The Ransomware Economy Expands: Activity Got Bigger, Broader and More Fragmented

Q3 2026 marked a material acceleration in public ransomware victims. CyberMon DRI telemetry recorded 2,942 victims, up from 2,373 in Q2, while the number of active groups increased from 89 to 106. That represents a 24.0% quarter-over-quarter increase in victims and a 19.1% increase in active groups.

The quarter was not simply busier; it was more fragmented. Thirty-four groups were first observed during Q3 versus 24 in Q2. Manufacturing became the largest affected sector in Q3, while Technology, Healthcare and Financial Services all expanded meaningfully. The United States remained the dominant geography by a wide margin.

India deserves specific attention. The Q3 India dataset contains 75 ransomware victims explicitly geolocated to India across the full quarter: 24 in July, 27 in August and 24 in September. Manufacturing leads with 18 victims, followed by Technology with 15. TheGentlemen is the most active group in the India dataset with 16 victims, followed by Krybit with 9 and Vexy Ransomware with 5.

Ransomware victim count rose sharply through July and reached its strongest weekly level in early August, approaching 300 victims worldwide in a week. Activity then moderated through late August and early September, rebounded around mid-September, and declined again at quarter-end. The pattern suggests multiple overlapping campaigns rather than a single sustained spike.

Manufacturing led Q3 with 480 victims, followed by Professional Services (407), Technology (372), Healthcare (281) and Retail & E-Commerce (199). Financial Services recorded 154 victims. Compared with Q2, Manufacturing rose from 394 to 480 (+21.8%), Technology from 260 to 372 (+43.1%), Healthcare from 204 to 281 (+37.7%), and Financial Services from 107 to 154 (+43.9%). Professional Services moved in the opposite direction, falling from 519 to 407 (-21.6%).

The top-group view shows TheGentlemen and Qilin far ahead of most peers, with Incransom, Krybit, LockBit5, Akira, Storm, SafePay, DragonForce and Direwolf forming the next tier. The important strategic signal is the coexistence of a few high-volume operators with a long tail of newly appearing brands.

The United States remained the most heavily represented country by a substantial margin. Germany, the United Kingdom, Italy, Canada and Brazil formed the next tier, while India also appears among the leading countries in the quarter's geographic distribution. Of 2,942 Q3 victims, 2,714 were geolocated in the telemetry.

The Q2-to-Q3 comparison points to both scale and diversification. Victim count increased by 569 victims, while 17 additional groups became active. The count of countries affected rose by 17, but the number of represented sectors remained unchanged at 13 — indicating broader geographic and actor expansion rather than expansion into entirely new industry categories.

Q2 was led by Professional Services (519), Manufacturing (394), Technology (260), Retail & E-Commerce (212) and Healthcare (204). By Q3, Manufacturing had moved into first place and Technology and Healthcare had grown substantially, while Professional Services declined.

At the actor level, Qilin led Q2, followed by TheGentlemen and DragonForce. In Q3, TheGentlemen moved to the top position, Qilin remained a dominant operator, and newer/high-growth names such as Krybit and Storm became more visible.

CyberMon DRI telemetry identified 34 ransomware brands first seen during Q3, compared with 24 in Q2. The Q3 cohort included Doommageddon, Booba Project, CRPxO, Global Secret Group, ExfilSquad, Orova, Panzer, Dark Project, L Group, Storm, Emperador, Vexy Ransomware, N0n, EndZone and others. The large number of first-seen brands reinforces a recurring challenge for defenders: brand churn can outpace traditional static blocklists and reputation-based monitoring.

Storm stands out within the first-seen Q3 cohort with 76 victims in the quarter's telemetry. Global Secret Group recorded 48, Orova 47, CRPxO 37, Panzer 35, Emperador 32 and Dark Project 30. These counts show that a newly observed brand can establish meaningful victim volume quickly.

The India-specific dataset contains 75 victims across the full quarter.

Manufacturing is the largest sector in the India dataset with 18 victims (24.0%), followed by Technology with 15 (20.0%). Other activity accounts for 10 victims (13.3%), Healthcare for 8 (10.7%), Unclassified for 5 (6.7%) and Financial Services for 4 (5.3%). Education and Professional Services record 3 victims each, while Energy & Utilities, Transportation, Hospitality and Retail & E-Commerce record 2 each; Government & Defense records 1.

TheGentlemen leads India-focused ransomware activity with 16 victims (21.3%), followed by Krybit with 9 (12.0%) and Vexy Ransomware with 5 (6.7%). Global Secret Group and Clop record 4 victims each, while Doommageddon, Everest and Nightspire record 3 each. Vexy's position remains notable because it was first observed during Q3 yet already ranks third in the India dataset.

India-focused ransomware activity was remarkably even across Q3: July recorded 24 victims, August 27 and September 24. August was the quarter's highest month, but only marginally, suggesting sustained rather than isolated ransomware pressure on Indian organisations.

The full list of India-geolocated claims observed in Q3, as captured in CyberMon DRI telemetry. Entries are publicly observed leak-site or extortion claims; inclusion here does not independently confirm that a listed organisation was compromised, nor the scope of any compromise.

• External exposure needs continuous monitoring. The combination of higher victim volume and more active groups increases the probability that exposed internet-facing assets, leaked credentials and forgotten infrastructure are discovered and operationalised by different actors.
• Actor-name monitoring alone is insufficient. Thirty-four first-seen brands in one quarter means defenders should track infrastructure, victimology, credential exposure, initial-access patterns and leak-site activity — not only known ransomware names.
• Manufacturing and technology require heightened attention. Both sectors increased materially from Q2 to Q3, and manufacturing became the largest sector in the quarter.
• India-focused intelligence should be treated as a dedicated lens. The visible India victim list spans manufacturing, technology, education, energy, finance, healthcare and other sectors, with both established and newly observed groups represented.

This report analyses CyberMon DRI ransomware claim telemetry captured for Q2 and Q3 2026. A "victim" is a publicly observed ransomware/extortion claim; it does not independently prove encryption, payment, or the full scope of compromise. Claim dates represent observed disclosure timing and may differ from intrusion dates. Group counts reflect names/brands present in the telemetry and may include rebrands, splinters or affiliate-driven operations.