How the World’s Most Active Ransomware Operation Expanded in H1 2026

Cyble Research and Intelligence Labs (CRIL) identified Qilin as the most active ransomware group in H1 2026, attributing hundreds of attacks across North America (370), Europe/UK (158), Asia-Pacific (64), and South America (40). The report describes Qilin's RaaS-driven model—using affiliates, initial access brokers, and purchased access—to target high-impact sectors (manufacturing, healthcare, construction, professional services) and urges organizations to reduce exposed attack surfaces, strengthen identity controls, monitor suspicious access, and prepare for both data theft and encryption-based extortion.