Ransomware in 2026: Same Business, New Rules

A Group-IB intelligence briefing outlining how the ransomware landscape shifted in 2025–Q1 2026: affiliate independence and consolidation, the rise of extortion-only and supply-chain rooted campaigns, AI-assisted malware and data processing, and profiles of eight high-impact ransomware operations (Qilin, Akira, Cl0p, SafePay, DragonForce, The Gentlemen, INC Ransom, Vect) that actively exploited known CVEs, abused legitimate tools for exfiltration, and published thousands of leak-site incidents; the report concludes with practical defensive priorities (monitor underground markets, treat vendors as attack surface, detect pre-encryption activity, urgent patching, and incident readiness).