Ransomware Surge: New Groups and AI Efficiency Drive Record Attacks

Black Kite identified 7,551 publicly disclosed victims between April 2025 and March 2026, marking a 24.9% increase over the previous year. While the first half of the cycle remained steady, the latter six months saw a sharp acceleration. Ferhat Dikbiyik, Chief Research & Intelligence Officer at Black Kite, noted that the landscape has fundamentally transformed as more groups enter the market while established operators continue to scale their reach.

The Anatomy of the Threat

More than 60 new ransomware groups emerged during the period, bringing the total number of active actors to 146 by June 2026. Despite this influx, market concentration remains high: the five largest groups account for 43.6% of all victims. The group Qilin alone claimed over 1,300 victims, nearly doubling the impact of its closest competitor.

AI is acting as an operational force multiplier rather than a primary catalyst. By lowering the cost of reconnaissance, scripts, and extortion messaging, AI has lowered the barrier to entry, allowing for more frequent and scalable attacks. Supply chain vulnerabilities remain a primary vector, with incidents frequently routed through trusted platforms like Salesforce and Oracle E-Business Suite. Post-incident analysis revealed persistent security failures, including a 175% increase in stealer log exposure and nearly half of all victims still carrying critical, unpatched vulnerabilities after the initial disclosure.