A ransomware crew that did not exist a year ago has become one of the most active extortion brands on the planet – and it got there by handing affiliates a 90% cut. The Gentlemen ransomware group first surfaced around mid-2025 before shifting into a formal ransomware-as-a-service model in September 2025, according to Microsoft’s May 28, 2026 threat report, which tracks the operators as Storm-2697 and catalogs the cluster’s payload as Ransom:Win64/Gentlemen.A; Check Point Research independently dated the group’s emergence to that same mid-2025 window, noting it advertised its service openly on underground hacking forums, while Palo Alto Networks’ Unit 42 traces the group’s 90% payout offer back to July 2025, when both its C-based and Go-based encryptor variants were already active, and clocked the leak site listing 580 victims across 77 countries through July 7, 2026. Comparitech’s August 18, 2026 analysis put the running tally at 675 claimed attacks since mid-2025. Along the way it tied the highest payout rate in the ransomware-as-a-service (RaaS) economy, got hacked itself, and had its alleged operator unmasked by name.
The story matters beyond one gang. The Gentlemen’s 90/10 affiliate split, versus the 80/20 that has anchored the market for years, is reshaping how criminal labor flows between RaaS programs, and it lands in a year when ransomware already features in nearly half of all data breaches. This analysis breaks down the numbers, the May 2026 backend leak that exposed the operation’s books, the attribution that put a Russian name to the brand, and what an arms race over affiliate economics means for defenders.
July 2026 Update
The core numbers below have moved since this analysis first published, with October 2026 reporting describing more than 800 claimed victims. Here’s what’s been verified since then:
- 483 victims across 66 countries, confirmed by Security Affairs and independently tracked by threat researcher Gregory Devans as of June 13, 2026 – with 380 of those victims logged in 2026 alone.
- The 90% affiliate cut has been in place since the group’s launch, which Decryption Digest’s analysis of a May 4, 2026 internal data leak pins to September 2025 – sharper than the “mid-2025” estimates that circulated earlier.
- Krebs on Security formally tied the operator aliases “hastalamuerte” and “Zeta88” to Alexander Andreevich Yapaev of Izhevsk, Russia in a June 10, 2026 report.
That held only briefly: Sophos tracked the leak site adding 169 fresh victims in July 2026 alone, pushing the cumulative total to 683, and Comparitech’s August 18, 2026 analysis separately recorded a close 675 attacks claimed by The Gentlemen on its leak site since mid-2025, and a Q2 2026 Check Point report published in August 2026 corroborated the earlier quarter-over-quarter jump from 40 victims in Q4 2025 to 166 in Q1 2026, extending the growth curve past the June snapshot above. Decryption Digest’s May leak analysis projects the exposure could accelerate a rebrand or infrastructure pivot – a projection, not a confirmed event, but one that lines up with the rebrand risk flagged in the predictions section below.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is The Gentlemen Ransomware?
The Gentlemen is a ransomware-as-a-service operation: a core team builds and maintains the encryptor, leak site, and negotiation infrastructure, then rents that toolkit to outside “affiliates” who carry out intrusions and split the ransom. The brand surfaced in September 2025, when Microsoft says the group formally launched its ransomware-as-a-service affiliate program, and, within roughly five months, had clawed into the top tier of the ecosystem – an April 2026 Hive Pro brief traced the early curve precisely, from roughly 30 victims in autumn 2025 to 48 by October 2025 and past 320 by April 2026, a trajectory KPMG corroborated independently, counting more than 30 claimed attacks across 17 countries by November 2025. By June 2026, PRODAFT’s tracking, reported by The Hacker News, put the victim count at 478, and a separate June 2026 Kaspersky report warned that the group had expanded its arsenal with newly identified malware and broadened its operations. Kaspersky’s Securelist team – researchers Fatih Şensoy and Maher Yamout – documented the group’s variants and tooling, placing it among the ten most prolific RaaS actors of the first half of 2026.
Check Point Research, whose tally is cited in Krebs on Security’s attribution report, ranks The Gentlemen as the second most active ransomware gang of 2026 by victim count; in its April 2026 reporting, Check Point said the group had publicly claimed more than 320 victims on its leak site, with 240 of those occurring in 2026 alone, while later snapshots pushed the total past 332 claims. Independent threat-intel firm Halcyon, in its threat assessment of The Gentlemen ransomware, counted nearly 300 organizations across 66 countries and 20 industry verticals – second-highest volume in the January–March window, trailing only Qilin and sitting ahead of Cl0p, RansomHub, and LockBit.
