Trends and threats from the past quarter, with insights to protect your organization.
Get the latest report from the GuidePoint Research & Intelligence Team (GRIT), which digs into findings from the second quarter of 2026. Dive into insights like these:
- Ransomware victim volume continues to increase. Q2 2026 recorded 2,279 reported ransomware victims, up 7% from Q1 2026 and 43% from Q2 2025. Weekly victim postings never fell below 150 during the quarter.
- Active threat groups reached a record high. GRIT observed 91 active ransomware groups in Q2 2026, the highest number across all observed periods, with operations spanning 108 countries.
- Top threat actors continue to dominate activity. The five most prolific groups collectively claimed more than 40% of all recorded attacks. Qilin remained the most active group, while The Gentlemen continued its rapid ascent into the second spot and DragonForce became the third most active group for the first time.
- AI is emerging as a threat actor productivity tool. Rather than enabling a wave of catastrophic AI-native attacks, GRIT observed threat actors using large language models to analyze exfiltrated data, personalize ransom negotiations and manufacture psychological pressure.
- Manufacturing remains the most impacted industry. Manufacturing accounted for nearly 15% of reported ransomware victims in Q2 2026. Manufacturing has maintained the top spot in GRIT’s analysis for several years.
Download the report now.
