Skip to main content
New 2026 Ransomware Report: Why Every Year Becomes the Worst Year on RecordRead the Report

Ransomware Report May 2026

An In-Depth Analysis of the Latest Ransomware Trends and Threat Landscape

Dive into the constantly shifting world of ransomware, as we uncover the latest tactics, dissect the most prolific actors, and offer insights to keep your organization one step ahead.

Welcome to the May 2026 ransomware update, highlighting the latest trends, threat actors, and significant developments shaping the ransomware landscape. The Black Kite Research Group tracked 716 ransomware victim listings this month.

Black Kite recorded 716 ransomware victim listings in May 2026, slightly below April's 736. The overall picture was stable, with the same leading group, country and industries as in April, while several mid-sized groups changed position.

Geographic Distribution

The United States accounted for 315 victims, or 44.0% of the month's listings, compared with 41.7% in April. The next most represented countries were Canada (33), the United Kingdom (31) and Germany (29).

Threat Actor Activity

Qilin remained the most active group with 108 victims (15.1%), down from 116 in April. The Gentlemen (76) and DragonForce (54) were the next most active groups.

Eight newly observed threat actors appeared in May: Bavacai (23), CMD Organization (17), Leak Bazaar (9), TITAN (9), 0Day Syndicate (5), Icarus (1), Spy Corporate (1) and Triple X (1).

Industry Impact

Manufacturing was again the most affected industry with 152 victims (21.2%), compared with 168 (22.8%) in April. Professional, Scientific, and Technical Services (133, 18.6%) and Construction (55, 7.7%) followed.

The Black Kite Research Group continues to monitor ransomware activity each month to provide organizations with insight into the shifting threat landscape and help prepare defenses against the evolving tactics of cybercriminal groups.

Total victims (ransomware victim listings)
716
Month-over-month change (-20 vs April 2026 (736))
-2.7%
Active threat actors (named groups with at least one listing)
60
Countries affected (countries with at least one victim)
76
Leading threat actor (108 victims · 15.1%)
Qilin
Leading country (315 victims · 44.0%)
United States of America
Leading industry (152 victims · 21.2%)
Manufacturing
Newly observed threat actors (first observed in our dataset this month)
8

01Threat Actor Distribution

  • Qilin (108), The Gentlemen (76) and DragonForce (54) held the top three positions for the second consecutive month.
  • SafePay nearly tripled from 10 to 29 listings, while Coinbase Cartel fell from 41 to 10.
  • Bavacai was first observed in our dataset with 23 listings, and RALord(Nova) rose from 8 to 25.

02Geographic Distribution

  • The geographic distribution was broadly stable: the United States accounted for 315 victims (44.0%), compared with 307 (41.7%) in April.
  • The four leading countries were the same as in April, in a slightly different order: Canada (33), the United Kingdom (31) and Germany (29) followed the United States.
  • Qilin listed 60 US victims, more than twice as many as Akira or DragonForce (29 each).

03Industry Distribution

  • Manufacturing (152) and Professional, Scientific, and Technical Services (133) remained the two leading industries, together accounting for 39.8% of listings.
  • Construction (44 to 55) and Wholesale Trade (42 to 52) increased, while Retail Trade fell from 44 to 28.
  • DragonForce's largest sector was Professional, Scientific, and Technical Services (16), while Qilin and The Gentlemen each listed Manufacturing most often.

04Threat Actor × Country Matrix

The matrix below shows how leading ransomware groups distributed their activity geographically.

Qilin
The Gentlemen
DragonForce
Akira
INC Ransom
SafePay
Lockbit 5.0
RALord(Nova)
Bavacai
Genesis
Others
USA
60
18
29
29
22
3
3
2
7
13
129
Canada
5
2
5
3
1
3
1
13
UK
4
3
6
2
3
1
2
1
9
Germany
1
2
2
2
8
1
3
10
Spain
5
2
2
2
2
2
7
Italy
2
4
1
1
3
1
1
4
Australia
5
1
1
2
1
2
4
France
2
1
1
1
2
8
Thailand
4
1
1
7
Netherlands
3
3
1
1
1
3
Others
20
42
4
3
6
6
16
18
7
3
88
Grand Total
108
76
54
42
33
29
26
25
23
18
282
  • Qilin listed the most victims in the United States (60 of 315 victims).
  • Qilin listed the most victims in Canada (5 of 33 victims).

05Threat Actor × Industry Matrix

This view highlights sector specialization across leading ransomware groups.

Qilin
The Gentlemen
DragonForce
Akira
INC Ransom
SafePay
Lockbit 5.0
RALord(Nova)
Bavacai
Genesis
Others
Manufacturing
21
19
6
14
10
7
6
2
4
1
62
Professional, Scientific, and Technical Services
20
11
16
8
6
4
3
5
4
5
51
Construction
15
4
7
4
3
2
1
3
16
Wholesale Trade
8
10
4
2
2
3
1
2
1
19
Health Care and Social Assistance
7
3
2
3
4
3
2
1
19
Finance and Insurance
6
4
4
2
2
1
1
16
Information
2
3
2
1
1
1
2
2
1
16
Retail Trade
6
3
1
1
1
1
2
3
1
9
Educational Services
2
3
2
3
5
2
8
Other Services (except Public Administration)
3
3
2
1
1
2
9
Others
18
13
12
7
3
8
5
9
5
2
57
Grand Total
108
76
54
42
33
29
26
25
23
18
282
  • Qilin listed the most victims in Manufacturing (21 of 152 victims).
  • Qilin listed the most victims in Professional, Scientific, and Technical Services (20 of 133 victims).

06Six Month Trend Context

Apart from March's 862, monthly listings stayed between 716 and 813 over the six months. May's 716 was the lowest total in the window.

07Security Findings

  1. Misconfiguration69.0%

    MX and DNS misconfiguration that may enable spoofing or phishing

    467 of 677
  2. Software Vulnerability60.0%

    Out-of-date services/products with potentially highly exploitable vulnerabilities

    406 of 677
  3. Critical Exposed Network Services51.1%

    Open RDP or SMB ports publicly visible

    346 of 677
  4. Fraudulent Domains46.4%

    At least one possible phishing domain

    314 of 677
  5. Botnet Activity45.5%

    At least one IP address involved in botnet, malware propagation or spam propagation

    308 of 677
  6. Stealer Logs40.8%

    At least one record found in stealer logs

    276 of 677
  7. Credential Stuffing18.3%

    At least one credential leaked in the last 90 days

    124 of 677

Misconfiguration (69.0%) and Software Vulnerability (60.0%) were the most common findings among scanned victims, and Credential Stuffing the least common (18.3%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.

08Key Takeaways

  • May's 716 listings were the lowest monthly total since September 2025.
  • SafePay nearly tripled from 10 to 29 listings, while Coinbase Cartel fell from 41 to 10.
  • Bavacai was first observed in our dataset with 23 listings.

09Data Methodology and Sources

  • The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
  • Victims are categorized by headquarters country and industry using NAICS classifications.
  • Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
  • Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.

Accelerate Risk Decisions, Cut the Noise.

Join leading teams using Black Kite to slash assessment timelines, eliminate manual reviews, and onboard vendors with confidence.