By 
Check Point Software Technologies Ltd. has unveiled its Q2 2026 State of Ransomware Report, exposing a strategic realignment in global cybercrime that carries grave implications for African enterprises.
RELATED: Global ransomware attacks double as July 2026 cyber threat volumes hit record highs
Attackers have abandoned single-vector approaches for multipronged offensives, forcing organisations to evolve their defences at unprecedented speed. Although global victim counts remained static at 2,139, the threat ecosystem has fractured into a record 93 active ransomware variants—a dispersal that signals not retreat, but tactical sophistication.
For South African and broader African organisations—which already endure a staggering 3,008 cyberattacks per organisation per week (Check Point Global Threat Intelligence Insights July 2026), roughly 61% higher than the global average—this decentralisation presents an immediate risk. Attackers are moving away from simple system encryption to aggressive data exfiltration, extortion, and AI-accelerated malware deployment, turning cyber security into a critical issue of operational continuity, regulatory compliance, and economic survival.
The latest report reveals that the ransomware ecosystem is decentralising rapidly. In Q1 2026, the top 10 ransomware cartels accounted for 71% of all victims. By Q2, that concentration dropped to 57.6% as mid-tier groups surged, pushing total active strains to an all-time high of 93.
While Qilin remained the most active group overall (279 victims), a newcomer called The Gentlemen grew by 62% in Q2, temporarily overtaking Qilin in June.
The AI Threat Multiplier
Leaked operational logs from The Gentlemen revealed how a core team of just nine people built a top-tier Ransomware-as-a-Service (RaaS) platform in record time. Notably, the group’s lead administrator built their central management panel in just three days using AI coding assistants.
“AI is drastically lowering the barrier to entry, allowing smaller, highly agile teams to automate reconnaissance, scale phishing campaigns, and deploy infrastructure faster than traditional defensive controls can adapt,” says Shayimamba Conco, Security Evangelist: Africa for Check Point Software Technologies.
The Extortion Pivot
Ransom payment rates have dropped to an all-time low of 23% as organisations improve system backup and recovery capabilities. However, on-chain payments still topped $820 million over the past year.
What actually happened in Q2 2026?
Data leak sites, where ransomware groups publish victims who refuse to pay, logged 2,139 victims in Q2, essentially flat against Q1 and up 33% year over year.
What shifted is who’s doing the attacking. In Q1, the top 10 groups controlled 71% of victims across just 71 active groups, a tight, top heavy market. By Q2, that eased to 57.6%, and active groups climbed to 93, the highest on record. Cl0p, whose Oracle E-Business Suite campaign drove much of Q1’s numbers, nearly vanished, and a wider mid tier filled the gap. Qilin held the top spot for a fourth straight quarter with 279 victims, narrowly ahead of The Gentlemen, which grew 62% and outpaced Qilin in June.
Figure 1:Total Number of Reported Ransomware Victims in data leakage websites, per month
(June 2024 – June 2026).
Figure 2: Top-10 share and active group count, Q2 2026.
“Because system restores no longer guarantee compliance, threat actors now prioritise data theft before encryption. For South African enterprises bound by strict data governance and privacy laws, double-extortion tactics mean backups alone are no longer enough to protect against reputational and financial damage,” Conco added.
What did the leaked Gentlemen chat logs actually reveal?
A leak of The Gentlemen’s own backend and chat history, giving researchers a rare inside view of a top tier operation. The core team was just nine people, running a 90/10 split with a broader affiliate base that carried out most of the intrusion work, the highest cut advertised in the market.
The detail worth remembering: the group’s admin, Zeta88, built the operation’s ransomware management panel in about three days using AI coding assistants, with a candid admission that the tools still require someone who understands the code well enough to guide and correct it. That’s genuine evidence AI is speeding up how ransomware tooling gets built, though its use here was about writing software faster, not running operations or picking targets. The bigger signal: the barriers to building a serious ransomware business have narrowed enough that one experienced operator can reach the top tier in months.
Figure 3 – The Gentlemen monthly victim trajectory, Sep 2025 – Jun 2026.
Figure 4:The Gentlemen referring to the leak in a criminal forum
Why does data theft matter more than encryption right now?
 Payment rates have fallen for six straight years, from 85% in 2019 to roughly 23% today, largely because backups have gotten better at neutralising encryption.
“Backups don’t help against data theft, though. If files are already stolen and about to be published, restoring systems doesn’t stop the leak, which is why operators are leaning into exfiltration first extortion,” Conco says.
Total dollars paid haven’t followed payment rates down: on–chain payments still exceeded $820 million in 2025.
Law enforcement spent the quarter chasing shared infrastructure rather than individual groups, dismantling a laundering platform, sanctioning exchanges tied to ransomware actors, and taking down a malware signing service and major infostealer networks. None of that shows up as a drop in Q2’s victim count, and seized infrastructure tends to get rebuilt elsewhere, but raising the cost of laundering, signing, and credential harvesting adds friction that compounds over time.
What should defenders actually prioritise?
A few things fall out of the quarter’s data. Initial access remains the fight that matters most: The Gentlemen’s own pipeline ran on VPN scanning, brute forcing, and brokered credentials, the same route used across most of the ecosystem, so phishing and exposed remote access deserve defense in proportion to how often they’re the opening move. Exfiltration detection now deserves the same weight backup and recovery has traditionally received, and remediation speed matters more too, since the gap between disclosure and exploitation is now measured in hours. Defenses still running on a human review cycle are working against AI assisted tooling that no longer waits for one.
How does Check Point address what this Ransomware quarter found?
Most of what this report documents starts with a person, usually through phishing or stolen credentials feeding the same pipeline The Gentlemen relied on. Workspace Security protects users across email, browsers, SaaS applications, and endpoints, using AI driven detection to stop ransomware delivery before execution and limit lateral movement and exfiltration after a compromise.
Hybrid Mesh Network Security applies consistent, AI driven controls at every connectivity point, from firewalls that block malicious files before they reach devices to CASB scanning that catches malware entering through SaaS platforms like OneDrive and Slack, a route access brokers increasingly favor. If a compromise happens anyway, Zero Trust access through SASE Private Access limits the blast radius so ransomware can only reach what the compromised user was authorized to touch.
Exposure Management answers the harder question of which vulnerabilities ransomware groups can actually reach and use, not just which ones exist. Check Point’s 2026 Exposure Gap Report found vulnerabilities now make up 42.6% of critical exposures, more than double the year before, and that they can realistically be closed in under an hour, with utilities sector organisations using the platform resolving 30% of theirs within that window.
AI Security addresses the same tooling ransomware groups are learning to use. ThreatCloud AI keeps protection moving on the same accelerated timeline as AI assisted exploitation, AI Agent Security governs the agent permissions that let an admin like Zeta88 build tooling in days, AI Red Teaming tests an organization’s own AI applications before deployment, and Workforce AI Security stops credentials and data from leaking through the AI tools employees already use.
Moving Beyond Remediation
“Detecting an attack after a breach has occurred is simply too late,” says Conco “As ransomware operators use AI to speed up their development and target South African enterprises with high-volume extortion campaigns, cybersecurity must pivot from reactive remediation to a prevention-first strategy.”
Through integrated protections spanning workspace, network, cloud, identity, and AI environments, organisations across Africa can close exposure windows, protect critical data, and ensure long-term digital resilience.
 Download the complete State of Ransomware Q2 2026 report here.
