Hey hackers - ransomware as a service in 2026 stopped being a land grab and turned back into a labor market: seventy-one active groups, one dominant franchise, and a pool of independent contractors who move the moment a program's terms slip.
The 2026 ransomware season reconsolidated around fewer operators with better packaging, and this piece reads it the way the affiliates read it - leaderboard first, then payout terms, then which program's kit actually ships updates.
TL;DR: Check Point counted the top ten groups taking 71.1 percent of Q1 victims, the highest concentration since early 2024, with Qilin posting 338 and The Gentlemen climbing from 40 to 166 victims in one quarter. ReliaQuest logged 2,252 leak-site victims for Q2 across 90 groups and 99 countries, The Gentlemen taking first at 300 while Qilin slipped to 289. Payouts run 80 to 90 percent, entry runs from a Bitcoin deposit to personal references, and the recruitment ground moved to BreachForums after the FBI seized RAMP in January.
The economics rhyme with every other service market on the dark web, and the exit leg still runs through the laundering cycle while the tracing side reads every negotiation wallet the same way.
Q2 confirmed the shape rather than disturbing it: 108 countries hit, up from 97, with Qilin holding 13 percent for a third straight quarter and The Gentlemen one slot behind at 12 percent, six victims short. GuidePoint's read of the field calls the top a four-headed monster - Qilin, The Gentlemen, Akira and DragonForce - and the structural reason the arrangement holds is that there are now four franchises to catch affiliates whenever any one of them takes a hit, instead of one giant waiting to fall.
The group launched in September 2025 with a stockpile: an inventory of about 14,700 already-compromised devices, which is why thirty-eight victims appeared within weeks of the program going public. They did not find that access. They had been collecting it.
The packaging is the product. Leaked chat logs describe a full starter kit for affiliates: pre-compromised victim lists, custom EDR killers, Group Policy Object deployment across a domain from a single host, WinSCP for exfiltration, edge-device exploitation for the entry, lightweight tunneling for command and control, and single-host encryption as the default shape.
The locker itself is a Go binary covering Windows, Linux, NAS and BSD with XChaCha20 and Curve25519 and a fresh ephemeral key per file, three speed modes that trade coverage for time, and a thirty-two kilobyte ESXi locker in C for the hypervisor layer. Ransom notes generate themselves with the affiliate's own contact details baked in, and messages to the operator's main Tox account forward straight to whoever owns the job.
Terms closed the recruitment loop: a 90 percent affiliate share, announced through an official BreachForums partnership in May 2026 that put the program one click from the access brokers selling RDP and VPN footholds. Against an average demand above 1.5 million dollars, ten points of margin is the difference between a contractor re-signing and a contractor leaving - and in a ransomware labor market, that is the entire retention strategy.
LockBit 5.0 landed on RAMP in September 2025 - multi-platform encryption for Windows, Linux and ESXi, randomized sixteen-character file extensions against signature-based detection, a five-hundred-dollar Bitcoin deposit gating new affiliates - and posted 163 victims in Q1 2026, a 106 percent rebound.
The interesting number is geographic. American victims fell to about 21 percent of LockBit's total, down from a historic majority, with Italy, Brazil and Turkey picking up the slack - a program that used to concentrate on one market now spreads across many, which is what rebuilding looks like when your home turf got crowded.
Around that comeback sits the cartel theater: DragonForce's September 2025 post on RAMP inviting Qilin and LockBit to "create equal competition conditions, no conflicts and no public insults" so all three can dictate market conditions, plus LockBit's announcement that critical infrastructure previously off-limits - nuclear, thermal, hydroelectric - is now fair game for affiliates.
ReliaQuest watched for joint operations and a combined leak site and saw neither. The cartel is a recruitment brochure written by three marketing departments, and every ransomware contractor knows it; LockBit's own ransomware alumni are the proof, with an ex-operator opening the Hyflock program on the Duty-Free forum in May 2026 at an 80 percent share rising to 85 by the second job.
The Gentlemen undercuts everyone at 90 percent flat with no deposit story attached to the public pitch. LockBit keeps the classic 80/20 split under a five-hundred-dollar gate. The historical marker everyone still quotes is BlackCat's jump to 90 percent back in 2023 to hold talent after disruption - the floor has not dropped since, because every displaced cohort of contractors remembers being bid on.
The FBI's seizure of RAMP on January 28, 2026 moved the whole board. That was the forum where LockBit had announced version 5.0, and with it gone, BreachForums absorbed the adjacency between access brokers and programs - a seller with an RDP foothold now sits a click from the ransomware operation that will weaponize it, with The Gentlemen's partnership banner between them.
