Threat Actors Surge
One New Group Every Week
The Growth Numbers and Trend
Ransomware became more active and more crowded this year. By the end of the reporting period, Black Kite observed 127 active ransomware groups that had announced at least one victim in the previous 12 months. The post-period pulse pushed that number even higher, reaching 137 in April 2026 and 146 in June 2026. That distinction matters: 127 is the in scope closing number for the April 2025 to March 2026 reporting period, while 146 shows that fragmentation continued after the cutoff rather than slowing down.
The longer term trend is sharper. The active group count moved from 61 in 2023 to 79 in 2024, 96 in 2025, 127 at the end of the current reporting period, and 146 in the post-period view. In three years, the number of active ransomware brands more than doubled. While in the past we’ve seen a temporary reshuffling after the collapse of a few dominant groups, now we see a structural expansion of the market.
Active Ransomware Groups by Month, April 2023–June 2026
The Top 5 Actors Claimed 43.6% of All Victims
The 2026 period also introduced 61 new ransomware groups, more than one new entrant per week. But the market did not become evenly distributed. The top five actors still accounted for 43.6% of all observed victims.
That means two things happened at once:
Expansion at the bottom
Concentration at the top
More brands entered the ecosystem, but a small set of high volume operators still controlled a large share of the output.
Established Actors Drove North American Concentration, New Entrants Spread Wider
Expansion also had a geographic dimension.
Legacy actors remained more heavily concentrated in North America, where 63% of their victims were located. New actors were still active in North America, but less concentrated there, with 46% of their victims in the region. Their victim distribution reached further into Europe, Asia, South America, the Middle East, and Africa.
New Actors Cast a Wider Net: Legacy Groups Concentrated in North America, New Entrants Spread Globally
This does not mean newer groups moved away from established markets. North America still represented the largest regional share for new actors. The difference is concentration. Established actors leaned more heavily on familiar high-volume markets, while newer groups spread their activity more widely across other regions.
That matters because fragmentation is not only a count of ransomware brands. As new actors enter, ransomware pressure can widen geographically even when the largest victim pools remain anchored in familiar markets.
Fast Entry, Faster Exit
The market also became more disposable. Not only did new actor groups enter faster but many disappeared faster too. A lifetime comparison of ransomware actors shows that groups emerging in the current cycle had much shorter operating windows than earlier cohorts. In an equal observation window, actors first seen between April and September 2025 had a median lifespan of 4.9 months, compared with 12.8 months for actors first seen between April and September 2024.
That compression suggests that the ransomware market is becoming easier to enter but harder to sustain. New groups can appear, publish victims, create visibility, and disappear before becoming durable operators. Fragmentation, in this sense, reflects churn as much as scale.
Fragmentation as a Launch Strategy
This is what makes the current phase different from earlier ransomware cycles. In the current cycle, fragmentation means more brands, more experiments, more affiliate movement, and more ways to convert access into public pressure. Some groups entered quietly. Some new or rebranded actors entered the market by publishing large batches of victims early, using disclosure volume to create immediate visibility. Several examples show how this worked. Scattered Lapsus$ Hunters disclosed 39 victims on October 3, including globally recognized names such as Stellantis, UPS, FedEx, IKEA, and others. LockBit 5.0 disclosed 53 victims on December 26, using the holiday period as a pressure window. Kazu, AiLock, The Gentlemen, and other new or rebranded actors also appeared with high volume disclosure moments that looked less like gradual market entry and more like launch campaigns.
The Market Began to Sort Itself
The final quarter also showed early signs of consolidation. While new groups continued to appear, mid tier space became harder to hold. High volume actors absorbed attention, affiliates, and disclosure share, while some smaller or unstable brands faded quickly. The result was a market where new names appeared constantly, but only a smaller set proved capable of sustained scale.
That pattern explains the paradox of 2026 ransomware. The ecosystem fragmented, but it did not disperse evenly. It expanded at the edges while concentrating around the strongest operators. More brands made the market noisier. The leaders made it heavier.
RansomHub, From Leader to Absence
RansomHub shows how quickly leadership can disappear in the ransomware market. In the previous reporting period, it was the top actor with 736 victims. In the current period, it recorded no victims after disappearing in May 2025.
RansomHub: From #1 to Zero in 12 Months
2024 Report Not ranked
2025 Report #1 736 victims
May 2025 Disappeared
2026 Report 0 victims
The brand may disappear, but the affiliates, access paths, and victim knowledge do not necessarily vanish with it.
The timeline should not be read as evidence that one actor directly replaced another. Although RansomHub's decline overlaps with the rise of other high-volume operators, especially Qilin, the available data does not support a direct attribution.
The more important lesson lies elsewhere. Modern ransomware operations are increasingly built around affiliate ecosystems rather than permanent brands. A leak site may disappear, a name may be retired, or an operation may shut down, but the people, access brokers, negotiation experience, victim knowledge, and intrusion techniques often continue under different banners.
Today's dominant ransomware brand can therefore become tomorrow's footnote. This can happen without reducing the overall capability of the ecosystem. In today's ransomware market, brands disappear more easily than affiliates.
Next: Threat actors’ methods tell you how they hunt.
Not every ransomware group operates the same way. Discover the actor models behind the volume.