June 2026 Ransomware Surge: The Gentlemen Dethrone Qilin in a Fragmented Threat Landscape In June 2026, the ransomware ecosystem saw a dramatic shift as The Gentlemen, a previously obscure group, claimed 94 victims enough to unseat Qilin from its five-month reign as the most active ransomware operation. The shakeup reflects a broader trend: a 9% month-over-month increase in ransomware attacks, with 707 victims across 87 countries, according to tracking firm Breachsense. ### A Volatile Leaderboard The top three groups in June accounted for over a third of all attacks, underscoring how a small number of well-resourced affiliate crews can rapidly reshape the threat landscape: - 1st: The Gentlemen (94 victims) – A newcomer that surged to the top in its first major tracked month. - 2nd: DeadLock (81 victims) – Another new entrant, debuting at second place, likely absorbing affiliates from disbanded operations. - 3rd: Qilin (71 victims) – Dropped after a five-month dominance, though still a major player. This churn is typical of the ransomware-as-a-service (RaaS) model, where groups rebrand, dissolve, or lose affiliates to rivals almost overnight. The rapid rise of The Gentlemen and DeadLock suggests they may have poached affiliates from established crews by offering better payouts or infrastructure. ### Key Incidents and Targets June’s attacks highlighted ransomware’s focus on high-value data and critical infrastructure: - FulcrumSec demanded $25 million from Novo Nordisk, stealing 1.3 TB of clinical trial data and AI models a prime target for resale or secondary extortion. - Nova targeted Australia’s NSW Rural Fire Service, exfiltrating 300 GB of sensitive data, demonstrating ransomware’s persistent threat to public-sector organizations. - Unpatched vulnerabilities remained the primary entry point, with CVE-2026-20230 (Cisco Unified CM) and CVE-2026-41089 (Windows Netlogon) exploited to gain initial access. ### Payment Rates Decline, Extortion Tactics Evolve Despite the surge in attacks, 69% of victims refused to pay in 2026 a trend driven by better backups, stricter cyber insurance policies, and law enforcement discouragement. This has pushed gangs toward data-theft-only extortion, where stolen data (rather than encryption) is the primary leverage. ### Regulatory and Market Impact The 9% rise in attacks and ransomware’s 48% share of all breaches (per Verizon’s 2026 DBIR) are pressuring cyber insurance underwriters to tighten requirements, while security teams must adapt to rapidly shifting threat groups. The fragmented RaaS market where new groups can dominate within weeks means defenders must focus on behavior-based detection rather than tracking specific gangs. ### Outlook for 2026 The rest of the year is expected to see: - Further leaderboard churn, with new groups likely cracking the top three. - Continued decline in payment rates, accelerating the shift to data-theft extortion. - Persistent exploitation of unpatched edge devices, keeping patch management a critical priority. - Faster disclosures due to stricter regulatory reporting, making monthly victim counts appear more volatile. June’s surge is less an anomaly than a continuation of the post-2024 ransomware landscape, where no group stays on top for long, affiliates move quickly, and defenders must prioritize fundamental security controls over chasing the latest threat actor.