Ransomware attacks affect SMEs more than ever as rivalry between cybercriminal gangs increases

NordStellar reports 2,581 ransomware attacks in Q2 2026, with Qilin (299) and The Gentlemen (284) leading the activity, well ahead of DragonForce (147).
American SMEs were the most affected, suffering 769 incidents; They were followed by Canada (97), Germany (83) and the United Kingdom (74), while attacks on multi-million dollar companies increased by 74%.
Experts say the rivalry between Qilin and The Gentlemen is driving the rise, with big corporate successes seen as reputation-enhancing trophies in the cybercriminal world.

Two ransomware gangs are fighting for dominance, and US-based SMEs are suffering the most, experts say.

Recent data on the state of ransomware in 2026, compiled by security experts at NordStellar, shows that two groups, Qilin and The Gentlemen, are by far the most active.

After analyzing more than 200 threat actor blogs, NordStellar concluded that there were 2,581 ransomware attacks in the second quarter of the year, and of that number, 299 belong to Qilin, the most active threat actor out there. In second place are The Gentlemen, with 284 attacks. The third most active group, DragonForce, doesn’t even come close with “only” 147 attacks.

SMEs and companies under attack

While it seems like a close race, it’s actually The Gentlemen who have been doing the heavy lifting between April and June 2026. This group saw a 39% increase in attacks, while Qilin activity actually decreased a bit, compared to the first quarter.

In this morbid race to the bottom, the biggest victims are small and medium-sized businesses (SMEs) based in the United States. These companies, with up to 200 employees and revenues less than $25 million, experienced 769 attacks in the second quarter of 2026, followed by Canada (97), Germany (83), and the United Kingdom (74).

NordStellar also mentioned American companies, which are now increasingly being targeted. Attacks against organizations with revenues exceeding $1 billion increased 74%, going from 23 incidents in the first quarter to 40 in the second.

“Historically, ransomware actors target SMBs because these organizations often lack comprehensive defenses, which can increase the likelihood of a successful attack,” said Vakaris Noreika, cybersecurity expert at NordStellar.

“This recent increase in attacks on businesses is unusual and may be a temporary fluctuation. This change is likely due to rivalry between dominant threat actors: a successful attack on a major corporation is a badge of honor that enhances a group’s reputation within the cybercriminal world.”