InfoSecBulletin Cybersecurity for mankind
New ransomware actions in 2026 show more variety in cybercrime, with some groups claimed over 100 victims. The ransomware attack grew in 2026, with 89 new ransomware groups listed from January 5 to November 5, based on the data by ransomware.live. Together, these groups claimed 2,235 victims, showing how active new ransomware operations are.
The numbers show that ransomware is not just done by a few well-known groups. Many new groups have come up this year, with some saying they have dozens or even hundreds of victims.
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
N0n, Krybit and Deadlock Lead the List
N0n claimed the most victims among the ransomware groups in the data, with 215. Krybit had 169 victims, and Deadlock had 112. Other big groups were Settra, with 105 victims, and Payload, with 92. Storm had 89 victims, then came Auditteam (66), Orova (63), Emperador (60), and Booba Project (58). The top five groups have 693 reported victims, which is about 31% of the total in the dataset.
Ransomware Activity Throughout 2026
Ransomeare.live data shows that new ransomware names keep appearing in the first ten months of 2026. Many groups showed up in the first quarter, like Sicarii, Vect, Insomnia, Bravox, Payload, Cipherforce, and Ailock.
The count of new operations went up in the second and third quarters. Some well-known names were Deadlock, Settra, Wallstreet, Global Secret Group, Orova, Panzer, Storm, and N0n. October and early November had more names added, like Vypr, Byod, Umbra, Scarlettgroup, Hyflock, Whitearmor, Everstake, Shiba, Obsoft, Pixelleaks, Aoqin, and Destello.
Some groups had very high victim numbers even though they were new. For instance, N0n, which joined on September 18, said it had 215 victims, while Krybit, which joined on April 3, said it had 169.
Newly Listed Groups With the Highest Victim Counts
The following ransomware groups recorded the highest victim counts in the supplied dataset:
Ransomware group |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Reported victimsÂ
| N0n |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 215 |
| Krybit |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 169 |
| Deadlock |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 112 |
| Settra |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 105 |
| Payload |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 92 |
| Storm |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 89 |
| Auditteam |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 66 |
| Orova |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 63 |
| Emperador |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 60 |
| Booba Project |Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 58 |
Source: ransomware.live
What the Numbers Indicate
Many ransomware groups are now appearing, showing a wider range of threats. The quick rise in victim claims by some groups also shows how capable these new ransomware actors can be.
However, the numbers of victims shown on ransomware leak sites should not be seen as confirmed successful attacks. These numbers might show claimed victims, repeated listings, or reports that have not been verified by the affected organizations or outside security experts.
Organizations should improve their readiness for ransomware by conducting regular security checks, maintaining offline, immutable backups, using multifactor authentication, detecting and responding to threats on devices, segmenting networks, managing vulnerabilities quickly, and practicing incident response.
Note: The data set is up to November 8 and the number of victims list claimed by the threat actor not confirmed.
