Ransomware New Normal: 49% More Groups, 2,122 Q1 Victims — What Now?

When “Elevated” Becomes the Baseline

The standard enterprise risk conversation about ransomware still frames the threat as a spike event: an unusual increase requiring exceptional response, followed by a return to a lower steady state. That framing is now factually wrong.

GuidePoint Security’s GRIT Q1 2026 Ransomware and Cyber Threat Insights Report documented 2,122 victims posted on data leak sites across the quarter — the second-highest Q1 on record. Victim post rates averaged 150–200 per week, holding steady both quarter-over-quarter and year-over-year. Industrial Cyber’s analysis described this as ransomware reaching an “elevated new normal” — the plateau that risk managers had been hoping would follow a sustained crackdown. The crackdown happened. The plateau set in at a level that is still catastrophically high by any historical standard.

Dragos’s 2026 OT Cybersecurity Year in Review added the industrial dimension: 119 ransomware groups targeted 3,300 industrial organisations globally in 2025, a 49% increase from the 80 groups active the prior year. Manufacturing accounted for more than two-thirds of industrial victims. The increase is not from existing groups growing larger — it is from net-new groups entering the market, lowering the average sophistication threshold and broadening the target set.

The Ecosystem Has Industrialised

What 119 Groups Means for Your Risk Model

The conventional enterprise ransomware risk model was built for a world of 15–20 major groups whose TTPs (tactics, techniques, and procedures) could be tracked, whose infrastructure could be partially disrupted by law enforcement, and whose targeting criteria could be somewhat predicted. A world of 119 industrial-focused groups does not behave the same way. Several structural changes follow from this proliferation:

GuidePoint’s Q1 2026 report highlighted The Gentlemen, a ransomware-as-a-service group that emerged in August 2025 and surged from 35 victims in Q4 2025 to 182 in Q1 2026, becoming the second most active group globally. Established groups Qilin and Akira declined 25% and 22% respectively over the same period. This churn — new groups rising rapidly while old groups decline — means intelligence on “active threat groups” becomes stale faster. An adversary profile built in Q4 2025 may be largely irrelevant by Q2 2026 if the group responsible for 40% of your sector’s attacks has been replaced by a new entrant.

The RaaS (ransomware-as-a-service) model drives this proliferation. Groups like The Gentlemen provide ransomware infrastructure — encryption tooling, negotiation platforms, leak sites — to affiliates who handle initial access and victim selection. Affiliates join and leave ecosystems freely. The barrier to entry for a new ransomware campaign has fallen to: buy initial access from an access broker, rent RaaS infrastructure, select a victim. No malware development required. No long-term group infrastructure to build. This is the industrialisation that produces 119 groups.

The Construction Sector Emergence — A Leading Indicator

GuidePoint’s Q1 2026 data showed construction joining the top five most-impacted industries with 131 victims — a 44% year-over-year increase. Manufacturing remained the most targeted. Healthcare and financial services held their positions. The construction sector emergence is significant not because construction is uniquely valuable (it isn’t, compared to financial services) but because it signals that ransomware affiliates are exhausting primary targets and expanding the search perimeter. As defences improve in historically targeted sectors, affiliates move to sectors with lower defensive maturity. Any sector that has been comfortable as a secondary target should treat the construction sector emergence as a 12-month warning.

OT/ICS: The Dwell Time Problem

Dragos’s report documented an industry-wide average dwell time for ransomware in operational technology (OT) environments of 42 days before detection and containment. Organisations with comprehensive OT visibility detected and contained ransomware in an average of 5 days. The 42-day versus 5-day gap is not a minor efficiency difference — it is the difference between a contained incident and a full OT environment compromise with physical operational consequences. Waterfall Security’s 2026 Threat Report separately noted that nation-state and hacktivist attacks against industrial infrastructure doubled in 2025 compared to 2024, compounding the ransomware exposure with a second threat vector that OT teams must now model simultaneously.

