Page 14 - EngineerIT June July Issue 2026

CYBERSECURITY

Q1 2026 Ransomware Report: Fewer

groups, higher impact: the trends

shaping attackers' next moves

lobal ransomware activity As cybercriminal operations consolidate and adopt more advanced
remained at near record highs capabilities, including AI-enabled tactics, ransomware attacks are
Gin Q1 2026. However, attacks are becoming more disruptive, scalable, and costly for organisations worldwide.
increasingly being driven by a smaller
number of highly capable ransomware Key findings:
groups, marking a significant shift in the • 2,122 organisations were listed on ransomware data leak sites in Q1
threat landscape. 2026, making it the second-highest Q1 on record.
• The top 10 ransomware groups accounted for 71% of all victims,
According to Check Point Research’s reversing the fragmented landscape seen throughout much of 2025.
State of Ransomware Q1 2026 report, • Qilin remained the most active ransomware operation for the third
2,122 organisations were extorted during consecutive quarter, posting 338 victims.
the quarter, making it the second- • The Gentlemen emerged as the breakout group, increasing activity
highest Q1 on record. from 40 victims in Q4 2025 to 166 in Q1 2026.
• LockBit confirmed its comeback, posting 163 victims and re-entering
the global top tier.

Taken together, these figures show that ransomware volume has stabilised
at a high baseline, while operational power is concentrating in fewer, more
capable hands.

Lorna Hardie, Regional Director, Africa, at Check Point Software Technologies

14 | EngineerIT June/July 2026