cyber.hendryadrian.com
Security Report · research.checkpoint.com

Ransomware Activity Remained High as Top Groups Regained Share in Q1 2026

· Original article ↗

Summary

Check Point Research tracked 2,122 ransomware victims posted across more than 70 leak sites in Q1 2026. The report describes renewed consolidation among leading groups and highlights access-driven activity, including The Gentlemen’s reported FortiGate stockpile.

Key points

  • The report tracked 2,122 new victims posted across more than 70 data leak sites, the second-highest Q1 total on record and 12.2% below Q4 2025.
  • The top 10 groups accounted for 71.1% of posted victims, while the number of active groups fell from 85 to 71.
  • Qilin led with 338 victims. The Gentlemen rose to 166, and LockBit posted 163; these figures reflect leak-site postings, not independently confirmed incidents.
  • Check Point Research attributes The Gentlemen’s growth in part to a reported stockpile of about 14,700 pre-exploited FortiGate devices and 969 validated brute-forced VPN credentials, primarily involving CVE-2024-55591.
  • The report links country and industry patterns to actor-specific access and exploited software, including The Gentlemen’s reported FortiGate access and Cl0p’s Oracle EBS campaign.
  • The report says LockBit’s U.S. victim share fell substantially, while noting that whether this reflects deliberate targeting choices or affiliate demographics remains uncertain.

Article Details

Publisher
research.checkpoint.com
Report Period
Q1 2026
Scope
Ransomware activity and victim postings across data leak sites, including operator, geographic, and industry patterns.
Sample Size
More than 70 active data leak sites and 2,122 new victim postings.
Key Statistics
  • 2,122 new victims were posted on data leak sites in Q1 2026, the second-highest Q1 total on record; these are reported postings, not independently confirmed incidents.
  • The top 10 ransomware groups accounted for 71.1% of all Q1 2026 posted victims.
  • Qilin posted 338 victims in Q1 2026, leading the groups tracked by the report.
  • The Gentlemen's victim postings rose from 40 in Q4 2025 to 166 in Q1 2026.
  • The report attributes to The Gentlemen a stockpile of approximately 14,700 pre-exploited FortiGate devices and 969 validated brute-forced FortiGate VPN credentials.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationLockBit 5.0 reportedly uses randomized 16-character file extensions and anti-analysis mechanisms to hinder detection.T1078 · Valid AccountsThe report describes 969 validated brute-forced FortiGate VPN credentials maintained for use in attacks.T1133 · External Remote ServicesThe report describes targeting FortiGate VPN access using validated credentials.T1190 · Exploit Public-Facing ApplicationThe report says The Gentlemen exploited internet-facing FortiGate devices, primarily via CVE-2024-55591, for initial access.T1486 · Data Encrypted for ImpactRansomware groups encrypted victim systems; LockBit 5.0 is described as having faster encryption routines.T1562.001 · Disable or Modify ToolsLockBit 5.0 is reported to use evasion mechanisms intended to bypass security detection.

CVE

CVE-2024-55591Fortinet · FortiOS; Fortinet · FortiProxy] Exploit Public-Facing Application – Used to gain initial access by exploiting FortiGate devices via CVE-2024-55591 (‘exploited primarily via CVE-2024-55591, a critical authentication bypass in FortiOS/FortiProxy’).CVE-2025-61882Oracle Corporation · Oracle Concurrent Processing[CVE ] Exploited vulnerability – CVE-2024-55591, CVE-2025-61882 and other vulnerability references tied to FortiGate and Oracle EBS campaigns

Threat Actors

AkiraA ransomware operation included among the groups that together claimed 41% of Q1 2026 victims with Qilin, The Gentlemen, and LockBit. The report also describes its targeting of consumer goods and industrial manufacturing.AnubisA ransomware actor that the report says targeted healthcare and critical infrastructure in its analysis of Q1 2026 victims.Cl0pA ransomware group whose Cleo mass-exploitation campaign contributed approximately 390 victims in Q1 2025; the report also links its Q1 2026 victim distribution to an Oracle EBS campaign exploiting CVE-2025-61882.Coinbase CartelA reported ransomware operation initially described as a DragonForce sub-brand; the article says Bitdefender independently linked it to ShinyHunters.DevManA ransomware operation reported to have split from DragonForce and to have posted 25 victims in Q1 2026.DragonForceA ransomware operation that posted 101 victims in Q1 2026 and publicly brands itself as a cartel or umbrella organization, according to the report.EverestA ransomware actor included in the report’s analysis of Q1 2026 victims in Japan.GenesisA ransomware actor included in the report’s Q1 2026 geographic analysis, which describes a near-exclusive focus on U.S. victims.hastalamuerteA threat actor identified by the report as an experienced Qilin affiliate who left the program after a dispute over an unpaid commission and founded The Gentlemen.LockBitA ransomware operation that posted 163 victims in Q1 2026, according to the report. LockBit 5.0 is described as its relaunched version.NefedovIdentified in a figure caption as Devman’s operator in connection with an Interpol Red Notice.nightspireA closed-group ransomware operation that posted 82 victims in Q1 2026 and is described as having OneDrive cloud-encryption capability.ObscuraA ransomware operation whose encryption bug reportedly renders files over 1 GB permanently unrecoverable, regardless of payment.PlayA ransomware operation that posted 121 victims in Q1 2026; the report says 85.1% of its victims were in the United States.QilinA ransomware operation that the report says led the Q1 2026 data leak site postings with 338 victims.SafepayA centralized, non-RaaS ransomware operation whose data leak site was reportedly inactive from mid-March through early April 2026.ShinyHuntersThe report says Bitdefender independently linked Coinbase Cartel to the ShinyHunters operation.sinobiA ransomware operation reported to have posted 80 victims in Q1 2026, with activity declining sharply in March.TenguA ransomware actor included in the report’s analysis of Q1 2026 geographic targeting patterns.The GentlemenA ransomware operation that the report says grew to 166 Q1 2026 victim postings. It attributes the group’s founding to Hastalamuerte and links its access stockpile to pre-exploited FortiGate devices and brute-forced VPN credentials.TrampIdentified in the report as Devman’s ransomware operator and a former Conti and Black Basta affiliate; the report says Tramp was added to Interpol’s wanted list in January 2026.

