GRF analysts recently completed the Semiannual Threat Group Activity Report covering the first half of 2026. The report series tracks attacks based on public sources and conversations of threat actors in closed forums. Analysts compiled data on 3,815 successful attacks. Some key findings:

• There has been a 20% increase in ransomware attacks from the last report which covered the second half of last year.

• In the first half of 2026, Manufacturing was again the most targeted industry with 790 victims. The next most targeted sector was Commercial Facilities with 487.

• This is the ninth report in a row in which Manufacturing has been the most targeted industry, and the fifth in which Commercial Facilities was the second most targeted.

• Qilin was once again the most prolific actor with 564 successful attacks, with relatively new group, The Gentlemen, taking second with 408.

• The United States was targeted by 46% of all ransomware attacks tracked by GRF analysts, with 22% directed at companies within the EU and UK.

• Attacks are increasingly blurring the line between traditional ransomware and a rise in simple theft and extortion.

• Malicious actors are increasingly choosing stealthy malware over malware with extensive capabilities, and that stealthy malware is commonly loading and executing in memory, making forensic analysis more difficult.