National CIO Review highlighted the Black Kite findings this week, and the vendor’s underlying study has also been covered by Dark Reading, Smart Industry, and SecurityBrief. The core figures are consistent across that reporting: ransomware activity accelerated materially late in the study period, 61 groups entered the market, and the number of active ransomware brands reached 146 by June 2026.
There is an important boundary around those numbers. Black Kite is counting organizations publicly identified through ransomware leak-site monitoring and validation, rather than every intrusion, encryption event, or extortion attempt. That makes the dataset useful for measuring criminals’ public naming-and-shaming activity, but it cannot establish the total volume of ransomware incidents. Organizations that pay, recover quietly, or are never posted to a leak site are absent. The trend is still alarming; the exact count should not be mistaken for a global incident census.
The second-half jump is more useful than the annual total
A 24.9% annual increase is severe, but annual totals can make a rapidly changing threat look smoother than it was. Black Kite’s data shows the first six months of the period averaged 484 disclosed victims per month, while October 2025 through March 2026 averaged 775. Every month in that latter stretch exceeded 700 disclosures.
That sustained increase changes planning assumptions. A brief spike might justify a narrow response to a mass-exploited vulnerability or a single affiliate campaign. Six months of higher volume argues for a broader operational problem: more access brokers, more ransomware-as-a-service affiliates, more extortion crews, and more organizations with reachable entry points.
Dark Reading reported that Black Kite identified 7,551 known victims worldwide and described the surge as tied to fragmentation in the ransomware market rather than a single campaign. That fits a difficult reality for defenders: taking down, sanctioning, or disrupting one ransomware brand does not necessarily eliminate the people, credentials, initial-access channels, or affiliate networks behind it.
The report’s own turnover data reinforces the point. Newer groups had a median lifespan of 4.9 months, compared with 12.8 months for the preceding cohort. A ransomware name disappearing from leak sites can be a branding event, not a meaningful reduction in criminal capability.
More groups did not dilute the biggest operators
Black Kite found that active groups grew from 96 in the previous period to 127 by the close of March, then to 146 by June. Yet the top five groups still claimed 43.6% of victims in the firm’s dataset. Qilin alone claimed 1,358 victims, a reported 443% year-over-year increase.
This is the operationally awkward combination: a crowded long tail of fast-changing groups, alongside a handful of large operations with the volume and reputation to attract affiliates. Security teams cannot build a workable ransomware program around tracking gang logos, ransom-note aesthetics, or a static list of active names. Those indicators can help an incident responder attribute a campaign, but they are weak preventive controls.
The stronger defensive model focuses on the conditions that make a victim usable: exposed remote services, unpatched internet-facing systems, stolen credentials, permissive application consent, unmanaged service accounts, and vendor connections that cross trust boundaries. CISA’s #StopRansomware guidance makes the same distinction, advising organizations to inventory third-party and managed-service-provider access, apply least privilege, use phishing-resistant multifactor authentication, limit remote desktop exposure, and keep tested offline or cloud-to-cloud backups.
For Windows estates, this also means treating identity infrastructure as production infrastructure. An attacker with a valid privileged Entra ID account, a retained OAuth grant, access to an RMM platform, or a compromised VPN session may never need to exploit a Windows kernel flaw to create a crisis. They can use legitimate administration paths to reach servers, virtual machines, file shares, backups, and cloud data.
The middle market is becoming a larger target pool
The Black Kite analysis also shows a shift in the revenue bands of identified victims. Companies with $50 million to $100 million in revenue rose from 25.1% to 29.3% of known-revenue victims. The $1 million to $5 million segment rose from 3.0% to 5.1%, while the $100 million-plus tier fell from 13.9% to 9.5%.
This does not mean large enterprises have become safe, nor does it prove attackers have abandoned them. Leak-site data captures what gangs choose to publish, and revenue information is not available for every victim. But the direction is consistent with a market in which smaller operations can buy access, rent malware infrastructure, use negotiation services, and automate reconnaissance without developing each capability in-house.