Products

ESXi[T1611 ] Escape to Host – Relevant to ESXi-targeting capability in LockBit 5.0 (‘multi-platform support (Windows, Linux, ESXi)’).Fortinet FortiGatereport highlights major shifts in geography, industry targeting, and access-driven campaigns tied to FortiGate, Oracle EBS, and other exploited systems.FortiOSdevices via CVE-2024-55591 (‘exploited primarily via CVE-2024-55591, a critical authentication bypass in FortiOS/FortiProxy’).FortiProxyCVE-2024-55591 (‘exploited primarily via CVE-2024-55591, a critical authentication bypass in FortiOS/FortiProxy’).Linux[T1611 ] Escape to Host – Relevant to ESXi-targeting capability in LockBit 5.0 (‘multi-platform support (Windows, Linux, ESXi)’).Microsoft OneDrive[T1133 ] External Remote Services – Used by targeting FortiGate VPN access and cloud services such as OneDrive for encryption (‘validated brute-forced FortiGate VPN credentials’ and ‘OneDrive cloud encryptionMicrosoft Windows[T1611 ] Escape to Host – Relevant to ESXi-targeting capability in LockBit 5.0 (‘multi-platform support (Windows, Linux, ESXi)’).Oracle E-Business Suitemajor shifts in geography, industry targeting, and access-driven campaigns tied to FortiGate, Oracle EBS, and other exploited systems.

Countries

AustraliaCl0p’s geographic anomalies (18.1% Canada and 8.7% Australia).BrazilThailand (10.8%), Brazil (6.0%), and India (4.2%) all feature prominently on their victim list.CanadaCl0p’s geographic anomalies (18.1% Canada and 8.7% Australia).IndiaThailand (10.8%), Brazil (6.0%), and India (4.2%) all feature prominently on their victim list.ItalyIn Q1 2026, US victims represented just 21.2% of LockBit’s total, with Italy (8.6%), Brazil (8.6%), and Turkey (5.1%) picking up the slack.JapanJapan (21 victims): The Gentlemen (6 victims) + Everest (4 victims) + Nightspire (3 victims).TaiwanTaiwan also rose sharply (from 8 victims to 26), while South Korea dropped out entirely.ThailandThailand (10.8%), Brazil (6.0%), and India (4.2%) all feature prominently on their victim list.TurkeyIn Q1 2026, US victims represented just 21.2% of LockBit’s total, with Italy (8.6%), Brazil (8.6%), and Turkey (5.1%) picking up the slack.United StatesGeographic and industry patterns varied sharply by actor, with some groups focusing heavily on the U.S.

Industries

business servicesCl0p’s 53.5% Business Services concentration (+18.6 percentage points above baseline) does not reflect a preference for professional services firms.ConstructionSinobi (76.2% US) explicitly targets US mid-market manufacturing and construction.consumer goodsAkira’s targeting of Consumer Goods (23.9%, +9.8 percentage points above baseline) and Industrial Manufacturing (17.8%, +6.7 percentage points above baseline), a combined 41.7% versus the 25.1% baseline, is consistentCritical infrastructureAnubis stands apart from all other top-20 actors in its willingness to target healthcare (13.0%, +8.3 percentage points above baseline) and critical infrastructure (8.7%, +7.7 percentage points above baseline).HealthcareGenesis (93.1% US) whose near-exclusive US focus (27 of 29 confirmed victims) and emphasis on the Healthcare sector (20.7%) is striking for an emerging actor with no documented affiliate program.Industrial ManufacturingAkira’s targeting of Consumer Goods (23.9%, +9.8 percentage points above baseline) and Industrial Manufacturing (17.8%, +6.7 percentage points above baseline), a combined 41.7% versus the 25.1% baseline, is consistent

Related Articles