Ransomware Claims Concentrate as AI Polishes Pressure
The shift is not a new ransomware breakthrough. A small set of gangs is taking most of the claims, and AI is helping them write extortion messages that sound more credible and personal without changing the underlying playbook.
GuidePoint’s Q2 2026 report counts 2,279 claimed victims, up 7% from Q1 and 43% year over year. The five most active groups claimed more than 40% of attacks, with Qilin and The Gentlemen driving much of the volume; the report also says LLMs are being used to scale ransom and extortion messaging, not to invent a new technical attack class.
For defenders, the weak tell is no longer sloppy writing. The pressure is coming from more believable, industrialized demands backed by a market that is concentrated enough to absorb disruptions and keep producing claims.