Ransomware rivals court affiliates as Nord counts 2,894 Q3 incidents

Ransomware brands may matter less than the crews who work under them. One rivalry in Nord Security's latest quarterly analysis suggests those crews follow the money. If that holds more widely, a takedown removes a name but not the people behind the break-ins.

What Nord Security counted

Nord logged 2,894 ransomware incidents from July to September 2026. Q2 had 2,664, so the quarter rose 8.6%. Q3 2025 stood at 1,933, which puts this quarter close to 50% higher.

Nord watches more than 200 leak sites and the dark web. The figures therefore cover victims that groups posted or claimed. They are not a count of every attack.

What Nord says is driving the rise

Nord points first to feuds between the biggest names in the trade. Its researcher Mantas Sabeckis adds a second reason. More groups are skipping file encryption and simply stealing data, which he calls faster and simpler. He says this shift is "likely a big part of why attack volumes keep climbing."

Affiliates changing gangs is a different matter. It moves share from one group to another. By itself it does not raise the total.

A pay dispute may explain the lead change

The Gentlemen led with 383 attacks, and Qilin followed with 363. Both sit far above the rest. Nord says every group below them claimed fewer than a third of their victims.

Nord ties the rivalry between the two to a quarrel over money. Based on underground forum activity, it believes The Gentlemen's founder once ran a top Qilin affiliate crew. He took an unpaid-cut dispute to a forum and lost. He then launched his own group and offered his old colleagues a 90% payout, against the usual 70% to 80%.

Nord's researcher likens the feud to a 1980s soap opera. The founder's history is Nord's inference from forum activity, not a confirmed fact.

Why takedowns may not end the problem

Nord says that a year earlier the criminal market was still recovering from the LockBit takedown and the closure of BlackCat and RansomHub. Those events left affiliates without a base. Nord says they have since regrouped under new leaders.

Infosecurity Magazine reports that Nord's researchers credit those earlier takedowns with helping to reduce activity during 2025. So takedowns did have an effect. The argument here is that they are limited, not useless.

Nord argues that affiliates chase the best payout, not the brand. This shows how limited a takedown can be. It is closer to closing one employer than ending an occupation. That is one case, so treat it as an illustration rather than a rule.

How the work is split

Under the affiliate model, a core group builds the ransomware and lends it out. Independent partners run the attacks and pay the core group a cut of each ransom. That helps explain why the groups' tools differ while their routes in overlap.

Nord says both leading groups get in through stolen credentials and exposed VPNs. A VPN is the remote-access gateway staff use to reach company systems. Qilin now uses AI for personalised phishing and for scripts that switch off backups. The Gentlemen rely on kits made in-house. These are designed to shut down security software and hand their partners a ready route into a victim's network.

Akira is a speed play, in Nord's telling. It uses exposed VPN logins and weak multi-factor setups to encrypt data within hours, a method Nord says it has aimed at small firms for over a year. INC Ransom concentrates instead. Nord points to a streak of law firms hit one after another.

Nord's expert draws a blunt lesson. Defenders can no longer prepare for one typical ransomware attack, because each style calls for its own defense.

Stealing without locking

Sabeckis says encryption is not disappearing. Some groups only lock files, and others combine locking with theft. Cl0p is Nord's example of a group that skips encryption entirely. It wagers that a threatened leak will make victims pay.

This matters for planning. Nord lists tested backups as a key defense, because they let a company restore systems without paying. That blunts the threat of locked files. It does not blunt the threat of publication. A company that has rehearsed only recovery has prepared for half the problem.

Who carries the risk

Nord says about 2 in 3 victims had 200 employees or fewer. Companies with 11 to 200 staff absorbed nearly half of all attacks. The largest firms fared differently: Nord counted 25 attacks on companies with $1 billion in revenue or more, down from 40.

Nord notes the burden this creates. Small businesses often lack a dedicated security team, yet face several attack styles.

Healthcare attacks rose 30% to 150, from 115 in Q2. IT rose about 10% to 210. Nord says hospitals cannot pause care, and one breached IT provider can spread harm to many downstream customers.

The US recorded 805 attacks, about 10 times Germany's 84. Of attacks Nord could place geographically, nearly half landed in North America and just over a quarter in Europe.

Questions to put to your team

Nord's researchers say the group names churn but the entry points do not. Credentials backed by poorly set up multi-factor authentication still work for attackers. Known flaws in widely deployed enterprise software remain among the most common ways in. These questions follow.

First, is multi-factor authentication enforced on every VPN and remote login, and how is weak setup checked? Second, who watches for leaked employee credentials? Third, how fast are known vulnerabilities in enterprise products patched?

Fourth, which IT suppliers could carry a breach to us, and what do their contracts say? Fifth, has the incident plan been rehearsed for a case where nothing is encrypted and the threat is publication?

Gang brands rise and fall with payout rates. The doors they walk through stay the same, and those doors belong to you.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Nord Security.