cyber.hendryadrian.com
Security Report · darkowl.com

DarkOwl Data Show Ransomware Leak-Site Activity Concentrated Among Top Groups

· Original article ↗

Summary

DarkOwl reports 195 ransomware leak-site postings in one week and says the top 10 groups accounted for 71.1% of listed victims in Q1 2026. These postings indicate claims, not independently confirmed compromises.

Key points

  • DarkOwl counted 195 victim disclosures from 46 active operators in one week.
  • INCRANSOM posted 11 listings in five days; THEGENTLEMEN posted five, and Audit Team posted four.
  • The article says monthly disclosures ranged from 646 to 808 in 2026 and projects roughly 8,660 victims for the year, up 24.9% from the prior 12 months.
  • The 10 most active groups accounted for 71.1% of listed victims in Q1 2026, compared with 57% two quarters earlier.
  • DarkOwl says TheGentlemen overtook Qilin in June, while Akira had 194 listings in Q1 and LockBit posted 43 in June.
  • Leak-site postings are group claims and do not by themselves confirm a compromise; the article argues continuous monitoring can show changes in posting activity sooner than quarterly reporting.

Article Details

Publisher
DarkOwl
Report Period
Published 2026-10-22; discusses postings from 2026-09-01 to 2026-09-09 and broader 2026 trends.
Scope
Ransomware leak-site disclosure cadence and operator concentration.
Sample Size
One weekly count covered 195 victim disclosures from 46 active operators.
Key Statistics
  • INCRANSOM posted 11 new victim listings in five days; the article says its postings spanned eight countries.
  • Monthly ransomware disclosures ranged from 646 to 808 victims during 2026.
  • The 10 most active groups accounted for 71.1% of Q1 2026 victims, up from 57% two quarters earlier.
  • The article said 2026 was pacing toward roughly 8,660 victims, a 24.9% increase over the prior 12-month period.
  • THEGENTLEMEN posted five victims during the same five-day window.
Recommendations
  • Continuously monitor ransomware leak sites rather than relying on periodic threat reporting.

Threat Actors

AkiraThe article reports that Akira had 194 victim disclosures in Q1 2026.AuditTeamThe article describes Audit Team as a smaller player that added four victim postings across South Korea, Germany, and Argentina. These are reported leak-site disclosures.INC RansomThe article reports that INCRANSOM posted 11 new victim listings in five days across eight countries. These are leak-site claims, not independent confirmation of each incident.LockBitThe article calls LockBit the all-time leader, with more than 500 confirmed attacks since 2019, and reports 43 victim postings in its strongest month of 2026, June.QilinThe article identifies Qilin as a ransomware group that held the number-one spot for five straight months, based on victim disclosures.The GentlemenThe article reports five victim postings during the same five-day window and later refers to the group as TheGentlemen, saying it overtook Qilin in June with 94 victims that month. These are reported leak-site disclosures.

Countries

ArgentinaA smaller player, Audit Team, added four more across South Korea, Germany, and Argentina.CanadaTHEGENTLEMEN posted 5 victims in the same window, a Canadian airline among them, at a steady rate of roughly one per day, spanning transportation, healthcare, and technology.GermanyA smaller player, Audit Team, added four more across South Korea, Germany, and Argentina.South KoreaA smaller player, Audit Team, added four more across South Korea, Germany, and Argentina.

Industries

HealthcareINCRANSOM posted 11 new victims in five days across eight countries, hitting manufacturing and industrial targets hardest, with healthcare and a US school district also on the list.IndustrialINCRANSOM posted 11 new victims in five days across eight countries, hitting manufacturing and industrial targets hardest, with healthcare and a US school district also on the list.ManufacturingINCRANSOM posted 11 new victims in five days across eight countries, hitting manufacturing and industrial targets hardest, with healthcare and a US school district also on the list.TechnologyTHEGENTLEMEN posted 5 victims in the same window, a Canadian airline among them, at a steady rate of roughly one per day, spanning transportation, healthcare, and technology.TransportationTHEGENTLEMEN posted 5 victims in the same window, a Canadian airline among them, at a steady rate of roughly one per day, spanning transportation, healthcare, and technology.

Related Articles