Ransomware is a type of attack that is not slowing down; instead, it is changing form and becoming increasingly dangerous. The trend of ransomware growth and professionalization is also detected by the latest reports from leading research teams in the field of cybersecurity. Based on these, it can be concluded that ransomware has entered a new phase, meaning greater risk for organizations than ever before. At PULSEC, we monitor these trends and directly observe them in the data from our security operations center. Here’s what you need to know.
Ransomware Still at an All-Time High
According to the Check Point Research report for Q1 2026, the first quarter of this year saw data from 2,122 affected organizations appear on ransomware data leak sites, which is the second highest Q1 since this data has been tracked, 117% above Q1 2024. When the effect of a single massive exploitation campaign that impacted last year’s data is removed, ransomware group activity is actually growing year-on-year.
The numbers are high, even when viewed on a monthly basis. The American technology company specializing in early warning, Dataminr, in its 2026 Cyber Threat Landscape report, notes a 225% increase in monthly threat-related alerts, tracking over 5,000 actor groups and 18,000+ ransomware incidents. These are scales that indicate the ransomware industry has become a well-organized criminal infrastructure. Therefore, there is no period of “rest.”
Fewer Groups, Greater Damage
One of the key shifts in 2026 is the consolidation of the ransomware ecosystem. After a period of fragmentation during which the number of active ransomware groups grew, the trend has reversed.
According to the aforementioned Check Point research, the top 10 ransomware groups are responsible for 71% of all attacks in Q1 2026. Police actions have dismantled some groups, but not the individuals who worked for them. Their associates simply moved to competitors.
The most active operation remains Qilin, holding the top spot for the third consecutive quarter (338 affected organizations). It is followed by the relatively new group, The Gentlemen, which jumped from 40 affected organizations in Q4 2025 to 166 in Q1 2026. Their growth model is based on pre-compromised access points, allowing them to avoid spending time on initial exploitation, instead attacking immediately and targeting many systems at once.
LockBit, with 163 affected organizations, has re-entered the global top attackers. This comeback confirms that even direct police actions do not eliminate ransomware operations. They simply reorganize.
Consolidation reduces the number of active actors but increases the average impact of each individual attack. The remaining groups are more experienced, better funded, and operationally more mature.
Attackers are in your system longer than you thought
One of the most important findings from Mandiant’s M-Trends 2026 report concerns how attackers gain entry into systems before ransomware is ever activated.
Mandiant notes that prior compromise accounts for 30% of initial infection vectors, which is double the previous year (15%). Behind this are Initial Access Brokers (IABs), specialized actors whose sole role is to compromise environments and sell access.
This model divides the work into two phases:
- IAB phase: long-term compromise, access collection
- Ransomware phase: rapid, destructive execution, with doors already open
Before ransomware is launched, an attacker may have already been in your system for weeks or months. The 24/7 SOC monitoring provided by PULSEC is precisely designed to detect danger at the moment an attack can still be stopped.
Unmanaged Devices: A Blind Spot in Every Environment
The CrowdStrike Global Threat Report for 2026 highlights a fact that should be a focus for every security team: attackers systematically seek out devices without XDR coverage.
Cases have been documented where, during a three-hour attack, actors interacted with only one managed endpoint, while conducting the rest of the operation through unmonitored systems. In some cases, attackers created new virtual machines and operated entirely outside XDR telemetry. In one documented case, the launch point for ransomware distribution was an unpatched webcam on the corporate network.
Any network-connected device without an agent is a potential attack surface. The question: “What percentage of our hosts have agents covered?” is not just an IT operational question, but a security question.
Artificial Intelligence as an Aid to Attackers
AI has ceased to be a theoretical threat and is becoming an operational reality in the hands of attackers.
For example, the Palo Alto Networks Global Incident Response Report for 2026 cites concrete examples: from AI-generated logos embedded in HTML data leak sites, to documented cases where ransomware groups use AI tools to plan and execute complete campaigns.
In operational practice, this looks like this: phishing messages are no longer poorly written. They are grammatically impeccable, contextually relevant, and tailored to the targeted individuals, making them significantly harder to detect.
This has concrete consequences for awareness programs. Traditional education that teaches employees to recognize poorly written phishing emails is no longer sufficient. Therefore, regular updates to awareness training are recommended, taking into account AI-generated threats and adapting tests to the realistic attack landscape.
Identity as an Attack Vector
The aforementioned Palo Alto Networks report ranks identity among the key factors contributing to attacker success. Cloud IAM platforms are increasingly deployed without full configuration. Over-privileged accounts and service accounts operating with high privileges remain extremely widespread. Zero Trust principles are frequently mentioned but rarely fully implemented.
Infostealer malware on employees’ private devices is an increasingly common entry point for corporate compromises. If an employee uses the same browser for work and personal use, and an infostealer picks up a session cookie or password, the corporate account can be compromised without any direct attacker presence within the network.
What should security teams do?
Based on all the reports and data mentioned, the following recommendations can be made.
- Close the XDR coverage gap – A complete and up-to-date inventory of every device on the network is essential. If you cannot confidently answer what percentage of hosts have agents, that is a vulnerability.
- Take infostealers seriously – If an infostealer is found on an employee’s private device, all credentials ever used on that device must be rotated, including corporate ones.
- Apply least-privilege principles in cloud IAM environments.
- Actively hunt unmanaged hosts
- Regularly update awareness training – Programs must keep pace with actual attacks, including AI-generated ones.
Ransomware, a Threat That Will Grow
The common denominator of all reports is that ransomware is not a threat that is subsiding. On the contrary, it is professionalizing. Fewer groups, with more resources, better organization, and AI tools, operate with pre-prepared access, patiently waiting for the right moment to attack.
PULSEC, from its SOC, directly confirms that these are precisely the scenarios that cause the greatest damage. Incidents are detected quickly. The problem arises when an organization is unable to react promptly.
If you want to understand your organization’s exposure or check if your controls are up to the task, contact the PULSEC team. You can also explore specific services that address the described threats, including SOC monitoring and detection, Threat Hunting, and Incident Response.
