Shutting down endpoint detection and response (EDR) tools before encryption begins has become standard operating procedure across the ransomware ecosystem, analysis of attacks by researchers at Halcyon has warned.
The practice, sometimes called EDR-kill, was once considered a specialist capability. It has now become standard practice among leading ransomware groups, giving defenders even less time to detect and contain attacks, said Halcyon in its Q2 2026 Ransomware Evolution Report, published on July 27.
Moreover, some of these leading ransomware groups are now including an EDR or antivirus shutdown into their attack chain.
This is the case with The Gentlemen, a group which has recently emerged and become one of the most prolific ransomware threats, which Halcyon has analyzed in detail.
In a previous threat assessment document, the company’s Ransomware Research Center shared that The Gentlemen’s developers are systematically reverse-engineering samples from other groups, such as Babuk, Qilin, LockBit 5.0 and Medusa, to select the strongest encryption routines, code-obfuscation techniques and EDR evasion methods to incorporate into their own codebase.
Ransomware Attacks Decline, But Threats Grow More Sophisticated
Halcyon's ransomware report recorded 1988 publicly claimed ransomware attacks from 89 active groups targeting organizations across 101 countries during the second quarter of 2026.
While overall number of claimed attacks fell by 5.7% quarter on quarter, the underlying tactics used by attackers became significantly more advanced, “signalling a shift towards faster, more automated and harder-to-detect operations,” the company said.
The leading ransomware groups were Qilin (293 attack claims), The Gentlemen (214 attack claims, DragonForce (143 attack claims), Akira (119 attack claims) and Lockbit 5.0 (102 attack claims).
DragonForce and LockBit 5.0 showed an activity uptake in the second quarter of 2026, while The Gentlemen overtook Qilin for the top spot in June.
Halcyon also identified several emerging – or for some, returning – ransomware groups, including KryBit, Payload, PEAR and World Leaks.
Manufacturing was the industry most targeted by ransomware groups in Q2 2026, representing 19.8% of all cyber extortion attacks. Construction took the second place, followed by business services, retail and software.
Vulnerabilities in enterprise edge devices, such as in Citrix NetScaler ADC and Gateway (CVE-2025-5777), SonicWall SSL VPN (CVE-2024-40766) and Fortinet’s FortiOS (CVE-2024-55591) were among the most exploited by ransomware groups during the reported period.
The report noted groups like DragonForce and Akira moved from initial breach to ransomware deployment in under an hour in some attacks.
Ransomware Groups Operationalize AI
The Halcyon report found that for ransomware operations, AI is moving beyond experimentation into operational use.
“Threat actors increasingly leveraged AI throughout the attack chain, from malware disguised as AI productivity tools to AI-assisted victim negotiations and the emergence of what researchers believe to be the first agentic ransomware capable of autonomously conducting key stages of an intrusion,” the Halcyon analysts wrote.
For instance, Halcyon reported increased instances of the LLM-developed EvilAI masquerading as fake AI-productivity apps while secretly providing ransomware actors initial access.
Ross Asquith, solutions engineering director for Europe at Halcyon, said the democratization of EDR-kill techniques and the generalization of the use of AI in ransomware attack chains show that the “ransomware ecosystem is becoming faster, more automated and far more effective at neutralizing the security tools organizations rely on.”
This, he added, should prompt cyber defenders to focus on cyber resilience and “no longer assume traditional controls will buy them the time they need to respond.”
Finally, the report highlighted growing evidence of ransomware being used to support state objectives, with Iran-linked actors increasingly disguising espionage campaigns as criminal ransomware operations.