Most Active Ransomware Groups in 2026: The Current Ranking

Ransomware groups announce their victims on leak sites, and trackers count those posts. In September 2026, 819 victims were posted by the groups tracked on ransomware.live. The ranking below uses that count (victims posted in September 2026, ransomware.live data, retrieved 14 October 2026). It measures how often a group claims victims, not how damaging each attack is, and the listings are the groups' own claims.

Victims posted: The Gentlemen (106), Qilin (74), Storm (37), Krybit (34), SafePay (32), AuditTeam (30), INC Ransom (28), Akira (28), Emperador (23), Silent Ransom Group (18), Panzer (18), MetaEncryptor (17), Dire Wolf (17), Vexy (16), Settra (15), Play (13), LockBit 5.0 (13), MedusaLocker (13), Rhysida (12), Brain Cipher (12), Everest (12), DragonForce (10).

The two leaders are far ahead: The Gentlemen and Qilin together account for more than a fifth of all posted victims. Several of the top twenty did not exist a year earlier, among them Storm, Emperador, Panzer and Settra, which shows how fast new brands appear. Over the whole third quarter of 2026, Comparitech counted 357 attacks claimed by Qilin and 342 by The Gentlemen.

23 of the September 2026 victims were in India. The Gentlemen, Krybit and Vexy posted four Indian victims each; AuditTeam, MedusaLocker, Emperador and Doommageddon two each. Vexy stands out because India is its most frequent target overall.

Almost every group in the list steals data before encrypting and publishes it if the victim does not pay. Most get in through VPN and remote-access accounts without multi-factor authentication, exposed Remote Desktop, unpatched edge devices or phishing calls to the help desk, and most go after the backups and the virtualisation hosts before they encrypt.

For recovery the family name matters less than how it encrypted the files. Many current encryptors, including those of Akira, LockBit and Spirals, encrypt large files only in part to work faster. Databases, virtual disks and backups therefore often keep most of their data, and that is recovered from the untouched parts, without the key.

Isolate the affected systems, but do not wipe, reinstall or "clean" anything yet, and do not run decryptors found online on your only copy. Keep the ransom note, a few encrypted files and, if you have them, unencrypted copies of the same files from before the attack: comparing the two shows exactly how the files were encrypted.

Then establish what is recoverable before deciding anything else: how much of each database, virtual disk and backup file was encrypted, and what the untouched parts still hold. Large files are often only partly encrypted, and that is where recovery without the key comes from.