What separates The Gentlemen from the dozens of forgettable RaaS launches each year is not novel malware – it is a business model. The group bought its way to scale, and the receipts are now public.
The 90% Affiliate Cut That Rewired RaaS Economics
For most of the modern ransomware era, the standard arrangement gave affiliates 70% to 80% of a paid ransom, with the operator keeping the rest to cover infrastructure, malware development, and negotiation support. The Gentlemen broke that convention with a 90/10 split – 90% to the affiliate, 10% to the core team. Per multiple analyses, only RansomHub had previously matched that generosity. Every source that examined the operation – from Krebs to Kaspersky to Halcyon to Hackread’s reporting on the leak – flags the 90% cut as the single biggest growth driver.
The logic is brutal and simple. Skilled intrusion operators are mobile; they follow money. A 10-percentage-point bump on a seven-figure ransom is life-changing, so experienced affiliates migrate from incumbent programs and bring their access, tooling, and target lists with them. Halcyon’s assessment notes that most infections observed in 2026 were carried out by affiliates rather than the core team – the clearest possible sign that the recruitment strategy worked. The Gentlemen did not need a better encryptor; it needed a better paycheck.
That wedge is already rippling through the market. When a new entrant dangles 90%, incumbents face a choice: match it and compress their own margins, or watch their best operators leave. It is the criminal-economy version of a labor bidding war, and The Gentlemen lit the fuse.
By the Numbers: More Than 800 Claimed Victims
The headline figures tell a story of compounding velocity. The table below consolidates the most-cited metrics for The Gentlemen ransomware, each attributed to its source and snapshot date, because leak-site claims are self-reported and shift weekly.
| Metric | Figure | Source / snapshot |
|---|---|---|
| First observed | September 2025 | Decryption Digest (leak analysis) |
| Affiliate revenue split | 90% / 10% (vs. 80/20 standard) | Krebs, Securelist, Halcyon |
| Victims claimed, Q4 2025 | 40 | Forum-tracking (GBHackers) |
| Victims claimed, Q1 2026 | 166 (+315% QoQ) | Forum-tracking (GBHackers) |
| Attacks, January 2026 | 48 | Halcyon |
| Attacks, February 2026 | 91 | Halcyon |
| Total claims by June 13, 2026 | 483 victims / 66 countries | Security Affairs, leak-site tracking |
| 2026 ranking by victim count | #2 most active | Check Point (via Krebs) |
| Leaked C2 data count | Not listed | Not listed |
One number deserves emphasis. A reported compromise of a command-and-control server alleged more than 1,570 linked victims, well above the public leak-site tally. That figure cannot be reconciled with the other available counts, so it is best read as an unverified claim, not a confirmed total. The visible 483 (the figure Security Affairs reported on June 15, 2026) is a dated historical figure, and later reporting describes more than 800 claimed victims.
Scaling Faster Than LockBit: The Growth Trajectory
Speed is the part that alarms analysts most. Halcyon’s assessment frames it bluntly: The Gentlemen reached in roughly five months a scale that took Akira twelve months and Qilin eighteen months to achieve, with a trajectory comparable to the early rise of LockBit 3.0 – long the benchmark for how fast a RaaS brand can grow. Monthly attack volume nearly doubled from 48 in January to 91 in February 2026, and the group cleared 200 victim claims across the first quarter; Unit 42 puts the acceleration in starker terms, tallying a sixfold jump in claimed victims between the second half of 2025 and the first half of 2026, and naming June 2026 the group’s highest month to date, with 117 claimed victims – nearly a fourfold increase over the roughly 30 victims Palo Alto Networks counted in January 2026. ReliaQuest’s accounting of the second quarter puts The Gentlemen at 300 claimed victims, edging out Qilin’s 289 to make it, by ReliaQuest’s count, the quarter’s most active ransomware brand. Black Kite reportedly counted 105 Gentlemen victim listings in September 2026, the most of any group in its monthly dataset.
