# Ransomware Surge in Q3 2026: The Gentlemen Overtakes Qilin as Rival Gangs Compete for Market Share

> 2,894 ransomware attacks were recorded July-September 2026, up 50% year over year and 8.6% over April-June 2026. The Gentlemen (383 attacks) edged past Qilin (363); its founder reportedly previously ran one of Qilin's top affiliate crews and now offers affiliates a 90% payout.

- **Published:** 2026-10-24T04:19:58Z
- **Last reviewed:** 2026-10-24T04:19:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4340
- **ID:** TL-2026-4340
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182, CVE-2025-7771

## Description

Nord Security data reported by Infosecurity Magazine on 2026-10-21 counted 2,894 ransomware attacks between July and September 2026, a 50% increase over the same period of 2025 and an 8.6% increase over April-June 2026. The Gentlemen was the most prolific group with 383 attacks, ahead of Qilin (363) and Inc Ransom (110). Krybit, Akira, Deadlock and Clop Leaks each recorded roughly 100 attacks. The report notes that groups have traded places as the most common perpetrator throughout 2026. The reported initial access methods are compromised passwords, lack of multi-factor authentication and unpatched vulnerabilities, with a growing share of operations relying on data theft and extortion without encryption ("stealing data is faster and simpler, so one group can hit many victims at once with far less effort").

The Gentlemen is a ransomware-as-a-service operation first seen in July 2025 (Palo Alto Unit 42). Its operators likely operated earlier as the "ArmCorp" affiliate of the Qilin RaaS, and the Infosecurity report says the founder was a top Qilin affiliate who left after a public dispute over an unpaid cut. The group advertises a 90% affiliate payout against the typical 70-80%. Unit 42 counted 580 claimed victims in 77 countries through 2026-07-07, with manufacturing the largest sector (103 victims); Check Point Research, which gained access to a live C2 server, reported 1,570+ likely corporate victims, a larger number than publicly claimed, with the USA, UK and Germany the top countries. In May 2026 an operational-security failure exposed the group's internal Rocket.Chat platform (23 chat rooms, thousands of messages, hundreds of screenshots).

Observed tradecraft (Unit 42, Check Point, ReliaQuest): initial access through edge devices (firewalls, VPNs, remote access gateways), RDP/remote access, brute force, leaked or stolen credentials and initial access brokers; rapid movement to the domain controller; Advanced IP Scanner for discovery; SMB and SSH (ESXi) lateral movement; domain-wide encryption pushed via Group Policy within hours; lockers written in C and Go for Windows, Linux and ESXi; EDR tampering with the GentleKiller framework and vulnerable driver loading (ThrottleStop.sys, CVE-2025-7771); SystemBC and a custom Go backdoor for command and control; wevtutil log clearing; vssadmin/wmic shadow copy deletion; scheduled tasks with names containing 'gentlemen'. Unit 42 associates the group with CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182 and CVE-2025-7771. The source articles provide no file hashes, IP addresses or domains, so none are recorded.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1110 Brute Force
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1046 Network Service Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.004 Remote Services: SSH
- T1090 Proxy
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy](https://www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/)
- [The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat](https://www.infosecurity-magazine.com/news/the-gentlemen-most-prolific/)
- [The Gentlemen Ransomware (Unit 42)](https://unit42.paloaltonetworks.com/the-gentlemen-ransomware.md)
- [The Gentlemen: A New Ransomware Threat Climbing the Charts Fast (Check Point Research)](https://blog.checkpoint.com/research/the-gentlemen-a-new-ransomware-threat-climbing-the-charts-fast/)
- ['The Gentlemen' Rapidly Rises to Ransomware Prominence (Dark Reading)](https://darkreading.com/threat-intelligence/gentlemen-rapidly-rise-ransomware)
- [Tables Turn on 'The Gentlemen' RaaS Gang With Data Leak (Dark Reading)](https://www.darkreading.com/threat-intelligence/gentlemen-raas-gang-data-leak)
- [The Gentlemen ransomware: Inside one of the fastest-growing extortion operations (Barracuda)](https://blog.barracuda.com/2026/08/17/the-gentlemen-ransomware--inside-one-of-the-fastest-growing-rans)
- [Who Are The Gentlemen? (Fortra)](https://www.fortra.com/blog/gentlemen-ransomware-what-you-need-know)
- [Threat Actor Profile: The Gentlemen (Gurucul)](https://gurucul.com/blog/threat-actor-profile-the-gentlemen/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4340