Threat Intel
Ransomware Landscape Shifts: Q2 2026 Report Highlights Growing Competition and AI‑Accelerated Ops
Check Point Research’s Q2 2026 ransomware report shows the ecosystem is still dominated by a handful of RaaS groups, but the tail is widening: 93 active actors now versus 71 in Q1, with the top 10 accounting for 57.6 % of victims (down from 71 %). Victim numbers stayed flat quarter‑on‑quarter, yet the US share dropped to 42 % as new groups like The Gentlemen and Krybit target fewer American targets. The Gentlemen’s internal leak revealed an AI‑powered ransomware‑management panel built in three days, marking the first hard evidence that generative‑AI is speeding up malicious tool development. P
Check Point Research’s latest State of Ransomware report for Q2 2026 paints a picture of a still‑concentrated yet increasingly crowded threat landscape. While the top players keep pulling the lion’s share of damage, the number of active groups has climbed to 93, a new high for the period.
Ecosystem Dynamics
- Top 10 groups now hit 57.6 % of all victims, down from 71 % in Q1.
- Total victim count remained steady quarter‑on‑quarter, but grew 33 % YoY.
- Active actors rose from 71 to 93, widening the tail of the distribution.
Top Players
- Qilin and The Gentlemen fought for the top spot, with Qilin recording 279 victims (‑17 %) and The Gentlemen surging 62 % to 269.
- June saw The Gentlemen surpass Qilin for the first time.
AI‑Driven Tooling
Internal leak from The Gentlemen exposed a nine‑person core team that used AI coding assistants to build a ransomware‑management panel in just three days—first concrete evidence that generative‑AI is shortening tool development cycles.
Payment Landscape
- Ransom payment rates fell to a multi‑year low near 23 %, a steep decline from 85 % in 2019.
- On‑chain payouts still exceeded $820 million in 2025.
- Large enterprises continue to pay high sums, while mid‑market victims hold firm or settle for smaller amounts.
Law Enforcement Focus
- Shifted from targeting individual groups to dismantling shared infrastructure.
- Key takedowns: a cryptocurrency laundering platform, a malware‑signing service, and large infostealer/VPN anonymization networks.
- Sanctions imposed on major Iranian digital‑asset exchanges.
Geographic Trends
- US victim share dropped from 50 % to 42 % quarter‑on‑quarter.
- Newer groups such as The Gentlemen and Krybit target the US less frequently than the ecosystem average.
Rapid Exploit Turnover
- Exploit windows are shrinking; vulnerabilities are weaponized within hours to days of disclosure.
- AI tools lower the cost and speed of exploit development, giving ransomware operators a first‑mover advantage.
Related vulnerabilities
August 17th Threat Intel: From Colombian Ransomware to AI‑Driven Espionage and Critical Vulnerabilities
This week’s bulletin highlights a ransomware hit on Colombia’s Ministry of Justice that stalled drug‑monitoring services, a 19‑million‑person data breach at Poland’s MyDr platform, and a social‑engineering attack on Levi Strauss that stole internal data. A phishing incident at U.S. defense contractor IEH Corp exposed sensitive engineering files. Researchers exposed a China‑linked AI campaign that mapped Taiwanese government systems, a North Korea‑linked Kimsuky offline AI toolkit, and the replayability of encrypted reasoning blocks from major LLM APIs. Patch Tuesday saw Microsoft, Apple, Adobe
Read briefing
CrowdStrike Launches $100K ‘Agents of Chaos’ AI Red‑Team Competition
CrowdStrike has rolled out Agents of Chaos, a $100,000 contest that forces defenders to craft AI‑powered defenses against advanced adversarial attacks. The challenge, part of the company’s agentic SOC vision, pits teams in a simulated battlefield where AI‑driven threat actors try to slip past detection while participants deploy machine‑learning‑augmented security controls. Winners earn the prize and a chance to embed their solutions into the Falcon platform.
Read briefing
AI Platforms Become New Attack Vectors: Hackers Hijack Claude, ChatGPT and More
As AI tools like Claude, ChatGPT and Grok become integral to daily workflows, threat actors are turning these trusted platforms into launchpads for malware, phishing, and data theft. By weaponizing shareable AI artifacts, exploiting sponsored search results and embedding malicious instructions in seemingly legitimate AI conversations, attackers can deliver ransomware, credential stealers and other payloads with minimal user suspicion. Recent campaigns—FakeAgent’s Claude Artifact redirect to SectopRAT and a fake Apple‑support guide on claude.ai/share that installs the MacSync stealer—show how q
Read briefing
CrowdStrike Launches Agentic Identity Provider to Secure AI Agents
CrowdStrike has unveiled its Agentic Identity Provider, a next‑generation identity framework that assigns a unique, verifiable identity to every AI agent deployed across an organization. By tying access rights to real‑time contextual signals, the solution enforces zero‑trust principles and tightens privileged‑access controls for autonomous agents. The move addresses growing concerns around the security of AI‑driven operations and aims to prevent misuse of AI tools while maintaining operational agility.
Read briefing