Global Ransomware Attacks Rise 23% in Q3
Global ransomware activity increased 23% in the third quarter of 2026, with organizations in North America and Europe accounting for the largest proportion of attacks, according to cybersecurity firm NCC Group.
The company's Cyber Threat Intelligence Report Review of Q3 2026 recorded 2,865 ransomware victim claims, up from 2,325 in the previous quarter.
Despite the quarterly increase, attacks declined 26% month over month in September to 821. North America recorded the most attacks that month with 390, followed by Europe with 211.
The industrial sector accounted for 29% of quarterly attacks, while Qilin remained the most active ransomware group for the sixth consecutive quarter, recording 365 victims. The Gentlemen followed with 356, and INC Ransom ranked third with 109.
Critical Infrastructure Faces Growing Threats
The report highlighted a July cyber attack against a small UK power generation facility that forced operations to stop for approximately four days.
Although the incident did not affect the national electricity grid, it demonstrated how cyber attacks can disrupt physical infrastructure.
The security researchers said the incident was consistent with techniques previously associated with Iranian-affiliated campaigns, including attacks against internet-exposed industrial controllers.
However, the UK government has not formally attributed the attack, and the techniques used remain unconfirmed.
The report also identified growing security challenges as organizations connect traditional IT networks with operational technology (OT) systems for remote maintenance and centralized management.
The firm recommended network segmentation, stronger privileged-access controls, and continuous monitoring of OT environments.
Ransomware Groups Target Internet-Facing Systems
The research found that more than 40 vulnerabilities affecting enterprise applications, VPN appliances, e-mail gateways, and management platforms were added to CISA's Known Exploited Vulnerabilities Catalog during the quarter.
The report examined Gunra, a ransomware-as-a-service operation that has targeted 53 victims across multiple industries as of Q3.
According to the cybersecurity company, Gunra exploited vulnerabilities CVE-2024-55591 and CVE-2025-24472 in internet-facing Fortinet devices to gain access to corporate networks.
The group also used stolen credentials, session hijacking, and administrative tools to move between systems before deploying ransomware.
Other emerging ransomware groups included Deadlock and Storm, with the latter claiming 78 victims by the end of September.
Researchers also observed initial access brokers advertising compromised VPN, Remote Desktop Protocol, and SSH access, alongside access to cloud identities, source code repositories, and security management platforms.
AI-Enabled Threats Raise Additional Concerns
The quarterly review also highlighted BraZetsu, an AI-enhanced Windows malware framework that evolved into a specialized initial access toolkit.
According to the report, BraZetsu uses AI models to automate victim profiling, analyze compromised environments, and identify valuable corporate systems.
The framework searches for enterprise software, financial data, digital certificates, and cloud credentials, helping operators identify compromised access that can be sold to other cyber criminals.
The cybersecurity firm also identified risks involving legitimate AI agents, including prompt injection, excessive permissions, and unintended access to external systems.
The report cited incidents involving U.S. and Australian government systems as examples of agents accessing resources beyond their intended scope.
Researchers warned that these incidents do not necessarily involve malicious intent but can create consequences resembling conventional cyber intrusions.
The full report is available at the NCC Group site.