Ransomware gangs claimed more victims from July to September than in the spring, and the growth came mostly from new names. The established gangs barely moved. What changed is who is able to start one.
Starting a gang no longer takes a team
Ransomware used to be a trade with a skills barrier. Someone had to write convincing phishing emails, find a way into the network, check that the malicious code worked, and negotiate with the victim. Established gangs split that work among specialists, or rented their tools to partners. AI now writes the emails, checks the code and handles much of the haggling, so one person can cover jobs that used to need several.
The numbers fit that. Groups that had never posted before the third quarter drove 93% of the rise in named victims, while groups that were already active added about 1%. One new group turned out to be run by an inexperienced teenager who had made more than $800,000 in under two weeks.
Not every claim is real. Some newcomers list dozens of victims in a single day, which looks like a list prepared in advance rather than dozens of break-ins, and many will burn out because they lack a veteran gang's experience. But a false claim still costs the named company a day of checking, and the cheap, real ones keep coming.
The language wall was a defense
Japan is the clearest case, but the logic holds in any market where the local language kept attackers out: Korean, Polish, Thai, Portuguese. Outside the United States, claimed attacks have risen faster than inside it. Employees in those countries were also taught that a clumsy, oddly worded email is a sign of fraud. That sign no longer works, because the email now reads like it came from a colleague.
Backups answer only half the threat
Classic ransomware locked a company's files and sold the key. A good backup beat that, because the company restored its files and refused to pay. Gangs responded by also stealing the files first and threatening to publish them. Newcomers have even less reason to bother with the locking, which needs different code for Windows and Linux servers and is the noisy part that security software catches. The number of attacks that involve locking files may fall in 2026 even as the total climbs.
Picture a 40-person freight company in Poland. A convincing supplier email, in perfect Polish, gets the accounts clerk to type her password into a fake page. The attacker downloads three years of customer contracts and payroll from her mailbox and shared folders, then emails the owner a list of what was taken and a deadline. Nothing is locked, so the backups have nothing to restore. The owner is negotiating over a leak, and the leak is about customers and staff, not the company's own uptime.
So the useful question is no longer "can we recover?" but "what could one stolen login download?" Take the account of someone in accounts or HR, list what it can reach, and archive or delete what nobody has opened in two years. Data that is not there cannot be published.