GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: Top Takeaways

GuidePoint's Q3 2026 Ransomware and Cyber Threat Insights Report details a significant escalation in the threat landscape, tracking 2,760 victims claimed by 112 threat actors across 29 industries in 115 countries. Victim counts surged 75.3% year-over-year compared to Q3 2025, alongside a 47.4% growth in active threat actors and expansion into 25 new countries.
A notable development is the growing influence of Artificial Intelligence in intrusion, where AI agents are demonstrated to operate autonomously in the intrusion phase, achieving remote code execution against victims rapidly. Furthermore, data extortion has manifested through specific actors like ShinyHunters, who focus on bulk data theft rather than encryption, averaging significant payments per victim.
The report also indicates shifts in ransomware payment dynamics, showing a drop in the overall payment rate but an increase in the average amount paid by those who do pay. The compounding effect of these threats highlights that while specific campaign yields may decline, the reputational risk associated with data extortion and evolving actor capabilities presents a persistent and escalating challenge for organizations.

* 2,760 victims were claimed in Q3 2026 by 112 distinct threat actors across 29 industries and 115 countries.
* Victim counts increased by 75.3% year-over-year, rising from 1,574 in Q3 2025.
* The number of active threat actors grew by 47.4%, up from 76.
* Targeting expanded to 25 additional countries, representing a 27.8% increase.
* The Gentlemen and Qilin groups accounted for approximately one in four victims collectively in Q3 2026.
* One AI agent actor achieved remote code execution against a real victim in under four hours.
* ShinyHunters tracked payments averaging approximately $600,000 per victim in 2026, with over $8 million USD observed across attributed Bitcoin wallets since Q3 2026 began.
* Clop has not been able to recreate previous mass exploitation campaign success regarding the PTC Windchill campaign.
* ShinyHunters claimed an attack against Instructure in May 2026, and six other education-technology platforms were tracked subsequently.
* The rate of ransomware payment dropped from 50% to just under 21% in Q3.
* The average ransomware payment rose by 34%, from $240,000 to $321,000.
* Microsoft's Patch Tuesday in September 2026 recorded 978 CVEs.
* 86% of disclosed vulnerabilities in 2024 fell into lower-risk classifications, and 83% through 2026 to date has fallen into lower-risk classifications.

The narrative presented reveals a shift from volume-based disruption to speed-based compromise, fundamentally redefined by the integration of autonomous intelligence. The dynamic where AI orchestrates intrusion phases—achieving remote code execution in minutes across multiple targets—suggests that technical defenses focused solely on perimeter security or static vulnerability lists are insufficient. This implies that resilience is less about patching known flaws and more about engineering systemic velocity across identity management, patch deployment, and automated response mechanisms.
The conflict between the financial reality of large-scale campaigns and the credibility risk associated with data extortion actors like ShinyHunters points toward a tension in threat credibility: the value may shift from direct monetary gain to reputational damage and control over future operational spaces. The observation that even successful groups like Clop face potential obsolescence based on evolving dispute dynamics suggests that structural evolution—rebranding or tactical shifts—is as critical as technical mitigation.
The central pattern here is that the underlying principles of defense—patch velocity, identity hygiene, and response automation—remain constant, yet the acceleration provided by AI amplifies the consequence of failure exponentially. The core challenge is bridging the gap between defensive fundamentals (the "what") and operational speed (the "how fast"). If defenders focus on incremental control improvements while actors leverage faster means, a persistent asymmetry emerges that favors rapid exploitation over slow remediation. What assumptions about human response capacity are being exploited when threat velocity increases this dramatically?