Ransomware Attacks Increase 20% in H1 2026
Ransomware attacks up 20% year-over-year in H1 2026, says report
Related Entities(initial)
Threat Actors
Organizations
Full Report(when first published)
Executive Summary
A report from cybersecurity firm NordStellar indicates a persistent and growing ransomware threat landscape, with a 20% year-over-year increase in attacks during the first half of 2026. Researchers documented 5,257 ransomware incidents between January and June 2026. Although the second quarter experienced a minor 4% decrease compared to the first, the overall volume establishes a new and alarmingly high baseline. The report highlights intense activity from ransomware groups Qilin and The Gentlemen. A particularly concerning trend is a 74% quarterly increase in attacks targeting large enterprises, suggesting that major corporations are increasingly in the crosshairs of sophisticated ransomware operations.
Threat Overview
- Total Attacks (H1 2026): 5,257 incidents
- Year-over-Year Growth: 20% increase compared to H1 2025 (4,387 incidents)
- Quarterly Trend: Q2 2026 saw 2,581 incidents, a 4% decrease from Q1 2026, but established a high baseline.
- Most Active Groups (Q2 2026):
- Qilin: 299 attacks
- The Gentlemen: 284 attacks
- DragonForce: 147 attacks
While small and medium-sized businesses (SMBs) remain the primary targets, the report identifies a significant strategic shift towards more lucrative, large enterprise targets.
Technical Analysis
The high volume of attacks is driven by the Ransomware-as-a-Service (RaaS) model, which lowers the barrier to entry for less skilled affiliates. The TTPs used by these groups are well-established:
- Initial Access: The most common vectors continue to be phishing (
T1566 - Phishing), exploitation of public-facing applications (T1190 - Exploit Public-Facing Application), and the use of stolen credentials, particularly for remote access services like RDP and VPNs (T1078 - Valid Accounts). - Execution and Impact: Groups like Qilin are known for their sophisticated encryptors and double-extortion tactics. After gaining access, they move laterally to compromise as much of the network as possible before deploying the ransomware payload (
T1486 - Data Encrypted for Impact) and exfiltrating data to their leak sites.
Impact Assessment
- Increased Targeting of Large Enterprises: The 74% surge in attacks against companies with over $1 billion in revenue is a critical finding. These attacks are more complex but offer a much higher potential payout for threat actors. This trend suggests that top-tier ransomware groups are becoming more ambitious and capable.
- Sustained High Volume: The establishment of a baseline of over 2,500 attacks per quarter indicates that ransomware is a consistent, high-volume threat that is not diminishing, despite law enforcement actions against some groups.
- Economic Damage: The continued high rate of attacks translates to billions of dollars in economic damage globally, from ransom payments, recovery costs, and business interruption.
IOCs — Directly from Articles
This is a trend report and does not contain specific IOCs.
Cyber Observables — Hunting Hints
To detect activity from prevalent groups like Qilin, defenders can hunt for:
file_nameREADME.txtcommand_line_patternreg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender"process_nameadfind.exeservice_namePsExecDetection & Response
- Behavioral-Based Detection: Rely on EDR and NDR solutions that use behavioral analysis to detect ransomware activities, rather than just static signatures. This includes detecting credential dumping, lateral movement, and mass file encryption. This aligns with D3-PA: Process Analysis.
- Threat Intelligence Integration: Integrate threat intelligence feeds that provide IOCs and TTPs for active groups like Qilin and The Gentlemen into SIEM and SOAR platforms to automate detection and response.
- Deception Technology: Deploy decoys and honeypots within the network. An attacker interacting with a decoy can trigger a high-fidelity alert, providing early warning of a breach. This is an application of D3-DO: Decoy Object.
Mitigation
- Attack Surface Management: Continuously scan and remediate the external attack surface. This includes patching vulnerabilities, closing unnecessary ports, and securing remote access services. This is a key part of M1051 - Update Software.
- Identity Security: Given the rise in attacks on large enterprises, focus on securing privileged accounts and implementing robust identity and access management (IAM) controls.
- Immutable Backups: This remains the most critical defense. Ensure backups are offline or immutable and test the restoration process regularly.
- Network Segmentation: Segment the network to prevent ransomware from spreading from workstations to critical servers and from IT to OT environments. This is a direct application of D3-NI: Network Isolation.
Timeline of Events
Article Updates
July 20, 2026
New analysis reveals an intense rivalry between Qilin and The Gentlemen ransomware groups is fueling the previously reported surge in attacks, with U.S. SMBs being primary targets.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Patching vulnerabilities remains a key defense against the initial access methods used by many ransomware groups.
Mapped D3FEND Techniques:
Network Segmentation
Segmenting networks can contain a ransomware infection and prevent it from spreading to critical assets.
Mapped D3FEND Techniques:
Privileged Account Management
Protecting privileged accounts makes it harder for attackers to move laterally and deploy ransomware widely.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The NordStellar report's finding of a 74% surge in attacks on large enterprises highlights the need for robust internal controls like D3-NI (Network Isolation). Large, flat networks are a primary enabler of widespread ransomware impact. Enterprises must implement a microsegmentation strategy to contain breaches. This involves creating small, isolated network zones around critical applications and data stores. For example, a company's financial database should be in its own segment, with firewall rules that only allow connections from specific application servers on specific ports. An attacker who compromises a user workstation should have no network path to this critical server. This containment strategy limits the 'blast radius' of an attack, preventing a single compromised endpoint from leading to a full-blown enterprise-wide encryption event. It directly counters the lateral movement phase of a ransomware attack.
To gain early warning of an active intrusion by groups like Qilin or The Gentlemen, organizations should deploy D3-DO (Decoy Objects). This involves placing fake but attractive-looking files and credentials (honeypot data) in various locations on the network, such as user workstations and file shares. These could be files named passwords.xlsx or fake AWS access keys. Any interaction with these decoy objects—a file being opened, a credential being used—is a high-fidelity indicator of malicious activity, as no legitimate user should ever touch them. When an alert is triggered, the security team knows an attacker is in the reconnaissance or lateral movement phase and can immediately initiate incident response to evict the attacker before they can deploy ransomware. This proactive hunting technique provides an essential early warning system that is difficult for attackers to bypass.
Timeline of Events
Start of H1 2026, the period analyzed in the NordStellar report.
End of H1 2026, during which 5,257 ransomware incidents were recorded.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.