emerged, bringing the total number of active threat actors to 146 by June 2026. The top five groups alone were responsible for nearly half of all victims. Unlike previous years dominated by a single major player or event, this year saw simultaneous expansion across multiple ransomware playbooks. Activity surged in the second half of the year, with Qilin becoming the largest operator by volume. The U.S. remains the most targeted country, but Europe and parts of Asia also experienced significant increases in attacks.