Ransomware in 2026 An Overview of Active and Emerging Threat Groups

Ransomware continues to evolve at a pace, with threat actors refining their tooling, targeting strategies, and extortion models.

For organisations, the challenge is no longer just preventing ransomware, but also understanding who the adversaries are, how they operate, and the risks they pose.

Now we're officially in 2026, we have compiled a high-level overview of ransomware gangs currently active or observed across global incident response and threat intelligence reporting.

Established and High-Impact Ransomware Gangs

Qilin

A ransomware-as-a-service (RaaS) operation known for double-extortion tactics, combining encryption with aggressive data-leak pressure.

Akira

Targets Windows and Linux environments, frequently exploiting VPNs and unmanaged credentials. Known for fast lateral movement.

LockBit

One of the most prolific ransomware groups historically. Highly automated, affiliate-driven, and relentlessly opportunistic despite repeated takedowns.

Clop

Specialises in mass exploitation of zero-day vulnerabilities, particularly in file-transfer platforms, focusing on data theft over encryption.

Rhysida

Often targets healthcare, education, and public sector organisations, using double extortion and public shaming tactics.

Medusa

A mature ransomware group known for targeted attacks, data exfiltration, and structured leak site operations.

Established and High-Impact Ransomware Gangs

Devman 2.0 / Devman 3.0

Indicative of active development cycles, suggesting either rebranding or technical evolution to evade detection.

Kill Security 3.0 Ransomware

Versioned naming implies continuous refinement of payloads and evasion techniques.

Dire Wolf v2

A re-engineered variant focusing on improved encryption routines and persistence mechanisms.

Obscura 2.0

A successor strain emphasising stealth, obfuscation, and reduced forensic visibility.

3AM v3

Associated with off-hours execution and rapid impact, often linked to broader criminal ecosystems.

Data-Leak and Extortion-Focused Operations

Ransom House

Primarily focuses on data theft and extortion without always deploying encryption.

World Leaks / Business Data Leaks / Leaknet

Leak-centric brands designed to amplify reputational damage and regulatory pressure.

Coinbase Cartel Ransomware

Uses branding and naming pressure tactics to imply large-scale financial exposure.

DATACARRY

Centred on data exfiltration, resale, and extortion rather than pure operational disruption.

Emerging, Smaller, or Less Publicised Groups

Dragon Force

A developing RaaS group with signs of expanding affiliate recruitment.

INC

Limited public reporting, but observed in targeted attacks against commercial organisations.

Play

Known for hands-on-keyboard attacks and manual privilege escalation.

Lynx

A newer group with focused targeting and selective victim disclosure.

Everest

Combines ransomware deployment with persistent data-leak operations.

Genesis

Often associated with credential abuse and identity-based intrusion paths.

Chaos Ransomware

Sometimes linked to destructive behaviour beyond pure financial extortion.

Niche, Opportunistic, or Short-Lived Operations

Safepay Ransomware

Focused on monetisation via rapid extortion cycles.

Sinobi

Limited activity but notable for reusing known malware components.

Handala

Ideologically motivated branding alongside financially driven attacks.

Anubis Ransomware

Multiple groups have used this name, complicating attribution.

The Gentlemen

Relies heavily on social pressure and public disclosure threats.

Space Bears

A newer entrant with unclear long-term sustainability.

Low-Visibility or Poorly Documented Threat Actors

These groups have limited public reporting but have appeared in threat feeds, leak sites, or underground forums:

• Blackshrantac
• Minteye
• NightSpire Ransomware
• TridentLocker
• Crypto24 Ransomware
• Benzona
• Nitrogen
• Securotrop
• Pear
• Kazu
• W.A. Ransomware
• Termite Ransomware
• Osiris Project
• Brotherhood
• Embargo
• Radar
• TENGU ransomware blog
• Sarcoma
• Cloak
• Abyss

Such actors often represent rebrands, splinter groups, or short-term campaigns, but still pose real risk, particularly to organisations with weak access controls or poor detection coverage.

What This Means For You

The ransomware ecosystem is crowded, volatile, and constantly shifting. New names appear weekly, while established gangs rebrand, fragment, or resurface under different identities.

Key takeaways:

• Ransomware is no longer just malware; it’s an operational business model
• Data theft and extortion are now as common as encryption
• Attribution matters less than preparedness, detection, and response capability
• Organisations without tested incident response plans remain the most exposed
  

Cybergen’s Perspective

At Cybergen, our incident response and threat intelligence work consistently shows that ransomware success is rarely driven by novel malware alone. The most damaging incidents stem from familiar failures: exposed credentials, excessive privileges, unmonitored access paths, and delayed detection. Threat actors exploit operational blind spots far more often than they defeat well-designed controls.

We also see a clear shift away from “spray and pray” ransomware towards targeted, intelligence-led intrusion. Many of the groups listed above operate with patience—mapping environments, identifying crown-jewel data, and timing execution to maximise disruption and leverage. Encryption is increasingly optional; data theft, regulatory exposure, and reputational damage now drive extortion value.

From our perspective, organisations that fare best against ransomware share common traits:

• Strong identity and access governance, particularly around privileged and third-party access
• Continuous monitoring capable of detecting abnormal behaviour before encryption occurs
• Practised, decision-ready incident response plans tested under realistic conditions
• Executive understanding that ransomware is a business risk, not just a technical one

Crucially, we observe that investment skewed too heavily toward preventative tooling—without equal focus on detection, response, and recovery—creates a false sense of security. Ransomware resilience is built through layered controls, clear ownership, and the ability to act decisively under pressure.

• Understanding who the threat actors are provides context.
• Understanding how they succeed provides defence.
• Being operationally ready is what ultimately limits impact.

For organisations seeking to move beyond reactive security and build true ransomware resilience, Cybergen delivers threat intelligence, detection, and response capabilities designed for real-world adversaries, not theoretical ones.

For more information about next-generation threat intelligence and ransomware readiness, get in touch with our team today.

Ready to strengthen your security posture? Contact us today for more information on protecting your business.