| Group | Time to ~300 victims / scale milestone | Affiliate cut | Note |
|---|---|---|---|
| The Gentlemen | ~5 months | 90% | September 2025 launch; #2 active in 2026 |
| Akira | ~12 months | ~70–80% (typical) | Halcyon comparison baseline |
| Qilin | ~18 months | ~80–85% (reported) | Q1 2026 volume leader |
| LockBit 3.0 | Comparable early curve | ~80% (historical) | Long-standing scaling benchmark |
| RansomHub | Rapid (2024–25) | Up to 90% | Only prior program to match 90/10 |
Context tightens the picture: The Gentlemen, which launched in September 2025, had logged 380 of its 483 claimed victims – roughly 79% – within 2026 alone by June 13, 2026, and Ransomtracker data cited by Ransomnews recorded 944 listings during 2026 through October 15, compared with 78 during all of 2025. The Gentlemen did not expand the pie; it ate someone else’s slice – and it did so during a year when overall ransomware volume is climbing, not flat.
When the Ransomware Gang Got Hacked: The May 2026 Backend Leak
In a twist that handed defenders a rare window, the gang itself was compromised. In May 2026, Check Point Research documented an internal breach that exposed The Gentlemen’s backend infrastructure: affiliate activity records, operational tools, victim-management systems, internal chat logs, and backend databases. The Gentlemen’s own administrator later acknowledged on underground forums that part of the internal backend database had been compromised and leaked, tracing the incident to a breach at a hosting provider the group relied on. It was the criminal equivalent of a competitor obtaining your CRM, your Slack, and your accounting ledger all at once.
The leaked chats read like an intrusion playbook. Affiliates discussed attack methods, credential abuse, EDR-killer tools, and access to enterprise systems, including conversations about Fortinet appliances, Cisco-related access, and NTLM relay techniques. The stolen dataset itself totaled 16.22 GB and was put up for sale on underground forums for $10,000 in Bitcoin, according to the same May 2026 leak reporting. The backend confirmed the headline economics, the 90% affiliate share, described by researchers as an unusually generous split. Check Point Research also surfaced one of the exposed negotiation threads: in a case closed in May 2026, the affiliate walked away with $190,000 after talking the victim down from its initial demand by $60,000. The breach also tied the operation to SystemBC, a long-running malware used for persistence and remote access.
Decryption Digest’s independent analysis of the leaked data – dated May 4, 2026 – confirmed the 90/10 affiliate split and pinned the group’s actual launch to September 2025, sharper than the “mid-2025” estimates earlier trackers had used.
Tellingly, exposure did not slow the brand: the operation kept posting victims at a high rate after the breach. Within days, on May 16, 2026, The Gentlemen became an official BreachForums partner, displaying the forum’s banner on its dark-web site – a move Palo Alto Networks separately confirmed was aimed squarely at recruiting fresh affiliates, and a defiant signal that, in the RaaS economy, reputation and recruitment matter more than operational secrecy. The dynamic echoes the brazen, parallel-extortion posture seen in the ShinyHunters Oracle breach wave that defined the first half of 2026.
Where the Operation Stands After the Breach
Acronis reported that The Gentlemen’s backend infrastructure was breached in May 2026, exposing internal communications, ransom negotiations, affiliate information, and tool-development discussions. Despite the breach, the operation continued posting victims at a high rate afterward. That supports continuity rather than retirement, although the sources do not establish whether the infrastructure or personnel changed.
Ransomnews reported 163 listings in August 2026, described as the group’s busiest month. In October 2026, reporting described the group as having more than 800 claimed victims and identified additional prominent listings. ATLAS lists The Gentlemen as an active ransomware group on October 25, 2026, ranks it seventh by listed victims, and attributes 11.7% of tracked victims to it. Because trackers count differently, the earlier 483 figure from June 2026 is best read as a dated historical figure, not a confirmed current total.
The business model has not shifted either. No documented change to the 90/10 split could be confirmed, and the reported arrangement is up to 90% of ransom revenue for affiliates, which describes affiliate economics rather than proof that every affiliate received exactly 90% on every operation. The Go-based locker still targets Windows, Linux, NAS and BSD systems. For defenders, the practical reading is that the May breach exposed the group’s internals without ending its activity. Detection work built from the leaked tooling and drivers should therefore stay in place, and exfiltration monitoring matters as much as encryption defenses, since observed data volumes included 13GB from a NAS, 3+TB from Docker/Nexus, and 100+GB from Confluence/JIRA.
