Black Kite released its 2026 Ransomware Report, Why Every Year Becomes the Worst Year on Record, analyzing the evolution of ransomware, the organizations most frequently targeted, and the externally visible risk indicators present before victims experienced publicly disclosed attacks.
Black Kite 2026 Ransomware report identified 7,551 publicly disclosed ransomware victims between April 1, 2025 and March 31, 2026, up 24.9% over the previous reporting period. But the annual figure hides a sharper trend: after tracking close to the prior year’s pace through the first half of the reporting period, ransomware victim counts accelerated 60% in the second half, closing with 861 victims in March 2026 – the highest monthly total in four years.
“Ransomware didn’t just grow this year; it evolved,” said Ferhat Dikbiyik, Chief Research & Intelligence Officer at Black Kite. “Previous years were often defined by a dominant ransomware group or a single major event. This year was different. We saw more groups enter the market, while established operators continued to scale and attack volume accelerated in the second half. Those shifts fundamentally changed the shape of the ransomware landscape.”
The Black Kite 2026 Ransomware report identified three key trends that defined this year’s ransomware landscape:
- Expansion at the bottom: More than 60 new groups entered during the reporting period, more than one per week, bringing the total to 146 active groups by June 2026.
- Concentration at the top: Despite the influx of new entrants, the five largest actors still controlled 43.6% of all victims. Qilin alone claimed 1,300+ victims, nearly twice as many as its nearest rival.
- Acceleration in the second half: While the first half tracked close to the prior year baseline, the second half outpaced it by 60%, closing with 861 victims in March 2026, the highest monthly total in four years of tracking.
Many of the year’s most consequential attacks moved through trusted vendor platforms, including SaaS integrations, enterprise applications, OAuth connections, and support workflows.
Black Kite’s before-and-after security posture comparison also found that exposure often remained after incidents were disclosed: stealer log exposure increased 175%, while 43.5% of victims still carried critical vulnerabilities in the latest assessment.
The report concludes that AI did not redefine ransomware during the reporting period. Instead, it lowered the cost of the work around the attack by making reconnaissance faster, phishing and vishing more convincing, victim research more scalable, scripts cleaner, translation easier, and extortion messaging cheaper to produce. While AI did not create this year’s acceleration, it lowered the barrier to entry enough that more actors could participate, suggesting ransomware operations could be scaling in anticipation of what comes next: AI-accelerated vulnerability discovery, faster exploitation cycles, and social engineering at scale.
Key findings from the report:
- 7,551 publicly disclosed ransomware victims identified, up 24.9% year over year.
- 60% acceleration in ransomware activity during the second half of the reporting period.
- 146 active groups by June 2026, including 61 new groups entering during the reporting period.
- Qilin claimed more than 1,300 victims, nearly two-times as many as its nearest rival.
- 43.5% of victims still carried critical patch vulnerabilities in the latest assessment, 30.8% carried KEV exposure, and 18.5% carried FocusTag® signals.
- 175% higher stealer log exposure in the before and after security posture comparison.
- Oracle E-Business Suite (EBS) and Salesforce ecosystem integrations defined several of the year’s most visible supply chain incidents.
The report recommends prioritizing vulnerabilities known to be exploited in the wild, extending third-party cyber risk management beyond questionnaire-based assessments, and hardening the human layer against vishing and help desk impersonation. The report also recommends strengthening identity verification, help desk escalation paths, employee reporting, vendor verification, and executive impersonation controls. To read the Black Kite 2026 Ransomware Report, visit the website here.
To learn how Black Kite’s Ransomware Susceptibility Index (RSI™) provides early warning of ransomware risk and helps organizations proactively identify susceptible third parties, visit the website here.
Related News:
Black Kite 2026 State of Financial Services Report Released
Black Kite 2026 Supply Chain Vulnerability Report Released
Methodology
The report covers the period from April 1, 2025 through March 31, 2026. The primary dataset includes 7,551 publicly disclosed ransomware victims identified through leak site monitoring and validated by the Black Kite Research Group™. Before and after security postures, current state exposure analysis, and post-period April-June 2026 activity are treated as separate scopes. Post-period data is used as supplementary context and excluded from primary year over year calculations.
