Two independent Q2 2026 ransomware reports published three days apart agree the ecosystem is fragmenting without de-concentrating — and the industrial one carries a negative finding OT operators should plan against: no Q2 case reached control-system manipulation
Two quarterly ransomware reports landed three days apart this week, counting different populations from different vantage points, and arriving at compatible descriptions of the same structural shift. Taken together they are the closest thing to an outside check on what the operational entries of the last quarter have shown one incident at a time.
Dragos's Industrial Ransomware Analysis for Q2 2026 counts incidents affecting industrial organisations: "Dragos identified 1,140 ransomware incidents affecting industrial organizations in Q2 2026, an 12% increase over the 1,020 recorded in Q1," with manufacturing the most affected sector at 747 incidents or 65%, and engineering firms, system integrators and equipment manufacturers second at 117 — a distribution that puts the industrial supply chain, not the plant, at the centre. The regional detail is where it becomes a European planning input rather than a US one: the United States remains the most impacted country by a wide margin at 431 incidents or 38% of the total, but "the country with the greatest increase from Q1 (37 incidents) to Q2 (68 incidents) was Germany" (Dragos, 2026-08-10) — an eighty-four per cent rise in a neighbouring jurisdiction whose industrial base overlaps heavily with the Swiss one.
Check Point Research's State of Ransomware Q2 2026 counts leak-site victims across all sectors and describes the ecosystem's shape: "The top 10 groups accounted for 57.6% of all victims, down from 71% in Q1, while the number of active groups climbed from 71 to 93, a new high for the period tracked in this report," against a total of 2,139 victims that was essentially flat quarter over quarter and up 33% year over year. Qilin remained the most prolific operator for a fourth straight quarter with 279 victims despite its own count falling 17%, while The Gentlemen surged 62% to 269 and briefly outpaced it; the US share of victims fell from 50% to 42%, which Check Point attributes to the fastest-growing groups — The Gentlemen and the newly active Krybit — targeting the US less often than the ecosystem average (Check Point Research, 2026-08-13). That last point is the one European defenders should read twice: a falling US share in a flat total is not a reduction in activity, it is a redistribution toward everyone else. Check Point also records, independently of this pipeline's own observations this week, that "The exploitation window kept narrowing, with AI increasingly cited as the accelerant."
The single most consequential finding in either report is a negative one, and it belongs to Dragos: "Dragos observed no case in Q2 2026 in which a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system; where operational disruption occurred, it followed encryption or precautionary shutdown of the enterprise and virtualization systems on which OT depends."
Dragos identified 1,140 ransomware incidents affecting industrial organizations in Q2 2026, an 12% increase over the 1,020 recorded in Q1.
Dragos observed no case in Q2 2026 in which a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system; where operational disruption occurred, it followed encryption or precautionary shutdown of the enterprise and virtualization systems on which OT depends.
However, the country with the greatest increase from Q1 (37 incidents) to Q2 (68 incidents) was Germany.
The top 10 groups accounted for 57.6% of all victims, down from 71% in Q1, while the number of active groups climbed from 71 to 93, a new high for the period tracked in this report.
The exploitation window kept narrowing, with AI increasingly cited as the accelerant.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Exfiltration TA0010
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
Impact TA0040
T1486Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
T1490Inhibit System Recovery
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.