Inside the Attack Chain: BYOVD, EDR Killers, and Hybrid Encryption
Technically, The Gentlemen is competent rather than exotic – which is precisely what makes it dangerous at scale. Per Securelist, the group runs multiple encryptor variants: a Go-based locker that emerged in September 2025 and is the most widely deployed, a Windows-only C-based variant still in development, and a cross-platform ESXi/Linux locker. A June 29, 2026 Kaspersky advisory confirmed the toolkit’s reach has expanded to Windows, Linux, NAS, BSD, and ESXi environments, letting affiliates hit everything from file servers to virtualization hosts to BSD-based appliances in a single intrusion, and The Hacker News’ June 2026 reporting on PRODAFT’s tracking described the malware as able to self-propagate across a network in worm-like fashion once inside.
Initial Access and Lateral Movement
Entry typically comes through internet-facing infrastructure – VPNs, firewalls, and remote-access gateways – plus stolen or weak credentials and, in some cases, purchased access from initial-access brokers. Once inside, affiliates use reconnaissance tools such as SharpADWS, NetScan, and Advanced IP Scanner, then move laterally via NETLOGON share distribution, a deploy_gpo.ps1 script, and PsExec. Krebs reports the crews can achieve network-wide encryption within hours of gaining a foothold.
Disabling Defenses
To blind endpoint protection, operators lean on the bring-your-own-vulnerable-driver (BYOVD) technique, loading signed-but-flawed kernel drivers to terminate security processes – a June 21, 2026 Shieldworkz briefing named the toolkit GentleKiller and documented it abusing vulnerable drivers to disable EDR across entire victim networks rather than single endpoints. The Go variant pairs Curve25519 key exchange with XChaCha20 encryption; the C variant uses AES-256-GCM with RSA. The defensive takeaway is that signature-based antivirus alone will not stop this chain. The indicators below, drawn from Securelist’s analysis, are a starting point for detection engineering.
# The Gentlemen – selected behavioral indicators (source: Kaspersky GReAT / Securelist)
# Hunt for these patterns; do not treat as a complete IOC set.
BYOVD drivers (loaded to kill EDR):
ProcessMonitorDriver.sys, wamsdk.sys, gamedriverx64.sys,
biontdrv.sys, inpoutx64.sys, wsftprm.sys, Havoc.sys
Defender-tampering registry key:
HKLMSOFTWAREPoliciesMicrosoftWindows Defender
"DisableAntiSpyware" = dword:00000001
Recon / lateral-movement tooling:
SharpADWS | NetScan | Advanced IP Scanner | PsExec
deploy_gpo.ps1 (GPO-based payload distribution via NETLOGON)
Persistence / C2:
SystemBC proxy malwareWho Runs The Gentlemen? The Krebs Attribution
The May leak did more than embarrass the gang – it cracked open its anonymity. Drawing on the exposed infrastructure and corroborating data from Check Point Software, Intel 471, PRODAFT, Constella Intelligence, and Epieos, Krebs on Security identified the alleged primary operator as Alexander Andreevich Yapaev, a 36-year-old from Izhevsk, Russia, who used online aliases including “Hastalamuerte,” “SantaMuerte,” and – per Krebs’s June 10, 2026 report – “Zeta88.” Investigators correlated forum-registration patterns, a reused phone number, and email handles to link the persona to the brand, though the attribution of zeta88, hastalamuerte and the Tox identity remains a reported assessment, not a publicly verified legal identity.
Halcyon estimates a core team of roughly 20 members with prior experience in the ransomware ecosystem – not amateurs, but veterans who understood that affiliate economics, not malware sophistication, would determine who won market share. Attribution rarely ends an operation by itself, but naming an operator raises the personal stakes considerably: it opens the door to indictments, sanctions, and the kind of pressure that has historically pushed Russian-speaking crews to rebrand rather than retire.
