Qilin Stays on Top of Ransomware, but The Gentlemen and DragonForce Are Closing In

The ransomware scoreboard for the first half of 2026 has a familiar leader and some fast-moving challengers. Qilin remained the most prolific group on data-leak sites for a third quarter running, but its lead is shrinking as The Gentlemen and DragonForce gain ground and LockBit's fifth-generation operation re-enters the top five.

The quarter in numbers

Threat-intelligence firm Brandefense counted 2,509 confirmed victims posted by 91 distinct groups in the second quarter of 2026, a period it measured through 3 July. That was about 17.5 percent above the first quarter, implying roughly 2,135 victims then. June 2026 was the busiest single month in the post's tracking window, with 919 victim postings. Check Point had separately tallied 2,122 new Q1 victims across more than 70 leak sites, and said Qilin, Akira, The Gentlemen and LockBit together accounted for about 41 percent of them.

Qilin posted 305 victims in Q2, down 16 percent from 363 in Q1, though still comfortably first. Akira, which spent much of 2025 in second place, logged 169, down 4.5 percent from 177. The Gentlemen climbed from 183 to 239, a rise of 30.6 percent, and DragonForce went from 101 to 144, up 42.6 percent. LockBit5 appeared in the top five with 115 victims, displacing IncRansom and Cl0p from the Q1 list.

How these groups get in

Brandefense's profiles of the leaders emphasise ordinary entry points rather than exotic exploits. Qilin affiliates are described as abusing valid VPN and remote-desktop credentials and using an encryptor aimed at VMware ESXi hosts. The Gentlemen use valid accounts and a Fortinet firewall flaw, then stage data with common transfer tools. Akira has been tied to Cisco AnyConnect VPNs lacking multi-factor authentication and to techniques that blind endpoint security. LockBit5 leans on edge-device flaws and Group Policy to deploy domain-wide. DragonForce is associated with compromising managed service providers to reach many customers at once. The sectors hit most often are manufacturing, professional services and healthcare.

Reading the numbers carefully

Leak-site counts are a rough proxy. They record what criminals choose to post, not confirmed breaches, and trackers disagree. One profile cites 641 Qilin victims for the first half; Brandefense's own quarterly figures sum to about 668. Some leak sites have posted inflated or fabricated lists: a group called 0APT launched a site in January 2026 with more than 200 claimed victims that researchers judged largely exaggerated. ZeroFox flagged Qilin for a record number of monthly attacks earlier in the year, while Positive Technologies described a market concentrating around a few major actors. Brandefense suggests Qilin's Q2 dip may reflect affiliates drifting to competing platforms, which is a common ransomware dynamic after disputes, rebrandings and law-enforcement attention.

The broader context is a market that is both fragmented and concentrated. Europol's IOCTA 2026 report said more than 120 active ransomware brands were observed in 2025, yet a handful account for most of the posts. Brandefense's tally shows the top five groups responsible for 972 of the 2,509 Q2 victims, while 86 other groups shared the remaining 1,537. That long tail matters to defenders because small groups are less predictable: they reuse leaked builders, buy access from brokers and often hit smaller organisations with thinner defences. Meanwhile, Qilin's dip and The Gentlemen's rise are a reminder that the underlying labour pool, the affiliates who actually break in, is mobile and will follow better revenue splits and tooling.

For security teams, the practical reading is to prepare for the common methods rather than a particular brand: enforce multi-factor authentication on every remote-access path, patch firewalls and VPN appliances quickly, restrict who can reach hypervisors, and rehearse restoring from offline backups.

What to watch

• Whether The Gentlemen overtake Qilin in Q3, which would mark the clearest change of leader since 2025.
• Affiliate migration: ransomware-as-a-service brands rise and fall with the affiliates who choose them.
• Edge-device patching and MFA coverage, because the headline groups rely on credentials and perimeter flaws more than novelty.
• Law-enforcement pressure; see also the KillSec takedown in early October.

Sources

1. Top 5 Ransomware Groups in Q2 2026 — Brandefense
2. Ransomware ecosystem in Q1 2026: market concentrates around major actors — Positive Technologies
3. Flash report: Qilin claims record number of monthly attacks for 2026 — ZeroFox