01Threat Actor Distribution
- Qilin's listings fell from 165 to 73, with its US listings down from 55 to 24.
- The table lists 30 groups individually, the most in the reporting period; Others accounted for 19.3% of listings, including 14 without an identified group.
- Several groups that rose in August fell back, including Clop (45 to 2), Orova (45 to 2) and Dire Wolf (43 to 19), while Storm (36) tied with Akira for third place.
02Geographic Distribution
- Victims were recorded in 93 countries, the highest number in the reporting period and up from 79 in August, despite the 22.7% decline in total listings.
- US victims fell from 448 to 334, accounting for 47.3% of the month's overall decline.
- Italy (51 to 22) and Germany (53 to 28) also declined, leaving Canada second with 31 victims.
03Industry Distribution
- Manufacturing fell by 80 victims, the largest decline among industries, and its 18.6% share was its lowest in the reporting period.
- Professional, Scientific, and Technical Services (139) moved closer to Manufacturing, trailing by 14 victims compared with 53 in August.
- The Gentlemen was the leading group in both Manufacturing (22) and Retail Trade (16), while Storm's largest sector was Finance and Insurance (10).
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Storm listed the most victims in the United States (30 of 334 victims).
- Storm listed the most victims in Canada (5 of 31 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- The Gentlemen listed the most victims in Manufacturing (22 of 153 victims).
- Qilin listed the most victims in Professional, Scientific, and Technical Services (15 of 139 victims).
06Six Month Trend Context
Listings rose for three consecutive months to August's 1,063 before falling to 822 in September. Even after the decline, September's total remained above each month from April to June.
07Security Findings
- Misconfiguration64.0%
MX and DNS misconfiguration that may enable spoofing or phishing
463 of 724 - Software Vulnerability58.6%
Out-of-date services/products with potentially highly exploitable vulnerabilities
424 of 724 - Critical Exposed Network Services51.8%
Open RDP or SMB ports publicly visible
375 of 724 - Botnet Activity47.8%
At least one IP address involved in botnet, malware propagation or spam propagation
346 of 724 - Fraudulent Domains41.7%
At least one possible phishing domain
302 of 724 - Stealer Logs38.5%
At least one record found in stealer logs
279 of 724 - Credential Stuffing26.4%
At least one credential leaked in the last 90 days
191 of 724
Misconfiguration (64.0%) and Software Vulnerability (58.6%) were the most common findings among scanned victims, and Credential Stuffing the least common (26.4%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- Listings fell 22.7% from August's high to 822 but remained 42.2% above September 2025.
- Qilin's listings more than halved, from 165 to 73, and The Gentlemen led with 105.
- Victim listings spanned 93 countries, up from 79 in August—the widest geographic distribution in the reporting period.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.