ZeroFox Intelligence Assessment - September 2026 Ransomware Wrap-Up

ZeroFox Intelligence Assessment - September 2026 Ransomware Wrap-up

TLP:Clear

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Key Findings

• In September 2026, ZeroFox recorded at least 742 ransomware and digital extortion (R&DE) incidents, which was roughly 14 percent fewer than in August but approximately 33 and 80.5 percent more than in September 2025 and September 2024, respectively.
• North America remained the top targeted region, with roughly 47 percent of September's incidents (at least 350). However, its year-over-year growth of approximately 7 percent lagged well behind the global rate of about 33 percent, shrinking its regional share of R&DE incidents from roughly 59 percent a year earlier.
• Manufacturing was again the most heavily targeted industry, with at least 150 incidents (down from 175 in August), while healthcare climbed to second place with at least 82 incidents.
• The Gentlemen, Qilin, Akira, INC Ransom, and Storm were almost certainly the five most active collectives in September 2026, with The Gentlemen and Qilin the only two that carried over from August's top five.
• Q3 2026 saw a new quarterly record of at least 2,381 R&DE incidents, approximately 14 percent above the previous high set in Q4 2025 and roughly 67 percent above Q3 2025. This very likely indicates an acceleration in global R&DE activity in the second half of the year heading into Q4 2026.