Ransomware activity remains elevated as affiliate ecosystems expand, while geopolitical tensions and AI developments continue to shape the threat landscape.
April 2026 key insights:
- 748 ransomware listings recorded, marking a slight decline from March but maintaining a higher baseline than 2025
- The Industrials sector remained the most targeted, consistent with previous months
- Qilin remained the most prolific ransomware group, responsible for 14% of attacks, followed by The Gentlemen at 10%
- North America remained the most targeted region at 43% of attacks, followed by Europe at 28%
- The rise of RaaS models and affiliate activity is accelerating intrusion speed and reducing dwell time before encryption
Read the full report to explore the latest ransomware trends shaping the April 2026 threat landscape.
Photocredits: Istock/TU IS