RANSOMWARE

ccording to Check Point Research

2026, overall ransomware victim numbers continues to remain at historically high levels in Q2 2026, though Check Point Research uncovered a trend that attackers are increasingly prioritising data theft over encryption, reshaping the economics and future of ransomware.

Key findings from Check Point Research:

A record 93 ransomware groups are now active – Check Point Research recorded 2,139 ransomware victims globally in Q2 2026, a 33 % increase year-on-year, while the number of active ransomware groups rose from 71 to 93, the highest level observed to date. The findings suggest ransomware activity is spreading across a larger number of actors rather than concentrating among a few dominant groups.

Evidence of AI accelerating ransomware development – Leaked conversations demonstrated that group, The Gentlemen’ s ransomware group administrator built the group’ s ransomware management infrastructure in approximately three days using AI coding assistants, including DeepSeek and Qwen. While AI was not observed autonomously running attacks, Check Point Research found clear evidence that AI is already accelerating the development of cybercriminal tooling and reducing the expertise required to launch sophisticated operations.

Ransomware is becoming a data theft business – According to data cited in the report, ransomware payment rates have fallen from 85 % in 2019 to approximately 23 % today, yet ransomware-related payments still exceeded US $ 820 million in

2025. This shift is pushing threat actors away from encryption-only attacks and toward exfiltration-first extortion, where stolen data becomes the primary leverage over victims.

AI is compressing the window between vulnerability disclosure and exploitation – Check Point Research also observed that the time between vulnerability disclosure and active exploitation continues to narrow, increasingly measured in hours and days rather than weeks. This is attributed partly to AI-assisted exploit development, allowing attackers to operationalise vulnerabilities faster than many organisations can patch them.

Evolution within ransomware ecosystem

Previously, successful ransomware campaigns required significant technical skill, infrastructure and manpower. Today,

Sergey Shykevich, Director, Threat Intelligence at Check Point Software

AI-assisted development, ransomware-asa-service models and specialised criminal supply chains are dramatically lowering those barriers. Resulting in a cybercrime economy where smaller groups can achieve disproportionate global impact.

For defenders, the implications are equally significant. Data protection is becoming as important as backup and recovery strategies. Organisations must also assume that AI will continue accelerating attacker innovation, reducing the time available to identify, prioritise and remediate exploitable exposures.

Most importantly, ransomware should no longer be viewed solely as a malware problem. It has evolved into a mature criminal ecosystem built on initial access brokers, credential theft, affiliate networks, AI-assisted tooling and data theft operations.

Sergey Shykevich, Director, Threat Intelligence at Check Point Software, said:“ The most important finding from this quarter isn’ t the number of ransomware victims, but how dramatically the barriers to entry are falling. We now have evidence that a small team, supported by AIassisted tooling and affiliate networks, can build a top-tier ransomware operation in a matter of months. As AI continues to accelerate both software development and exploit creation, we’ re likely to see more threat actors emerge, operate faster and scale further than ever before. Organisations need to shift from a reactive security model to a preventionfirst approach, focusing on reducing exploitable exposures, protecting credentials and sensitive data, and assuming that attackers will increasingly leverage AI to shorten every stage of the attack lifecycle.”

30 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST