2,252 Victims, One Common Requirement
ReliaQuest’s Q2 2026 ransomware report documents 2,252 victim organizations across 90 ransomware groups and 99 countries. The Gentlemen claimed the top spot with 300 victims, powered by an affiliate kit that includes custom EDR killers, Group Policy Object-based deployment, and SMB encryption tools. Deadlock emerged from 11 months of silence with blockchain-hosted command and control and kernel-level EDR termination that disables endpoint security before encryption begins.
The report correctly emphasizes that defenders should focus on attacker behaviors rather than tracking which group sits at the top of the leaderboard. But there’s one behavior that precedes everything else described in this report: writing the malware payload to disk.
Before The Gentlemen’s custom EDR killer can terminate your endpoint security, it has to land on the file system. Before Deadlock’s malware can exploit a vulnerable driver to disable defenses, the malware binary has to be written to disk. Before any ransomware can encrypt files via SMB or deploy domain-wide via Group Policy, the encryptor executable has to exist on the target machine.
Every ransomware attack — regardless of group, technique, or sophistication — requires this step. It’s the most upstream intervention point in the entire attack chain.
Signature-Based Detection Loses the Race
The report notes that The Gentlemen’s operation includes AI-accelerated tool development that “lets the program refresh affiliate tools on a timescale that competing operations built around human developers can’t match.” This isn’t just a competitive advantage for ransomware operators — it’s a fundamental problem for signature-based security tools.
Traditional antivirus and EDR platforms detect threats by recognizing patterns they’ve seen before. A security researcher analyzes a new variant, creates a signature, pushes an update, and your endpoint learns to block it. That process takes time — hours or days. AI-accelerated malware development compresses the attacker’s build cycle to the point where signature-based detection can’t keep pace.
Deadlock’s kernel-level EDR termination makes this worse. Even if your endpoint security has the signature, the malware disables it before encryption begins. You lose the telemetry you need to detect and respond.
FileSure doesn’t play that game. It doesn’t try to recognize ransomware. It operates at the Windows kernel level and intercepts file write operations before they complete. You define which programs are authorized to write executable files to your systems. Everything else is blocked — including threats nobody has seen before, threats that refresh faster than signature databases can update, and threats specifically designed to kill your EDR before you know they’re there.
A Specific FileSure Rule That Applies
Here’s a kernel-level file operation rule that would have prevented the initial payload delivery for every attack described in this report:
File name filter: *.exe, *.dll, *.sys
Operations: Write, Create
Drive type: Hard drives, Network drives
Authorized programs: Your software deployment tools, Windows Update, approved installers
Result: Block and alert
When an unauthorized program — a phishing email attachment handler, a browser download, an exploit delivered via a compromised edge device — attempts to write an executable file, the operation is blocked at the kernel level before it completes. The malware payload never lands on disk. The EDR killer never runs. The encryptor never executes. The lateral movement tools never deploy via SMB.
The attack stops at the earliest possible intervention point, before any of the sophisticated evasion techniques described in the report become relevant.
Why This Matters More Than the Leaderboard
The Q2 2026 report documents significant shifts in ransomware group hierarchy: Qilin dropped 29%, DragonForce fell 58%, Coinbase Cartel collapsed 91%. Those changes matter for threat intelligence, but they don’t change the fundamental mechanics of how ransomware works on Windows systems.
Professional, scientific, and technical services led sector targeting for the fifth consecutive quarter. The US absorbed 49% of victim activity. India and Thailand maintained elevated totals. These patterns held steady even as the top groups reshuffled.
The technique that drives all of this — writing malware to disk — also held steady. It’s not going away. AI-accelerated tool development will make variants appear faster. Kernel-level evasion techniques will spread to more groups. Blockchain-hosted C2 infrastructure will become more common.
None of that changes the fact that the malware has to land on your file system before any of it matters.
FileSure gives you a control at that layer. It works on legacy Windows systems that modern endpoint security won’t touch. It works offline when your management server is unreachable. It works on zero-day variants that no signature database has seen. It works when the attacker’s EDR killer has disabled everything else.
Start your free 21-day trial at bystorm.com and test it against the threats described in this report.
Source: Ransomware and Cyber Extortion in Q2 2026
Category: Ransomware
Tags: ransomware, the gentlemen, deadlock, kernel filter driver, file system security, edr evasion, smb encryption, zero-day prevention