Sourcing did not change, only the storefront: Verizon's DBIR found domain credentials in stealer log marketplaces before the attack for 54 percent of victims, which means the labor market's raw material is bought, not built, and the opsec habits around an exit apply to a payout the same way they apply to anything else that ends in a transfer.
Speed: ReliaQuest reads The Gentlemen's tooling cadence as AI-accelerated iteration, compressing an affiliate-kit build cycle that used to take months into days, with the implication that any program willing to standardize on off-the-shelf models copies the same packaging and the same tempo.
The third use is capacity. Check Point notes affiliates now run their own AI tooling against targets, which drops the technical bar for an effective attack, and mid-tier groups that adopt the pattern get the same compression the top tier already banked.
On the defensive side of the same ledger sits the trend that matters: victims with intact backups pay less, encryption without full network reach pays less, and every quarter where the entry vector is a stale appliance exploit instead of novel work pushes payment volume down no matter how loud the leaderboard gets.
Deadlock's burst after eleven months of quiet shows the other axis: technical novelty with blockchain-hosted command and control rotating through a smart contract and kernel-level termination that blinds endpoint telemetry before encryption starts, the kind of edge that does not need a leaderboard to matter.
The detection side has stopped chasing names for the same reason. Behavior-based coverage - remote service abuse, identity compromise, lateral movement, defense evasion - survives the rebrand cycle that makes any specific signature a two-quarter asset.
Programs collapse, alumni relaunch, leak sites fork, and the four-headed structure means the next Hyflock arrives with a themed panel and a press release rather than a vacuum. Read the payout terms, read the kit changelog, and treat every cartel announcement as what it is: marketing aimed at the same contractors shopping three forums over.
Treat the leaderboard as weather and the economics as climate. Payout terms, entry gates, kit maintenance and venue are the four numbers that decide where the labor goes next quarter, and they are all published by the programs themselves in the threads where they recruit. Read them the way a contractor would, know which side of the transaction you are on, and keep the exit path - the wallet, the wash, the off-ramp - rehearsed before the first demand goes out.
The 2026 ransomware season reconsolidated around fewer operators with better packaging, and this piece reads it the way the affiliates read it - leaderboard first, then payout terms, then which program's kit actually ships updates.
TL;DR: Check Point counted the top ten groups taking 71.1 percent of Q1 victims, the highest concentration since early 2024, with Qilin posting 338 and The Gentlemen climbing from 40 to 166 victims in one quarter. ReliaQuest logged 2,252 leak-site victims for Q2 across 90 groups and 99 countries, The Gentlemen taking first at 300 while Qilin slipped to 289. Payouts run 80 to 90 percent, entry runs from a Bitcoin deposit to personal references, and the recruitment ground moved to BreachForums after the FBI seized RAMP in January.
The economics rhyme with every other service market on the dark web, and the exit leg still runs through the laundering cycle while the tracing side reads every negotiation wallet the same way.
The market reconsolidated, by the numbers
Two years of fragmentation reversed in Q1 2026. Active groups fell from 85 to 71, fourteen operators vanished outright, and the new names that replaced them mostly posted under ten victims each - the mid-tier thinned while the top concentrated. The top ten claimed 71.1 percent of all leak-site victims, Qilin alone outposted the bottom fifty groups combined, and the quarterly story stopped being "how many groups exist" and became "which four absorb the displaced affiliates."Q2 confirmed the shape rather than disturbing it: 108 countries hit, up from 97, with Qilin holding 13 percent for a third straight quarter and The Gentlemen one slot behind at 12 percent, six victims short. GuidePoint's read of the field calls the top a four-headed monster - Qilin, The Gentlemen, Akira and DragonForce - and the structural reason the arrangement holds is that there are now four franchises to catch affiliates whenever any one of them takes a hit, instead of one giant waiting to fall.
