Ransomware Activity — June 2026

Top 10 Briefing Points

1. 1

   The Gentlemen moved to the top of Check Point's June ranking — Check Point attributed 17% of published attacks in its June dataset to The Gentlemen, ahead of Qilin at 11%; these are data-leak-site disclosures, not confirmed incident totals.[1]

2. 2

   Publicly visible ransomware activity increased — BlackFog counted 102 publicly disclosed attacks across 21 countries and 31 groups in June, while explicitly separating public disclosure from unverified actor attribution.[2]

3. 3

   Healthcare, services, and education remained prominent — BlackFog's June dataset recorded healthcare as its leading sector, followed by services and education, supporting continued scoping attention for sensitive-data and operational-disruption exposure.[2]

4. 4

   Dataset definitions cannot be combined into one victim count — Check Point reports published attacks, while BlackFog mixes public disclosures and qualified claims. Use each source for direction within its own methodology rather than adding the totals together.[1][2]

5. 5

   RaaS leadership can shift quickly — The Gentlemen's rise from a mid-2025 entrant to a leading published-activity position shows how affiliate movement and access inventory can change the operating landscape within months.[1][3]

6. 6

   Edge access and valid credentials remain briefing priorities — Research into The Gentlemen describes access through unpatched edge devices and purchased credentials, including FortiGate exposure, making edge logs and identity evidence central to early scoping.[3]

7. 7

   Cross-platform impact should be assumed during scoping — The Gentlemen maintains Windows, Linux, and VMware ESXi capability, so responders should include virtualization and backup infrastructure rather than limiting collection to Windows endpoints.[1][3]

8. 8

   Pre-encryption behavior remains detectable — ReliaQuest observed LeakNet using ClickFix, a Deno in-memory loader, DLL side-loading, PsExec lateral movement, and S3 staging before ransomware deployment.[4]

9. 9

   One compromise can create downstream client risk — Check Point documented The Gentlemen using information stolen from a service provider to support a later attack against the provider's client, reinforcing third-party scoping obligations.[3]

10. 10

    The practical response window begins before encryption — Prioritize edge authentication, credential misuse, lateral administration, data staging, security-control tampering, virtualization, and backup evidence as soon as ransomware is suspected.[3][4]