Qilin Dominates 2026 Ransomware Landscape With 500+ Victims; Passes 16% Market Share as The Gentlemen Emerges as Runner-Up

Qilin ransomware has claimed more than 500 victims in 2026 alone — accounting for approximately 16% of the global ransomware market per Check Point research — cementing its position as the most active RaaS operation currently tracked, with manufacturing, professional services, and technology as primary sectors. The Gentlemen group, an emerging competitor, surpassed Qilin in June 2026 with 115 victims in a single month (vs. Qilin's 78), signaling a rapidly consolidating competitive landscape following the collapse of LockBit, ALPHV, and RansomHub. Defenders should note Qilin's expanding TTP set: affiliates are now observed stealing Chrome credentials pre-encryption, abusing Windows Subsystem for Linux to evade EDR, and leveraging a RaaS panel feature that introduces fake legal counsel into ransom negotiations to maximize victim payment pressure.

Qilin's 78), signaling a rapidly consolidating competitive landscape following the collapse of LockBit, ALPHV, and RansomHub.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.