Who Gets Hit: Sectors and Geography
The Gentlemen’s victimology is unusual in one respect that should worry compliance teams outside the United States. Where most ransomware ecosystems skew heavily toward US targets, Halcyon found only about 7% of The Gentlemen’s victims were US-based – an anomaly that suggests the affiliates are deliberately spreading risk across jurisdictions, or simply following exposed, vulnerable infrastructure wherever it sits.
| Top targeted sectors | Top targeted countries |
|---|---|
| IT services | Thailand (≈27 victims) |
| Construction | United States |
| Manufacturing | France |
| Financial services | Brazil |
| Healthcare (growing) | China, Indonesia, Taiwan |
Manufacturing, IT services, and construction dominate the victim list, with healthcare a fast-growing third – a sign the group does not observe the informal “no hospitals” limits that some operators claim. Unit 42’s July 7, 2026 count puts manufacturing alone at 103 confirmed victims, the largest single vertical in its 580-victim, 77-country tally. Geographically, Thailand leads with roughly 27 victims, followed by the US, France, and Brazil, with additional clusters in China, Indonesia, and Taiwan. For multinationals, the lesson is that perimeter exposure anywhere is exposure everywhere.
Market Impact: What a 90/10 Split Does to the Ransomware Economy
The Gentlemen’s real legacy may be economic rather than technical. By proving that a 90% affiliate cut can buy top-three market share in under six months, the group has handed every aspiring RaaS operator a template – and pressured incumbents to respond. Forum tracking already shows the pressure: when a rival launched in May 2026, it advertised an 80–85% sliding-scale cut that grew more affiliate-friendly after the first job, an explicit attempt to compete on “aggressive affiliate economics.”
That dynamic has three consequences for defenders. First, more generous splits draw more skilled operators into ransomware overall, raising the baseline quality of intrusions. Second, thinner operator margins push core teams toward higher victim volume to stay profitable – meaning more attacks, not fewer. Third, it accelerates affiliate churn between brands, which fragments attribution and complicates law-enforcement targeting. The arms race is no longer just about exploits; it is about payroll.
The Bigger Picture: Ransomware Across 2026
The Gentlemen did not emerge in a vacuum. Check Point Research reported that ransomware attacks surged 48% in May 2026 even as overall cyberattack volume eased, with education and other under-resourced sectors bearing the brunt. The structural picture is corroborated by Verizon’s 2026 Data Breach Investigations Report, whose headline findings include system intrusions rising to roughly 61% of breaches, ransomware now featuring in about 48% of breaches, a majority of victims (around 69%) declining to pay, and a sharp rise in incidents involving third parties.
Those two data points – surging volume and falling payment rates – explain the affiliate-economics gold rush. If a smaller share of victims pay, operators need either bigger ransoms or far more victims to hit the same revenue. The Gentlemen chose volume, and the 90% cut is how it recruited the labor to generate it. The model is a rational, if grim, response to a market where defenders are slowly winning the “should we pay?” argument.
Industry Data and Expert Analysis
Because The Gentlemen is a live, evolving operation, the most reliable read comes from primary threat-intelligence reporting rather than secondhand summaries. The following sources anchor the figures in this analysis:
- The May 2026 breach of the group’s backend infrastructure exposed internal communications, ransom negotiations, affiliate information and tool-development discussions (reported via SC Media and Hackread). The group kept operating afterward.
- Kaspersky’s Securelist (researchers Fatih Şensoy and Maher Yamout) details the encryptor variants, BYOVD EDR-killers, and lateral-movement tooling.
- Halcyon‘s threat assessment supplies the scaling comparison (five months vs. Akira’s twelve and Qilin’s eighteen) and the 7%-US-victim anomaly.
- Krebs on Security published the attribution linking the operation to a named Russian operator.
- Verizon’s 2026 DBIR provides the market backdrop of rising intrusions and falling ransom payments.
Where individual figures differ between sources – for example, “nearly 300” versus “332-plus” versus “483” victims – the gap reflects different snapshot dates and counting methods (confirmed encryptions versus leak-site listings), not contradiction. The trajectory is consistent across all of them: up and to the right.
What Comes Next: 5 Predictions for The Gentlemen and RaaS
Forecasting cybercrime is inexact, but the incentives point in clear directions. Five predictions for the second half of 2026:
- An affiliate “wage war” intensifies. Expect more programs to advertise 85–90% splits and sign-on perks, compressing operator margins and pushing core teams toward higher attack volume to compensate.
- Law-enforcement pressure escalates. With an alleged operator now named, indictments, sanctions, or infrastructure takedowns become plausible – and, as with LockBit, may trigger a rebrand rather than a shutdown.
- The leak fuels detection wins. The exposed tooling, drivers, and TTPs will feed EDR signatures and threat-hunting rules, raising the cost of using the current Gentlemen toolkit.
