Cybersecurity firm NordStellar recorded 2,581 ransomware attacks worldwide in the second quarter of 2026, with two gangs, Qilin and The Gentlemen, responsible for nearly a quarter of all incidents combined. The data, drawn from over 200 threat actor blogs, reveals a sharp intensification in the cybercriminal landscape, one where competition between top groups is directly fueling higher attack volumes across both small businesses and major corporations.
The Numbers Behind the Surge
Qilin claimed the top spot with 299 confirmed attacks in Q2, narrowly edging out The Gentlemen at 284. The gap between these two and the rest of the field is stark. DragonForce, ranked third, managed only 147 attacks, roughly half of either leader's total.
The real story, however, is momentum. The Gentlemen ramped up operations by 39% between April and June, while Qilin actually saw a slight decline from its Q1 pace. That shift suggests a power struggle is unfolding in real time, with each gang trying to outdo the other in both volume and high-profile targets.
US SMBs Caught in the Crossfire
Small and medium-sized businesses in the United States absorbed the heaviest damage. Companies with 200 or fewer employees and annual revenue under $25 million suffered 769 attacks in Q2 alone. That figure dwarfs the next most affected countries: Canada reported 97 incidents, Germany 83, and the United Kingdom 74.
The concentration of damage on American SMBs is not accidental. These organizations typically operate with leaner security budgets, fewer dedicated IT staff, and less rigorous backup protocols than their enterprise counterparts. For ransomware operators, that translates to a higher probability of a successful payout.
Enterprise Targeting Jumps 74%
A notable and more troubling trend emerged in the enterprise space. Attacks against organizations with revenue exceeding $1 billion surged from 23 in Q1 to 40 in Q2, a 74% increase. That reverses the historical pattern in which large corporations, with their layered defenses and incident response teams, were considered harder and less attractive marks.
Vakaris Noreika, a cybersecurity expert at NordStellar, tied this shift directly to the rivalry between Qilin and The Gentlemen:
"Ransomware actors historically target SMBs because these organizations often lack comprehensive defenses, which can increase the likelihood of a successful attack. This recent spike in enterprise targeting is unusual and may be a temporary fluctuation. This shift likely stems from the rivalry between dominant threat actors. A successful hit on a major corporation is a badge of honor that boosts a group's reputation within the cybercriminal underground."
In other words, breaching a Fortune 500 company or a household brand name has become less about the ransom itself and more about status. In an economy where threat actors recruit affiliates, sell access, and auction stolen data, reputation is currency.
What This Means for Defenders
The dual targeting strategy, SMBs for volume and enterprises for prestige, creates a difficult defensive landscape. Organizations that previously considered themselves too small to matter are now squarely in the crosshairs. At the same time, large companies that have grown complacent after years of relative quiet may be facing a renewed test.
This dynamic also raises questions about the broader ransomware ecosystem. When top gangs compete for dominance, the spillover often includes faster weaponization of new vulnerabilities, more aggressive extortion tactics, and a flood of lower-tier affiliates trying to mimic the leaders' success. The second half of 2026 will likely determine whether Qilin can hold its lead or whether The Gentlemen' surge signals a longer-term shift in the hierarchy of cybercrime.
Looking Ahead
With the rivalry between Qilin and The Gentlemen showing no signs of cooling, security teams should brace for sustained pressure through the remainder of the year. Watch closely for whether the enterprise targeting trend holds into Q3, or if the gangs retreat to softer SMB targets once the current reputational contest subsides.