Black Kite argues that AI is lowering the cost of supporting work around ransomware—researching targets, generating phishing lures, writing scripts, translating messages, and scaling extortion communications—rather than being the sole reason ransomware counts increased. That is a more credible reading than the fashionable claim that AI “caused” ransomware’s rise. The report offers no evidence that autonomous AI exploitation drove the 2025–26 surge; it describes a criminal market becoming cheaper to operate at the margins.
For mid-sized organizations, the implication is blunt. Size no longer provides much protection through obscurity. A company with an outsourced help desk, a small security staff, exposed remote administration, Microsoft 365 identities, and a handful of broadly authorized SaaS applications can present a highly monetizable target even if it is not a household name.
Vendor access and OAuth grants are part of the perimeter
The most useful part of the report is its insistence that ransomware exposure extends through trusted technology relationships. Black Kite points to incidents involving SaaS integrations, enterprise applications, support platforms, and OAuth tokens, including the Salesloft Drift-related compromise that enabled access to Salesforce customer environments. It also cites Oracle E-Business Suite as an example of how a weakness in widely deployed enterprise software can create downstream exposure at scale.
The operational lesson is not simply “vet vendors better.” Annual questionnaires and contractual security clauses do not reveal which service accounts still have administrator rights, which OAuth applications possess broad mailbox or file permissions, which support tools can access endpoints, or which integration tokens persist after an employee, contractor, or vendor engagement changes.
CISA explicitly warns that third parties and managed service providers have served as ransomware infection vectors. Its guidance calls for least privilege and separation of duties for third-party access, with access limited to the systems a provider must actually operate. Many organizations still do the opposite in practice: standing accounts, broad tenancy permissions, permanent VPN access, and shared administration credentials remain common because they make support easier.
A mature review should cover both Windows and cloud control planes:
- Inventory every remote management, help-desk, backup, identity, and SaaS integration that can reach production systems or data.
- Remove dormant vendor accounts, replace shared credentials with named accounts, and require multifactor authentication for every external administrative path.
- Review enterprise application consent and OAuth permissions in Microsoft Entra ID, especially applications that can read mail, files, directories, or retain offline access.
- Constrain service accounts and application identities to the smallest feasible set of roles, subscriptions, sites, mailboxes, or APIs.
- Test whether backup administrators, backup repositories, and recovery credentials are reachable through the same identity plane an attacker could compromise.
The critical change is conceptual: a vendor connection should be classified by what it can do, not merely by the vendor’s reputation or the product category.
Recovery has to include exposure reduction
Black Kite says 68.1% of victims had observable misconfiguration findings before disclosure, 46.9% had exposed remote-access ports, 43.2% had software-vulnerability findings, and 34.5% had stealer-log findings. More than 60% had at least one ransomware-relevant finding involving a vulnerability, credential stuffing, or stealer logs.
These are external signals, not proof that each signal caused a specific breach. A public RDP port may be unrelated to an incident; a stealer-log record may be stale; a detected vulnerability may be inaccessible or already mitigated. But the figures identify the kind of exposure attackers can enumerate before a victim is publicly named. They also expose a recurring failure in post-incident work: restoring business services is often treated as the finish line.
Black Kite’s post-incident assessment found 43.5% of victims still had critical vulnerabilities, while stealer-log exposure was 175% higher in its before-and-after comparison. The latter metric needs careful interpretation. It does not prove the ransomware intrusion caused the stolen credentials; it does show that credential exposure remained visible or increased among victims after the event.
That is why a ransomware recovery plan must include a separate validation phase after containment and restoration. Microsoft’s ransomware incident-response playbook similarly emphasizes eradication and a post-incident review, rather than treating data restoration as the end of response. In a Windows environment, that review should include privileged Active Directory and Entra ID accounts, newly created accounts, conditional-access changes, remote-management agents, scheduled tasks, service accounts, OAuth grants, VPN access, backup controls, and endpoint persistence.
The Black Kite report does not prove that every disclosed victim was breached through a vendor, exposed port, or stolen credential. It does establish a more useful conclusion: the attack surface worth defending is broader than the endpoint fleet, and it can remain dangerous after an organization declares the incident over. The organizations that adjust fastest will be the ones measuring recovery by what attackers can still reach—not by whether the last encrypted server has been brought back online.