Cyber Threat
Intelligence Reports

Ransomware activity reached a year-to-date high in July 2026, while advances in AI-enabled attack capabilities, evolving cyber espionage infrastructure, and geopolitical developments continued to shape the threat landscape.

July 2026 key insights:

• 894 ransomware attacks were recorded globally in July, representing a 22% increase compared to June and the highest monthly total recorded in 2026 to date.
• Industrials remained the most targeted sector, accounting for 250 attacks (28%), followed by Consumer Discretionary with 165 (18%) and Information Technology with 103 (12%) attacks.
• North America remained the most targeted region, accounting for 365 attacks (41%), followed by Europe with 263 attacks (29%).
• The Gentlemen was the most active ransomware group in July, responsible for 138 attacks (15%), closely followed by Qilin with 127 attacks (14%).
• Security researchers documented JADEPUFFER, an autonomous AI-driven ransomware operator capable of independently progressing through multiple stages of the attack lifecycle with minimal human intervention.

Ransomware activity surged in July, while wider developments across the cyber threat landscape provided further insight into the evolving nature of cyber risk. The emergence of increasingly autonomous AI-enabled attacks and the growing use of shared relay infrastructure by state-aligned actors reflected a broader shift towards more scalable, resilient, and difficult-to-attribute activity. Together, these trends demonstrate how cyber operations are becoming more efficient, adaptive, and harder to detect, reinforcing the importance of proactive security strategies and resilient defences.