The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat

ReliaQuest's analysis of ransomware events from March–May 2026 found 1,368 victim claims across 99 countries and identified The Gentlemen as the most active ransomware operation (300 incidents), overtaking Qilin; the report attributes the rise to aggressive affiliate recruitment, a pre-packaged intrusion kit and AI-accelerated tooling, and offers defensive recommendations such as restricting RDP, enforcing Microsoft's vulnerable-driver block list, monitoring blockchain RPC egress, and hardening identity against vishing and AiTM attacks.