"Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era,” said Vakaris Noreika, VP of product research and development at Nord Security.
Nord Security’s quarterly tally: 2,894 attacks, a 50% year‑over‑year increase
Between July and September 2026, Nord Security recorded 2,894 ransomware incidents — a figure the firm says represents a 50% increase compared with the same quarter in 2025. The July–September period also rose 8.6% versus April–June 2026, indicating growth that is both steep year‑over‑year and incremental quarter‑to‑quarter.
Nord Security’s analysis, published on October 21, connects the recent rise to a recovery from the effects of law‑enforcement action the previous year. Researchers wrote that takedowns of groups such as Lockbit, BlackCat and RansomHub helped suppress ransomware activity during 2025, and that the market is now shifting into a different phase.
The Gentlemen and Qilin: a rivalry that reshapes the market
Of incidents that could be attributed during the quarter, The Gentlemen and Qilin were the two most prolific groups. Nord Security counted 383 attacks attributed to The Gentlemen and 363 to Qilin. The two have traded the top spot throughout 2026, with The Gentlemen edging past Qilin by 20 attacks in this quarter.
Nord’s researchers trace the competition to a personal split. “Based on underground forum activity we observed, The Gentlemen's founder appears to have previously run one of Qilin's top affiliate crews before a dispute over an unpaid cut, which he took to an underground forum and lost,” said Mantas Sabeckis, senior threat intelligence researcher at Nord Security. According to the report, the founder responded by launching a new group and luring affiliates away with a 90% payout — above the typical 70–80% affiliate share — accelerating The Gentlemen’s growth.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechnique shift: from encryption to rapid data theft
Nord Security’s researchers identify a notable change in how some groups execute extortion. Rather than relying solely on encrypting victim files, attackers are increasingly stealing sensitive data and threatening publication unless a ransom is paid. “Stealing data is faster and simpler, so one group can hit many victims at once with far less effort. This shift is likely a big part of why attack volumes keep climbing,” Sabeckis said. He added, “But that doesn’t mean encryption is going away.”
The report frames this shift as an efficiency play: data exfiltration reduces the operational burden of encrypting systems and may allow a single operator to scale attacks across many targets more rapidly.
How attackers are getting in: old openings, persistent risk
Despite changes in post‑compromise behavior, Nord Security found that the initial entry vectors have “remained broadly the same.” The primary initial failures cited are compromised passwords, lack of multi‑factor authentication, and unpatched security vulnerabilities. “The names on the most prolific ransomware group list regularly change, but the way they get in doesn’t,” Noreika said. He emphasized that closing those familiar openings still removes a large share of the risk.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Expect to prioritize hardening user authentication and patch management. The report’s emphasis on compromised passwords and absent multi‑factor authentication points directly to defensive controls that still reduce exposure.
- Policymakers and law enforcement: The Nord Security analysis connects 2025’s decline in activity to takedowns of Lockbit, BlackCat and RansomHub, and describes the current uptick as the market stabilizing. That suggests enforcement actions influenced volumes previously, and their future impact will be watched closely.
- Affected enterprises and procurement leaders: The shift toward faster data theft increases pressure on incident response and data‑loss prevention strategies. Organisations should note that attackers are moving to techniques that can generate more victims per campaign even if the technical entry methods remain unchanged.
The quarter’s report paints ransomware as a marketplace in motion: a renewed, competitive landscape where split‑off affiliates, higher payout incentives and a tactical move toward data exfiltration are pushing overall volumes higher. Nord Security’s figures — 2,894 incidents, a 50% year‑on‑year rise, and the specific counts for The Gentlemen (383), Qilin (363), Inc Ransom (110) and near‑hundred tallies for Krybit, Akira, Deadlock and Clop Leaks — make clear that the shifts are measurable and concentrated among a few active actors.
The central question left by Nord Security’s analysis is operational: will closing the long‑standing entry points identified in the report be enough to blunt the renewed momentum driven by rival gangs and faster, publication‑oriented extortion? If Noreika is right that the market is now stabilizing into a “new era,” defenders and policymakers face a narrow window to test that hypothesis.
https://www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
