Global Ransomware Surge: 63 New Victims Reported in 24 Hours as 'The Gentlemen' and 'N0N' Lead Activity

Executive Summary

Encrygma threat data shows a significant escalation in global ransomware activity, with 63 new victim organizations published on leak sites within the last 24 hours. This surge is driven by a mix of established RaaS operators and aggressive new entrants, pushing the 2026 year-to-date total to 8,631 confirmed incidents.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, the current landscape is defined by high-velocity extortion cycles. The Encrygma Threat Severity Index (ETSI) for the current wave of attacks is rated at 8.5/10, reflecting the increased frequency of data exfiltration and the rapid emergence of new, highly active threat clusters like N0N.

Technical Details

Encrygma analysts observe that threat actors are increasingly leveraging automated reconnaissance and agentic workflows to identify vulnerabilities. Recent campaigns, such as the IAH6477 attack on Alera Group, demonstrate a focus on high-volume data theft, with 2.6 TiB of sensitive data currently held for ransom. Encrygma's AI Threat Taxonomy classifies these as 'High-Velocity Exfiltration' events, where attackers prioritize rapid data harvesting over traditional encryption-only models.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we categorize the current activity as 'High Confidence' for the top-tier groups. 'The Gentlemen' remains the most active operator with 137 listings in the last 30 days, while the newcomer 'N0N' has rapidly ascended to second place with 101 listings, indicating a highly organized and well-resourced operation.

Implications

Encrygma threat data shows that the shift toward double extortion—where data is stolen before encryption—has become the industry standard. The recent legal action against Zohar Pinhasi, who operated a fraudulent 'decryption' service, highlights the secondary risks victims face when engaging with unverified third-party recovery firms, often resulting in double-payment scenarios.

Recommendations

Encrygma recommends that organizations implement robust, immutable backup strategies and conduct regular threat hunting exercises. Based on the ETSI scoring, we advise immediate patching of known vulnerabilities in edge infrastructure, as Encrygma intelligence confirms these remain the primary entry vectors for the most active ransomware groups currently operating.