- Targeting tilts further from the US. The 7%-US-victim pattern likely persists or deepens as affiliates route around the jurisdiction with the most aggressive FBI and Treasury response.
- BYOVD becomes a board-level issue. Repeated EDR-killer abuse accelerates adoption of Microsoft’s vulnerable-driver blocklist, kernel-level tamper protection, and driver allow-listing across enterprises.
How to Defend Against The Gentlemen Ransomware
Because The Gentlemen leans on exposed infrastructure and BYOVD rather than zero-days, the defensive playbook is well understood – the challenge is execution. Priorities, mapped to the group’s documented attack chain:
- Close the front door. Patch and harden internet-facing VPNs, firewalls, and remote-access gateways; enforce phishing-resistant MFA everywhere; retire orphaned accounts and exposed RDP.
- Block vulnerable drivers. Deploy Microsoft’s vulnerable-driver blocklist and enable EDR tamper protection so BYOVD attempts fail. A well-tuned SIEM such as the one in our free Wazuh SIEM tutorial can surface driver-load and Defender-tampering events.
- Throttle brute force and credential abuse. Rate-limit and lock down exposed services; our Fail2ban setup guide covers SSH and service hardening.
- Detect lateral movement. Alert on PsExec, anomalous GPO changes, NETLOGON script drops, and SystemBC beaconing – the chokepoints between foothold and full encryption.
- Assume encryption will be attempted. Keep immutable, offline backups; segment networks; and rehearse recovery so paying is never the only option. Layered endpoint defense – see our Bitdefender vs Norton vs McAfee comparison – remains a baseline.
Frequently Asked Questions
What is The Gentlemen ransomware?
The Gentlemen is a ransomware-as-a-service (RaaS) operation that emerged in mid-2025. A core team supplies the encryptor and infrastructure while outside affiliates conduct intrusions, splitting the ransom, with affiliates reportedly offered up to 90%. By 2026 it ranked among the most active ransomware brands worldwide.
Why is the 90% affiliate cut significant?
Most RaaS programs pay affiliates 70–80% of a ransom. The Gentlemen offers 90% – tying RansomHub for the highest rate on record. That premium draws experienced operators away from rival programs, which is the primary reason the group scaled so quickly.
How many victims has The Gentlemen claimed?
Counts vary by source and date: Halcyon logged nearly 300 organizations, Krebs cited 332-plus claims, PRODAFT’s tracking (via The Hacker News) put the figure at 478 by June 2026, and leak-site tracking showed 483 victims across 66 countries by June 13, 2026, with 380 of those in 2026 alone, a figure that October 2026 reporting has since overtaken, describing more than 800 claimed victims. A reported compromise of a command-and-control server alleged more than 1,570 linked victims, but that number cannot be reconciled with the other available counts.
Who is behind The Gentlemen ransomware?
Krebs on Security, using leaked data and corroboration from Check Point, Intel 471, PRODAFT, Constella, and Epieos, identified the alleged operator as Alexander Andreevich Yapaev, a 36-year-old from Izhevsk, Russia, who used aliases including “Hastalamuerte” and “Zeta88,” per Krebs’s June 10, 2026 report. Halcyon estimates a core team of roughly 20.
What systems does The Gentlemen ransomware target?
The group encrypts Windows, Linux, NAS, and ESXi environments using multiple variants – a widely deployed Go-based locker (Curve25519 + XChaCha20) and a developing C-based Windows variant (AES-256-GCM + RSA). It uses BYOVD techniques to disable endpoint protection.
How did The Gentlemen ransomware get hacked?
In May 2026, Check Point Research documented an internal breach that exposed the group’s backend databases, affiliate chats, and victim-management systems. The leak confirmed the 90% revenue share and revealed far more victims than the public leak site showed. The group nonetheless became a BreachForums partner days later.
Which industries and countries does it hit most?
IT services, construction, manufacturing, financial services, and healthcare top the sector list. Thailand leads by victim count, followed by the US, France, and Brazil. Notably, only about 7% of victims are US-based – unusual for a major ransomware operation.
Analysis and figures current as of October 25, 2026. Victim counts for active ransomware operations are self-reported on leak sites and change frequently; figures are attributed to their sources and snapshot dates throughout.
