Top Ransomware Crews Dominating the 2026 Attack Landscape

As ransomware continues to evolve and wreak havoc globally, a recent analysis from DARKFEED shines a spotlight on the threat actors currently at the forefront of this pervasive cybercrime. According to DARKFEED’s tracking, the Qilin ransomware group has emerged as the most prolific, with a staggering 401 reported attacks. Hot on their heels are The Gentleman, with 235 attacks, and Akira, responsible for 195 incidents. These figures paint a grim picture of the current ransomware threat environment and highlight the persistent challenges organizations face in defending against these sophisticated operations.

The data further reveals a crowded field of malicious actors, with INC (153 attacks), DragonForce (128), Play (126), and CLOP (126) also making significant contributions to the global attack volume. Even historically prominent groups like LockBit, though appearing lower on this specific list with 109 attacks, remain a considerable threat. NightSpire and Sinobi round out the top ten, underscoring the diverse and active nature of ransomware syndicates operating today.