October 2026 Ransomware Wrap-Up

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 11:59 PM (EDT) on October 31, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• ZeroFox observed at least 855 separate ransomware and digital extortion (R&DE) incidents in October 2026, an increase of approximately 24 percent from the 690 incidents recorded in September 2026.
• Regional R&DE targeting patterns in October 2026 were largely consistent with those observed during previous months. However, the global R&DE threat landscape is very likely maintaining the shift toward geographic diversification.
• ZeroFox observed the manufacturing industry remained the most targeted sector in October 2026, with at least 151 recorded R&DE incidents (an increase from the 143 observed in September 2026).
• ZeroFox observed that the five most active R&DE collectives in October 2026 were almost certainly The Gentlemen, Qilin, n0n, Akira, and Booba Project. This is a change from September 2026, with only The Gentlemen, Qilin, and Akira remaining in the top five over the month.

October 2026 Overview

ZeroFox observed at least 855 separate R&DE incidents in October 2026, an increase of approximately 24 percent from the 690 incidents recorded in September 2026. Additionally, October 2026 marked a roughly 34 percent increase year-over-year from the 636 incidents recorded in October 2025 and an 82 percent increase from the 470 incidents recorded in October 2024.

Regional Trends

Regional R&DE targeting patterns in October 2026 were largely consistent with those observed during previous months. However, the global R&DE threat landscape is very likely maintaining the shift toward geographic diversification. North America-based organizations were the most targeted by a substantial margin, accounting for roughly 48 percent of all October 2026 incidents (or at least 407 incidents).

• ZeroFox had observed a decline in North America’s global share of R&DE incidents for Q2 2026, with European organizations increasing their share. Overall, this trend has continued through October 2026; North American targets saw a 22 percent decrease in year-over-year incidents from October 2025, suggesting threat actors are very likely expanding targeting efforts in other regions at a faster rate.

Europe-based organizations were the second most targeted group in October 2026, accounting for just over 23 percent of all R&DE incidents—down slightly from the approximately 24 percent in September 2026. Europe recorded at least 200 incidents in October 2026—indicating that although the percentage of total incidents dipped slightly, it will likely remain the second most targeted region in the near future.

Asia-Pacific (APAC)-based organizations accounted for 15 percent of all October 2026 R&DE incidents, an increase from the just over 13 percent share recorded in September 2026; however, the total number of incidents in the APAC region has nearly tripled since 2024. This is an indication that threat actors very likely view APAC as a vulnerable region for targeting.

Industry Trends

In October 2026, ZeroFox observed that the manufacturing industry remained the most targeted sector, with at least 151 recorded R&DE incidents (an increase from the 143 observed in September 2026). Roughly 18 percent of all R&DE incidents in October 2026 targeted entities in the manufacturing industry, which is consistent with what ZeroFox has observed throughout 2026. Of note, manufacturing has consistently been the most targeted industry since at least 2021.

• In October 2026, organizations operating within the manufacturing industry almost certainly continued to represent high-value targets for R&DE collectives. This sustained targeting is likely driven by factors such as low operational tolerance for downtime and the use of vulnerable operational technology infrastructure behind automation efforts.
• Heavily targeted industries in October 2026 included manufacturing, healthcare, professional services, technology, and retail; together, R&DE attacks on these industries accounted for approximately 60 percent of all incidents.

Prominent Collectives

ZeroFox observed that the five most active R&DE collectives in October 2026 were almost certainly The Gentlemen, Qilin, n0n, Akira, and Booba Project. This is a change from September 2026, with only The Gentlemen, Qilin, and Akira remaining in the top five over the month. These top five most active collectives accounted for roughly 44 percent of all global R&DE attacks in October 2026—a slight increase from the approximately 37 percent the previous month—and were responsible for a combined total of at least 375 incidents.

• The Gentlemen remained the most prominent R&DE collective in October 2026, accounting for at least 137 incidents; Qilin was the second most prominent, with at least 106 incidents over the course of the month.

n0n

One notable addition to the top five R&DE collectives for October 2026 is n0n, which accounted for at least 73 incidents during the month. ZeroFox first observed this threat actor in late September 2026, and the collective has since claimed at least 86 victims on its leak site. The regions most frequently targeted by n0n were North America, APAC, and Europe.

Thus far, 2026 has seen an average of at least one new threat actor group per week, and n0n is very likely the latest new group to establish itself as a serious threat. There is a roughly even chance the collective will continue its high pace and establish itself as one of the most active threat collectives.