Global ransomware activity rose by 3% in Q2 2026 compared with the previous quarter, according to NCC Group’s latest Quarterly Cyber Threat Intelligence Report. The report highlighted continued growth in supply chain attacks, with threat groups increasingly targeting trusted software development ecosystems.

Rather than directly attacking organisations, threat actors are compromising trusted software and development tools used by thousands of businesses. These attacks allow a single compromise to impact multiple organisations, making supply chain attacks an effective method for large-scale compromise.

TeamPCP emerged as one of the most prominent groups associated with this activity. NCC Group reported that its campaigns demonstrate how compromised software dependencies and development workflows can enable downstream compromise before attacks are detected.

Industrials remain the most targeted sector

Industrials continued to be the most targeted sector in Q2, accounting for nearly a third of global ransomware attacks at 30%. Consumer Discretionary and Information Technology followed with 23%.

The same sectors remained among the most targeted in June. Industrials ranked first with 183 attacks, representing 28% of attacks during the month. Consumer Discretionary followed with 166 attacks, accounting for 25%, while Information Technology recorded 63 attacks, representing 9%.

North America was the most targeted region in Q2, accounting for 44% of global attacks. The region also ranked first in June with 275 attacks, followed by Europe with 153 attacks and Asia with 133 attacks.

Qilin remains leading ransomware group

Qilin remained the most active ransomware group for the fifth consecutive quarter, responsible for 14% of all attacks with 301 reported incidents. The Gentlemen group ranked second with 238 victims, followed by DragonForce with 145 victims.

NCC Group also reported that KryBit emerged as a new entrant to the top 10 most active ransomware groups during the last three months.

VPNs and edge devices continue to attract attackers

Corporate VPNs and internet-facing edge devices remained key targets for attackers in Q2. NCC Group reported that threat activity ranged from opportunistic hackers to ransomware-as-a-service operators and nation-state sponsored APT groups exploiting software vulnerabilities to gain unauthorised access and expand network compromise.

Vulnerabilities affecting specific VPNs or their manufacturers accounted for some of the most common threat intelligence alerts issued by NCC Group during the first half of 2026, with many rated as high or critical severity.

Matt Hull, VP and Head of Cyber Intelligence and Response at NCC Group, said: “Supply chain attacks continue to be one of the most attractive routes for threat actors to cause significant operational, financial and reputational damage to organisations.”

“We have seen these attacks continue to rise in scale and sophistication, and businesses should therefore ensure monitoring and resilience is continuous, rather than ad hoc,” Hull added.

Hull also noted that while ransomware volume had not seen a material increase in the last quarter, the trajectory of attacks continued upward and VPNs remained an increasingly attractive target.

“Alongside ongoing geopolitical tensions, rapidly evolving AI capabilities and increasingly sophisticated attack methods, organisations must remain resilient and proactive in their approach to cyber security, treating it as the board-level issue it is,” Hull said.

NCC Group noted that incident figures may change over time as cyber attacks are often disclosed after they occur. The statistics represent the best available estimate at the time of publication and may be updated as additional information becomes publicly available.