| Program | Q1 victims | Q2 victims | Move | Signature |
|---|---|---|---|---|
| Qilin | 338 | 289 | first place held, April to June slide of 29 percent | open recruitment, deposit entry, cross-sector targeting |
| The Gentlemen | 166 | 300 | +315 percent then first place outright | starter kit, AI-accelerated tooling, 90 percent share |
| LockBit 5.0 | 163 | mid-tier rebuild | +106 percent from a low base | multi-platform locker, deposit gate, cartel rhetoric |
| DragonForce | 101 | 47 posts | -58 percent quarter over quarter | cartel branding, LLM-written pressure, data audit service |
| Deadlock | dormant | 75 in June alone | burst after eleven months of silence | blockchain C2, kernel-level EDR termination |
The Gentlemen: an origin in a commission dispute
The year's fastest riser started as a bookkeeping argument. Check Point's reporting puts The Gentlemen's founder, hastalamuerte, as an experienced Qilin affiliate who walked after a dispute over roughly 48,000 dollars in unpaid commission - a senior operator who had already run the ArmCorp crew under Qilin and carried prior time with Embargo, LockBit and Medusa.The group launched in September 2025 with a stockpile: an inventory of about 14,700 already-compromised devices, which is why thirty-eight victims appeared within weeks of the program going public. They did not find that access. They had been collecting it.
The packaging is the product. Leaked chat logs describe a full starter kit for affiliates: pre-compromised victim lists, custom EDR killers, Group Policy Object deployment across a domain from a single host, WinSCP for exfiltration, edge-device exploitation for the entry, lightweight tunneling for command and control, and single-host encryption as the default shape.
The locker itself is a Go binary covering Windows, Linux, NAS and BSD with XChaCha20 and Curve25519 and a fresh ephemeral key per file, three speed modes that trade coverage for time, and a thirty-two kilobyte ESXi locker in C for the hypervisor layer. Ransom notes generate themselves with the affiliate's own contact details baked in, and messages to the operator's main Tox account forward straight to whoever owns the job.
Terms closed the recruitment loop: a 90 percent affiliate share, announced through an official BreachForums partnership in May 2026 that put the program one click from the access brokers selling RDP and VPN footholds. Against an average demand above 1.5 million dollars, ten points of margin is the difference between a contractor re-signing and a contractor leaving - and in a ransomware labor market, that is the entire retention strategy.
LockBit's second life, and a cartel with no shared leak site
Operation Cronos seized LockBit's infrastructure in February 2024 and the numbers never recovered to their peak: 2,500 organizations across 120 countries, 1,800 of them American, more than 500 million dollars collected, roughly 200 affiliates, and a leadership structure where the alleged founder Dmitry Khoroshev took about twenty cents on the dollar. What survived was the brand.LockBit 5.0 landed on RAMP in September 2025 - multi-platform encryption for Windows, Linux and ESXi, randomized sixteen-character file extensions against signature-based detection, a five-hundred-dollar Bitcoin deposit gating new affiliates - and posted 163 victims in Q1 2026, a 106 percent rebound.
The interesting number is geographic. American victims fell to about 21 percent of LockBit's total, down from a historic majority, with Italy, Brazil and Turkey picking up the slack - a program that used to concentrate on one market now spreads across many, which is what rebuilding looks like when your home turf got crowded.
Around that comeback sits the cartel theater: DragonForce's September 2025 post on RAMP inviting Qilin and LockBit to "create equal competition conditions, no conflicts and no public insults" so all three can dictate market conditions, plus LockBit's announcement that critical infrastructure previously off-limits - nuclear, thermal, hydroelectric - is now fair game for affiliates.
ReliaQuest watched for joint operations and a combined leak site and saw neither. The cartel is a recruitment brochure written by three marketing departments, and every ransomware contractor knows it; LockBit's own ransomware alumni are the proof, with an ex-operator opening the Hyflock program on the Duty-Free forum in May 2026 at an 80 percent share rising to 85 by the second job.
The affiliate labor market, priced
Ransomware program economics in 2026 read like a compensation band because that is what they are. Qilin runs open recruitment on Russian-language forums at an 80 to 85 percent affiliate share behind a monetary deposit, which trades references for money and lowers the entry bar compared to Akira, where the door opens through personal ties instead.The Gentlemen undercuts everyone at 90 percent flat with no deposit story attached to the public pitch. LockBit keeps the classic 80/20 split under a five-hundred-dollar gate. The historical marker everyone still quotes is BlackCat's jump to 90 percent back in 2023 to hold talent after disruption - the floor has not dropped since, because every displaced cohort of contractors remembers being bid on.
| Program | Affiliate share | Entry | Recruitment venue |
|---|---|---|---|
| Qilin | 80 to 85 percent | monetary deposit | RAMP until the January seizure, open forum threads |
| The Gentlemen | 90 percent | application, kit onboarding | BreachForums official partnership, May 2026 |
| Hyflock | 80 percent rising to 85 | claim of prior LockBit and Qilin tenure | Duty-Free forum, May 14, 2026 |
| LockBit 5.0 | 80 percent | 500 dollar Bitcoin deposit | RAMP announcement, legacy brand pull |
| Deadlock | not published | closed operations | no active recruitment while DLS sits quiet |
Sourcing did not change, only the storefront: Verizon's DBIR found domain credentials in stealer log marketplaces before the attack for 54 percent of victims, which means the labor market's raw material is bought, not built, and the opsec habits around an exit apply to a payout the same way they apply to anything else that ends in a transfer.