What Enterprise Risk Teams Must Do About the New Baseline

1. Replace “ransomware recovery cost” with “ransomware baseline exposure” in your risk model

Most enterprise risk models treat ransomware as an event with a probability and a cost. At 150–200 victim posts per week globally — concentrated in manufacturing, healthcare, financial services, and now construction — the question is no longer “what is the probability of being hit?” for any organisation above a certain revenue threshold in a targeted sector. It is “what is our current recovery posture, and what are our extortion exposure categories?” Update your risk register to replace single-event probability with an exposure-based model: data exfiltration liability (regulatory fines, class actions), operational disruption cost per day, ransom negotiation exposure, and reputational loss. These four buckets have different mitigation strategies and should be tracked separately.

2. Audit your ransomware insurance coverage against the current threat model

GuidePoint’s data shows that ransomware ransom demands have continued to climb even as attack volume stabilised. Many enterprises carry ransomware insurance policies that were underwritten against 2023–2024 threat models. Review your current policy against three questions: Does the policy cover double extortion (data exfiltration plus encryption)? Does it cover multi-party extortion (multiple groups holding data simultaneously)? Does it cover OT/ICS disruption, or only IT system disruption? Policies that fail on any of these three points have coverage gaps that the 2026 threat model will expose. Insurance renewals in 2026 are a specific moment to address these gaps; waiting until an incident to discover them is too late.

3. Build a sector-specific threat intelligence feed into your risk review cadence

The 119-group proliferation means that generic ransomware threat intelligence — “ransomware is active, stay patched” — has stopped providing decision-relevant signal. Enterprise risk teams need sector-specific intelligence: which groups are currently targeting your industry, what their current initial access vectors are (phishing vs. exposed RDP vs. VPN vulnerabilities), and what their average ransom demand is for your organisation size. This intelligence is available through commercial ISAC (Information Sharing and Analysis Center) memberships, through vendors like Dragos (for OT/ICS sectors), and through GuidePoint’s GRIT quarterly reports. Build a quarterly ransomware risk review meeting that uses this intelligence rather than generic threat briefings.

4. Close the 42-day OT dwell time gap — it is the single highest-leverage OT control

For organisations with any operational technology environment — manufacturing, energy, utilities, healthcare devices, building management — the Dragos finding is the single most actionable data point in the 2026 ransomware landscape. OT environments with comprehensive visibility detect and contain ransomware in 5 days on average. Environments without visibility average 42 days. The control gap is OT network monitoring: passive traffic analysis tools (like Dragos Platform, Claroty, or Nozomi Networks) that provide visibility into OT network communications without disrupting operations. If your OT environment has no dedicated monitoring tool, the 42-day dwell time is your current baseline. Close it.

The Correction Scenario — What Stabilisation Does Not Mean

The 150–200 victim-per-week plateau is often framed optimistically: at least it is not growing exponentially. That framing is incomplete. Stable high volume masks two structural changes that make the plateau more dangerous than a continued spike in some respects.

First, as attack volume stabilised, attacker sophistication increased. Dragos reported that adversaries are progressing from isolated device targeting to mapping entire industrial control system architectures before deploying ransomware — demonstrating a maturation in preparation that extends dwell time and maximises disruption. Stable attack count does not mean stable attack severity.

Second, law enforcement disruption has not succeeded in reducing the baseline, only in disrupting individual groups. Each disrupted group’s affiliates migrate to new RaaS platforms and continue operating. Until the economics of ransomware — the access broker market, the cryptocurrency laundering infrastructure, the ransom negotiation platforms — are structurally disrupted, law enforcement action is a whack-a-mole that influences the distribution of attacks across groups, not the total volume. Enterprise risk teams should not plan for a sustained reduction in attack volume. They should plan for 150–200 victims per week for the foreseeable future and build their recovery posture accordingly.

Frequently Asked Questions

Sources & Further Reading

• Ransomware Activity Remains Elevated — New Threat Groups Reshape the Landscape — GuidePoint Security/BusinessWire
• Ransomware Reaches Elevated New Normal as Attack Volumes Hold Steady — Industrial Cyber
• Dragos OT Cybersecurity Report: Adversaries Increase Real-World Impact — BusinessWire
• The State of Ransomware Q1 2026 — Check Point Research
• The State of Ransomware in Q1 2026 — Emsisoft
• Waterfall Threat Report 2026: Nation-State Attacks on Critical Infrastructure — Industrial Cyber