New data from Bridewell’s threat intelligence team recorded 2,889 publicly disclosed ransomware victims across 111 active ransomware and extortion groups in the third quarter of 2026, an 80% increase from 1,609 victims reported in the same period a year earlier. Based on data from Ransomware.live, the findings identified Qilin as the most active group, claiming 362 victims, followed by Thegentlemen with 360 and Incransom with 109. The top 10 groups accounted for 48% of all victim postings, while 47 of the 111 active groups each published fewer than 10 victims, highlighting fragmentation of the ransomware ecosystem alongside the continued activity of established RaaS (ransomware-as-a-service) operations.
The U.S. remained the most targeted country, accounting for 34.7% of publicly listed victims, while ransomware activity affected 121 countries and 13 industry sectors during the quarter. Manufacturing was the hardest-hit industry, representing 16.4% of all victims, underscoring exposure of industrial organizations to ransomware attacks. Monthly postings peaked at 1,064 in August, up from 970 in July, before declining to 855 in September. Bridewell noted that data-leak-site postings represent publicly disclosed victims rather than the full extent of ransomware incidents, as some victims pay ransoms without appearing on leak sites or are never publicly listed.
Ransomware groups publicly posted 2,889 victims on data-leak sites (DLS) during the third quarter of 2026, with August recording the highest monthly total of 1,064 victims, compared with 970 in July and 855 in September. The quarter averaged 963 victim postings per month, according to data from Ransomware.live filtered by attack date. The figures represent publicly disclosed victims only, as some organizations pay ransoms without being listed or never appear on leak sites. Victims without a recorded attack date were excluded from the monthly totals but included in the overall quarterly count.
“Ransomware DLS activity rebounded sharply in Q3 2026, with 2,889 victim postings recorded – approximately 30% higher than Q2,” Bridewell reported. “Activity increased from 970 postings in July to a quarterly peak of 1,064 in August before falling to 855 in September; however, September remained above every individual month recorded in Q2, indicating that publicly visible ransomware activity remained elevated despite the late-quarter decline. DLS postings should be treated as a proxy for ransomware activity rather than a complete measure of incidents.”
Storm emerged as a new ransomware group in August, recording 78 victim postings during the quarter after initially listing 41 victims that month, while Direwolf also first appeared in August with 43 victims and recorded 60 postings. SafePay recorded 73 victims, with its monthly postings rising from 12 in August to 32 in September, a 167% increase.
Other groups showing significant month-over-month growth included Settra, which rose 50% from 18 victims in July to 27 in August; LockBit5, up 75% from 12 to 21; Clop, up 4,400% from one to 45; SilentRansomGroup, up 467% from three to 17; and Everest, which doubled its postings from six in August to 12 in September. The new and rising groups were identified using a minimum of five victims and a month-over-month growth threshold of at least 50%.
Bridewell analysis identified that Q3 2026 showed continued ransomware ecosystem churn, with Storm and Direwolf emerging as new operators while Safepay, LockBit5 and Clop recorded sharp month-on-month growth. “Safepay’s continued acceleration from Q2 is particularly notable, while Clop’s 4,400% increase reflects growth from a very low July baseline and should be interpreted cautiously. The mix of new entrants and established groups regaining momentum reinforces the need to monitor both emerging operators and established RaaS programmes.”
It added that the third quarter of this year showed a further shift towards a more fragmented ransomware ecosystem, with Qilin, Thegentlemen and Incransom accounting for 29% of victim postings compared with 32% for the leading three groups in Q2. The top 10 share also fell from 56% to 48%, indicating that the sharp increase in overall victim volume was distributed across a broader pool of operators rather than being driven solely by the largest RaaS programmes. Qilin and Thegentlemen nevertheless remained dominant individually, each recording more than 350 victims during the quarter.
The report also noted concentration of attacks across 13 sectors underscores the indiscriminate nature of most modern ransomware campaigns. Sectors with high operational dependency on data, such as manufacturing, professional services, and technology, remain disproportionately attractive targets due to the urgency of restoring access and the sensitivity of the data at risk.
“Sector targeting remained broad in Q3 2026, although Manufacturing became the most affected sector with 474 victim postings (16.4%), up from 274 (12.4%) in Q2. Technology and Healthcare also recorded substantial increases, rising to 363 and 285 postings, respectively, while Professional Services accounted for a further 13.6% of activity,” Bridewell identified. “The distribution indicates that the quarter’s overall increase in ransomware volume was not confined to a single industry, with operationally dependent and data-rich sectors continuing to experience significant exposure.”
Looking ahead, Bridewell identified that Q3 2026 indicates a ransomware ecosystem that is expanding in both scale and participation, with victim postings rising to 2,889 alongside a record 111 active groups. Despite Qilin remaining the most prolific operator, its 12.5% share and the growing number of lower-volume groups indicate continued decentralisation.
It added momentum signals in Q3 2026 that point to a changing watch list, with SilentRansomGroup, Wallstreet, and Vexy Ransomware showing the strongest quarter-end acceleration, while Threeam and Termite retained momentum from Q2. “The prominence of several lower-volume groups suggests continued ecosystem churn rather than acceleration being confined to established operators. We assess with moderate confidence that these groups warrant heightened monitoring into Q4, although DLS-based momentum should be corroborated with wider CTI and incident telemetry.”
The analysis assessed with moderate confidence that elevated activity is likely to persist into Q4, with established RaaS programmes sustaining high operational tempo while emerging and resurgent groups add further volatility to the threat landscape.
