Black Kite Reports 60 Percent Jump in Ransomware Activity Led by Growing Number of Groups

Black Kite announced in a press release its 2026 Ransomware Report, highlighting a 60 percent increase in ransomware incidents during the second half of the reporting period from April 2025 to March 2026. The company recorded 7,551 publicly disclosed victims, marking a 24.9 percent rise compared to the prior year.

The research identified 146 active ransomware groups by June 2026, with more than 60 new entrants joining the ecosystem. The five largest operators were responsible for 43.6 percent of total victims, with Qilin alone accounting for over 1,300 cases. March 2026 saw 861 victims, the highest monthly total in four years.

According to the report, AI did not redefine ransomware execution but lowered the cost of operations by automating reconnaissance, phishing, and content preparation. This reduced barrier to entry allowed more actors to participate. Many attacks exploited trusted vendor platforms such as enterprise software integrations and support workflows.

Black Kite noted that post-incident exposure often persisted, with 43.5 percent of affected organizations still carrying critical vulnerabilities and stealer log exposure increasing 175 percent. The report recommends prioritizing patch management, strengthening vendor verification procedures, and improving identity controls to mitigate future risks.