Ransomware and Cyber Extortion in Q2 2026

Q2 2026 ransomware intelligence: The report documents 2,252 ransomware victim posts across 99 countries with The Gentlemen becoming the most-active group while previously dominant groups declined; it highlights Deadlock as a technically notable newcomer that uses a Polygon smart-contract for rotating C2 and a Bring-Your-Own-Vulnerable-Driver (BYOVD) chain exploiting CVE-2024-51324 to terminate EDR at the kernel before encryption, and provides sectoral/country trends and prioritized mitigation actions (block vulnerable drivers, monitor blockchain RPC egress, harden identity, restrict RDP).