AI enters the build pipeline
Three separate uses of large models showed up in the 2026 ransomware filings and they are worth separating. Pressure: DragonForce claimed legal counsel on staff in negotiations and affiliate ads - counsel that is almost certainly a language model drafting plausible-sounding statements about a victim's reporting obligations, which works because plausibility is the product, not truth.Speed: ReliaQuest reads The Gentlemen's tooling cadence as AI-accelerated iteration, compressing an affiliate-kit build cycle that used to take months into days, with the implication that any program willing to standardize on off-the-shelf models copies the same packaging and the same tempo.
The third use is capacity. Check Point notes affiliates now run their own AI tooling against targets, which drops the technical bar for an effective attack, and mid-tier groups that adopt the pattern get the same compression the top tier already banked.
On the defensive side of the same ledger sits the trend that matters: victims with intact backups pay less, encryption without full network reach pays less, and every quarter where the entry vector is a stale appliance exploit instead of novel work pushes payment volume down no matter how loud the leaderboard gets.
What moves the market next
Follow the affiliates, not the brands. Qilin's April-to-June slide lines up almost exactly with The Gentlemen's climb - the same lineage, the same forum, a better split - and the quarterly forecasts expect migrated contractors to keep favoring whichever program ships tools fastest.Deadlock's burst after eleven months of quiet shows the other axis: technical novelty with blockchain-hosted command and control rotating through a smart contract and kernel-level termination that blinds endpoint telemetry before encryption starts, the kind of edge that does not need a leaderboard to matter.
The detection side has stopped chasing names for the same reason. Behavior-based coverage - remote service abuse, identity compromise, lateral movement, defense evasion - survives the rebrand cycle that makes any specific signature a two-quarter asset.
Programs collapse, alumni relaunch, leak sites fork, and the four-headed structure means the next Hyflock arrives with a themed panel and a press release rather than a vacuum. Read the payout terms, read the kit changelog, and treat every cartel announcement as what it is: marketing aimed at the same contractors shopping three forums over.
TERMS IN WRITING: share, deposit, payout schedule and dispute resolution on the program's own panel - not in a recruitment thread that can be edited. KIT PROVENANCE: ask what ships in the starter package and whether the EDR killer and deployment tooling get versioned updates, because a static kit ages out in weeks. EXIT TEST: how payouts clear, on what schedule, and what a contractor's first test run looks like before a real job depends on it.
EXPOSURE HISTORY: every prior disruption, seizure and forum ban the brand carries - the affiliates who lost money in Cronos already priced that risk. RECRUITMENT VENUE: where the program recruits tells you who else is in the room, and after RAMP's seizure the venue changed faster than the terms did. HEAT: programs advertising 90 percent shares through official forum partnerships are buying visibility, and visibility is the input the tracing side reads first.
EXPOSURE HISTORY: every prior disruption, seizure and forum ban the brand carries - the affiliates who lost money in Cronos already priced that risk. RECRUITMENT VENUE: where the program recruits tells you who else is in the room, and after RAMP's seizure the venue changed faster than the terms did. HEAT: programs advertising 90 percent shares through official forum partnerships are buying visibility, and visibility is the input the tracing side reads first.
The stance that holds
Ransomware in 2026 is an industry with HR problems. The product got commoditized - every serious program ships cross-platform encryption, negotiation panels and negotiation pressure - so the competition runs on affiliate share, tooling cadence and how fast a displaced contractor can be onboarded. Consolidation at the top and churn underneath are the same phenomenon seen from two altitudes: four franchises absorbing the market while seventy smaller names fight over what leaks down.Treat the leaderboard as weather and the economics as climate. Payout terms, entry gates, kit maintenance and venue are the four numbers that decide where the labor goes next quarter, and they are all published by the programs themselves in the threads where they recruit. Read them the way a contractor would, know which side of the transaction you are on, and keep the exit path - the wallet, the wash, the off-ramp - rehearsed before the first demand goes out.