Page 15 - EngineerIT June July Issue 2026

CYBERSECURITY

"Although the Q1 2026 ransomware
1000
trends are based on global data, 927 945
900
these findings are particularly
800 801
relevant to African organisations.
730 727 732
In recent years, both the public 700 684 707
635 634
and private sectors in Africa 600 603
541 534 531 543
have faced an increase in cyber 500 494 518
477 479
incidents that disrupt critical 400 407 387
services, financial systems, 347
300
healthcare, telecommunications,
200
and government operations," says
100
Lorna Hardie, Regional Director,
0
Africa, at Check Point Software
Jun-24 Jul-24 Sep-24 Oct-24 Nov-24 Dec-24 Jan-25 Feb-25 Mar-25 Apr-25 Jun-25 Jul-25 Sep-25 Oct-25 Nov-25 Dec-25 Jan-26 Feb-26 Mar-26
Technologies. Aug-24 May-25 Aug-25
"Ransomware groups are no Figure 1: Total number of reported ransomware victims in DLS, per month (Jun 2024 - Mar 2026).
longer targeting only the world’s
biggest economies. As the report From fragmentation to consolidation
shows, attackers now often The most important change this quarter is not how many attacks occurred, but who
target places where they already carried them out.
have access, not just the most • In Q3 2025, ransomware activity was spread across a record number of groups.
profitable targets," she adds. • By Q1 2026, the number of active groups had declined
• At the same time, the share of victims claimed by top operators surged past 70%
High Volume Is the New
Normal This pattern is familiar. Law enforcement pressure, infrastructure disruption, and
Check Point Research tracked the competitive landscape tend to scatter smaller players. Stronger groups survive,
more than 70 active ransomware absorb displaced affiliates, and grow. In Q1 2026, groups such as Qilin, Akira,
data leak sites during Q1 2026. The Gentlemen, and LockBit together accounted for 41% of all victims, while the
top 10 ransomware groups accounted for 71%.
These sites were recorded:
• More than 700 victims per For defenders, consolidation raises the stakes. Larger ransomware operations tend to be:
month on average • More organised
• Minimal fluctuation between • More operationally consistent
January, February, and March • More resilient to disruption

At first glance, year-over-
year (YoY) numbers suggest a Qilin, 338
modest decline compared to Q1
2025. However, that comparison
Other, 614
is misleading. A single mass-
exploitation campaign inflated
last year’s figures. When
Akira, 197
that anomaly is removed,
ransomware activity actually
increased YoY.

"The takeaway for business The Gentlemen, 166
leaders is straightforward. Sinobi, 80
Ransomware is no longer driven
by short-term spikes alone. Nightspire, 82
Instead, activity has settled into a Lockbit, 163
DragonForce, 101
persistently high operating level
with consistent growth, creating Play, 121 INC Ransom, 133
Cl0p, 127
a risk environment organisations
must plan for," Hardie says. Figure 2: Top 10 ransomware groups by number of publicly claimed victims - Q1 2026.

15 | EngineerIT June/July 2026