Report by Halcyon
Ransomware Evolution Report Q22026
Key Findings
Q2 2026 recorded 1,988 ransomware attack claims from 89 groups across 101 countries.
The US accounted for 42.5% of ransomware claims, Canada for 5% and Germany for 4.8%.
Qilin was responsible for 293 attack claims in Q2 2026, though its volume slid each month, from 113 in April to 108 in May and 72 in June.
Payload was responsible for 37 attack claims in Q2 2026, up from 24 in Q1 2026.
The Gentlemen reached 214 claims in H2 2026 and a single-day leak of 37 victims on May 6.
DragonForce was responsible for 143 claims in H2 2026.
PEAR was responsible for 35 claims in H2 2026, nearly triple the 13 posted the quarter before.
Akira posted 119 attack claims in H2 2026.
WorldLeaks was responsible for 28 claims in H2 2026.
LockBit ended H2 2026 with 102 claims.
In H2 2026, manufacturing (19.8%) was the most targeted industry by ransomware, followed by construction (10.1%), business services (9.0%), retail (8.4%), and software (6.8%).
The in-house GentleKiller framework fielded eight BYOVD variants targeting more than 400 processes across 48 security products.