Check Point：2026年 Q1勒索软件状况报告：少数攻击团伙主导更大规模网络威胁（英文版）（20页）.pdf

1、Insights into fewer groups driving greater impactTHE STATE OF RANSOMWARETHE STATE OF RANSOMWARETHE STATE OF RANSOMWARETHE STATE OF RANSOMWARETHE STATE OF RANSOMWARETHE STATE OF RANSOMWAREQ12026TABLE OFCONTENTS:Ransomware in Q1 2026:Consolidation at Scale010101010101From Fragmentation to Consolidatio

2、n020202020202Notable Surges and Decline030303030303Actor Spotlight:The Gentlemen The Breakout Story of Q1 2026040404040404Geographic Distribution of Victims070707070707LockBit 5.0:Making a Comeback050505050505Ransomware Attacks by Industry080808080808DragonForce:The Cartel Model Under Pressure060606

3、060606Conclusion090909090909Ransomware activity remained elevated in Q1 2026,continuing the trend established over the past year.According to the State of Ransomware Q1 2026 report from Check Point Research,overall attack volume stayed near historic highs.At the same time,the structure of the ransom

4、ware ecosystem changed materially.After two years of increasing fragmentation,activity is consolidating around a smaller number of dominant groups.For organizations,this shift reduces the number of active actors but increases the potential impact of individual incidents.EXECUTIVE SUMMARY:KEY FINDING

5、S 2,122 organizations were listed on ransomware data leak sites in Q1 2026,making it the second-highest Q1 on record.The top 10 ransomware groups accounted for 71%of all victims,reversing the fragmented landscape seen throughout much of 2025.Qilin remained the most active ransomware operation for th

6、e third consecutive quarter,posting 338 victims.LockBit confirmed its comeback,posting 163 victims and re-entering the global top tier.The Gentlemen emerged as the breakout group,increasing activity from 40 victims in Q4 2025 to 166 in Q1 2026.Taken together,these figures show that ransomware volume