--- title: The State of Ransomware Q2 2026 | daily.dev description: The Q2 2026 ransomware landscape shows growing decentralization: the top 10 groups' share of victims dropped from 71% to 57.6% while active groups rose from 71... canonical: https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The State of Ransomware Q2 2026 | daily.dev og:description: The Q2 2026 ransomware landscape shows growing decentralization: the top 10 groups' share of victims dropped from 71% to 57.6% while active groups rose from 71... og:url: https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p og:image: https://api.daily.dev/og/posts/cWgXqMj2P.png og:image:alt: The State of Ransomware Q2 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The State of Ransomware Q2 2026 **[Check Point Research](https://daily.dev/sources/cpresearch)** · 3 min read · 0 upvotes · 0 comments ## Summary The Q2 2026 ransomware landscape shows growing decentralization: the top 10 groups' share of victims dropped from 71% to 57.6% while active groups rose from 71 to 93. Qilin remained the top operator with 279 victims but fell 17%, while The Gentlemen surged 62% to 269 victims, briefly overtaking Qilin in June. A leak of The Gentlemen's internal chat logs revealed a core team of about nine operators who used AI coding assistants to build their ransomware management panel in roughly three days. Ransom payment rates hit a multi-year low near 23%, down from 85% in 2019, though on-chain payments still topped $820 million in 2025. Law enforcement targeted shared infrastructure like laundering platforms, malware signing services, and infostealer networks rather than individual groups. US victim share fell from 50% to 42%, and vulnerabilities are now weaponized within hours to days of disclosure, with AI cited as an accelerant. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did a ransomware gang use AI coding assistants to build their tools? An internal leak revealed that the ransomware group The Gentlemen used AI coding assistants to build their ransomware management panel in about three days. Chat logs and platform data exposed a core team of roughly nine operators supported by a broader affiliate base, providing rare first-party evidence of AI accelerating malicious tooling development. _Security teams tracking how AI lowers the barrier for malicious tooling can follow developments like this on daily.dev._ ### What percentage of ransomware victims actually pay the ransom now? Ransom payment rates fell to a multi-year low near 23%, continuing a six-year decline from 85% in 2019. Despite the falling rate, on-chain ransomware payments still exceeded $820 million in 2025, with average payments rising even as the median falls, meaning large enterprises keep paying heavily while the mid-market increasingly holds firm. _Anyone benchmarking ransomware risk and payment trends can keep tabs on shifts like this via daily.dev._ ### Which ransomware group was the most active in Q2 2026? Qilin remained the most prolific ransomware operator for a fourth straight quarter with 279 victims, though its count fell 17% quarter over quarter. The Gentlemen surged 62% to 269 victims and actually outpaced Qilin during the month of June, making the two groups close rivals for the top spot. _Teams monitoring which ransomware operators pose the biggest threat can track shifts like this on daily.dev._ ## Similar posts on daily.dev - [Ransomware Attacks Surge 50% In 2025, Qilin Leads Wave](https://daily.dev/posts/ransomware-attacks-surge-50-in-2025-qilin-leads-wave-ukr8h9jqa) · Cyble · 1 upvotes · 0 comments - [Ransomware Groups Surge In Q4 2025 – Cyble Insights](https://daily.dev/posts/ransomware-groups-surge-in-q4-2025-cyble-insights-bekvw1yk1) · Cyble · 1 upvotes · 0 comments - [Reviewing the trends in ransomware attacks in 2026](https://daily.dev/posts/reviewing-the-trends-in-ransomware-attacks-in-2026-zduvsdh2i) · Securelist · 0 upvotes · 0 comments - [Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report](https://daily.dev/posts/ransomware-leverage-is-growing-by-the-terabyte-takeaways-from-threatlabz-2026-ransomware-report-12cyw5vjm) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#ai-coding](https://daily.dev/tags/ai-coding) [View this post on daily.dev](https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The State of Ransomware Q2 2026","url":"https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p"},"datePublished":"2026-08-13T12:55:30.989Z","dateModified":"2026-08-13T12:55:56.726Z","description":"The Q2 2026 ransomware landscape shows growing decentralization: the top 10 groups' share of victims dropped from 71% to 57.6% while active groups rose from 71...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,ai-coding","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"The State of Ransomware Q2 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p#faq","mainEntity":[{"@type":"Question","name":"How did a ransomware gang use AI coding assistants to build their tools?","acceptedAnswer":{"@type":"Answer","text":"An internal leak revealed that the ransomware group The Gentlemen used AI coding assistants to build their ransomware management panel in about three days. Chat logs and platform data exposed a core team of roughly nine operators supported by a broader affiliate base, providing rare first-party evidence of AI accelerating malicious tooling development. Security teams tracking how AI lowers the barrier for malicious tooling can follow developments like this on daily.dev."}},{"@type":"Question","name":"What percentage of ransomware victims actually pay the ransom now?","acceptedAnswer":{"@type":"Answer","text":"Ransom payment rates fell to a multi-year low near 23%, continuing a six-year decline from 85% in 2019. Despite the falling rate, on-chain ransomware payments still exceeded $820 million in 2025, with average payments rising even as the median falls, meaning large enterprises keep paying heavily while the mid-market increasingly holds firm. Anyone benchmarking ransomware risk and payment trends can keep tabs on shifts like this via daily.dev."}},{"@type":"Question","name":"Which ransomware group was the most active in Q2 2026?","acceptedAnswer":{"@type":"Answer","text":"Qilin remained the most prolific ransomware operator for a fourth straight quarter with 279 victims, though its count fell 17% quarter over quarter. The Gentlemen surged 62% to 269 victims and actually outpaced Qilin during the month of June, making the two groups close rivals for the top spot. Teams monitoring which ransomware operators pose the biggest threat can track shifts like this on daily.dev."}}]} ```