The Gentlemen Ransomware Gang Dominates Q2 2024 with Record Attacks A recent analysis by cybersecurity firm ReliaQuest reveals that The Gentlemen ransomware gang emerged as the most active threat group between April and June 2024, responsible for 300 incidents surpassing long-standing leaders like Qilin, which recorded 289 attacks in the same period. The findings, published on July 16, highlight a shift in the ransomware landscape, with The Gentlemen displacing Qilin as the top operator after its dominance throughout 2023. Over the three-month span, 11 ransomware groups claimed 1,368 victims across 99 countries, with The Gentlemen and Qilin significantly outpacing other major players. DragonForce, Akira, and LockBit followed, each linked to 100–150 incidents, though none matched the scale of the two leading groups. ReliaQuest attributes The Gentlemen’s rapid rise to its aggressive affiliate recruitment and a pre-packaged intrusion kit that lowers the barrier to entry for new operators. The group provides affiliates with a detailed playbook, covering attack workflows, target selection (including edge devices), and tools like lightweight tunneling and SMB encryption for efficient deployment. Leaked chat logs also suggest The Gentlemen leverages AI tools to accelerate development, outpacing rivals in updating its malware and infrastructure. Security analyst Tristano Di Liberto noted that The Gentlemen’s AI-driven build pipeline and proven affiliate throughput could entice operators from competing ransomware-as-a-service (RaaS) programs, potentially sustaining its dominance into Q3 2024. The group’s streamlined approach contrasts with the slower adaptation of established gangs, signaling a new phase in ransomware evolution.

Ransomware Surge in Early 2026: Key Trends and Evolving Threat Tactics A recent analysis by Bitdefender reveals a sharp rise in ransomware attacks targeting U.S. organizations in the first two months of 2026, with 53 active groups claiming victims seven of which have dominated the threat landscape for over four months. Among the most prolific are Qilin, Akira, Clop, INC Ransom, Play, DragonForce, and Sinobi, though Qilin likely leads in confirmed U.S. victims after excluding inflated claims from 0APT, a group notorious for false reporting. Between January and February, 750–800 U.S. organizations were impacted, with construction and manufacturing bearing the brunt of attacks, followed by technology, healthcare, and legal sectors. Despite the surge in attacks, ransom payments are declining, a shift attributed to stricter cyber insurance requirements, regulatory pressures, and improved incident response practices bolstered by guidance from agencies like CISA, the FBI, and the NSA. ### Evolving Attack Patterns Ransomware groups are refining their tactics to evade detection and maximize impact: 1. Identity-First Compromise Attackers are prioritizing credential theft such as browser session tokens over brute-force methods to bypass multi-factor authentication (MFA) and reduce detection noise. Encrypting authentication tokens and enforcing strict session lifetimes could mitigate this risk. 2. Supply Chain Exploitation Groups are increasingly targeting vendors and SaaS platforms to compromise multiple downstream victims. High-profile examples include ShinyHunters, which orchestrated large-scale supply chain attacks in 2025. While MFA and patch management remain critical, they are no longer sufficient against identity-based breaches. 3. Automated Exploitation The time-to-exploit window has shrunk dramatically, with attackers leveraging AI-driven tools like CyberStrukeAI to automate vulnerability exploitation within hours of a proof-of-concept (PoC) release down from days in 2024–2025. This acceleration allows threat actors to rapidly scale attacks before defenses can react. 4. BYOVD (Bring Your Own Vulnerable Driver) Attacks A resurgence in defense evasion tactics has seen ransomware groups weaponize legitimate drivers to gain kernel-level access, bypassing EDR and antivirus solutions. Unlike past multi-stage attacks, modern ransomware now embeds vulnerable drivers directly, syncing evasion and encryption in a single phase. By Q2 2026, BYOVD attacks are projected to account for 75% of ransomware incidents, posing a severe challenge for defenders. ### Emerging Threat Landscape The ransomware ecosystem is undergoing structural shifts: - RaaS (Ransomware-as-a-Service) platforms are expanding, with some groups offering low-cost or free access to attract affiliates. - Hacktivist messaging is being co-opted by ransomware groups amid geopolitical tensions, particularly in the context of the Iran conflict. - Specialized roles such as initial access brokers (IABs), penetration testers, and negotiators are becoming more defined, reflecting a maturing criminal economy. - Living Off the Cloud (LOTC) tactics are rising, with attackers repurposing cloud management tools (e.g., AWS, Box) to exfiltrate or lock data. Traditional whitelisting is ineffective, as even approved applications can be abused. ### Future Targets Ransomware groups are diversifying their initial access points, with growing focus on: - Edge devices (VPNs, firewalls) as low-effort entry points. - Hypervisors and cloud services, where modern encryptors (e.g., ESXi-targeting malware) can cripple virtualized environments. - Proactive reconnaissance, with attackers scanning for exposed data and vulnerabilities before striking. As the threat landscape evolves, behavior-based detection and dual-control security measures are becoming essential to counter LOTL/LOTC attacks, while BYOVD tactics demand heightened scrutiny of driver vulnerabilities. The first half of 2026 signals a more automated, evasive, and supply-chain-focused ransomware threat one that prioritizes speed and stealth over traditional brute-force methods.

Ransomware Affiliate Masquerades as Recovery Service in Sophisticated Extortion Scheme A suspected ransomware affiliate is targeting victims under the guise of a recovery service called Ransom Busters, contacting them before attacks become public and offering decryption keys and data deletion for a fee. GuidePoint Security’s Research and Intelligence Team (GRIT) uncovered the scheme after responding to multiple ransomware incidents where victims received unsolicited emails from the group. Ransom Busters claimed to exploit vulnerabilities in ransomware-as-a-service (RaaS) administrative panels, granting access to encryption keys and stolen data from operations like DragonForce, Settra, and Anubis. The group demanded payments between $20,000 and $60,000 to delete data from ransomware servers. However, GRIT’s investigation revealed strong evidence linking Ransom Busters to the attacks themselves. In two incidents, the same tools (SoftPerfect Network Scanner, s5cmd, Remotely), tactics (including a backdoor account with the password Numlock!123), and attacker-controlled hostname (DESKTOP-BBETH6K) were used. GRIT concluded with moderate confidence that Ransom Busters is a single ransomware affiliate attempting to divert ransom payments from RaaS gangs. While no victims have reportedly paid the group, one victim instead paid the RaaS operation behind the attack yet their data was not leaked, suggesting Ransom Busters may have complied with the agreement. Ransomware negotiation firm Coveware confirmed encountering similar activity, noting this behavior differs from typical "ambulance chasers" who target publicly disclosed victims. Unlike those opportunists, Ransom Busters exploits non-public incidents, increasing risks for victims paying the ransom may no longer guarantee data deletion if multiple parties have access. Coveware warned that growing distrust within RaaS ecosystems could fuel more such schemes as affiliates seek additional profits outside standard revenue-sharing models. The incident highlights an alarming evolution in ransomware tactics, where attackers not only encrypt data but also pose as recovery services to exploit victims before breaches are detected.