Frontline Insights - Ransomware Q3 2026 Report

Frontline Insights - Ransomware Q3 2026 Report Excerpt:

Our latest Frontline Insights | Ransomware Q3 2026 Report, produced by the NSB Cyber Intelligence Centre, recorded 2,755 global ransomware claims in Q3, 78.0% above the same quarter of 2025 and 27.3% above Q2. This is the highest quarterly total in our series. In Q2, the annual increase and the quarterly decline pointed in different directions; this quarter, both measures indicate continued growth.

The distribution of activity also shifted. THE GENTLEMEN displaced Qilin as the most active group, and together the two accounted for 26.6% of all claims, while 36 groups entered our tracking for the first time. Much of the quarter’s movement was campaign-driven. Clop posted almost all of its 68 claims in August and September, consistent with its established pattern of exploiting a single flaw in widely deployed enterprise software, and Dire Wolf increased from 4 claims in Q2 to 62. Among sectors, IT Services and IT Consulting more than doubled, followed by Financial Services and Real Estate. This report also introduces a dedicated section on the initial access broker market, in which listings rose 55.5% on Q2, although they remain well below the level recorded a year earlier.

Oceania did not follow the global trend. The region recorded 53 claims, 3.6% fewer than in Q2, of which 48 were against Australian organisations. Manufacturing and Industrial Products, Consumer and Retail, and Professional Services were the most frequently claimed sectors, and 24 different groups claimed at least one victim in the region. Several of these listings, including two naming New South Wales public bodies, have not been verified, and all figures in the report should be read as threat actor claims rather than confirmed breaches. The full report examines the implications for Australian organisations, with particular attention to remote access exposure, the patching of internet-facing enterprise applications, and preparedness for data-theft extortion.

This report will cover:

• Overview

• Ransomware Operations Q3 2026

• Targeted Sectors

  • Manufacturing & Industrial Products

  • Professional Services

  • Engineering & Construction

  • Healthcare & Life Sciences

  • Consumer & Retail

  • Technology

  • Financial Services

  • Legal Services

  • Government & Public Sector

  • Transport & Logistics

  • Education

  • IT Services and IT Consulting

  • Real Estate

• Initial Access Broker Market

• Closing Remark

Authors:

• Evan Vougdis - Head of Cyber Intelligence and Response of NSB Cyber

• Dimitri Dubuc - Cyber Associate of NSB Cyber