Nearly Half of March Ransomware Attacks in Tied to Just 3 Groups

Why It Matters

The concentration of ransomware activity among a few gangs amplifies risk for high‑value targets, especially in the United States, and forces enterprises to prioritize advanced threat detection and response.

Key Takeaways

• Qilin responsible for 20% of March ransomware attacks.
• Akira contributed 12% of incidents, targeting manufacturing and business services.
• Dragonforce RaaS made up 8% and expanded via social‑engineering.
• U.S. entities comprised 52% of reported ransomware victims.
• Attackers refine timing, targeting seasonal cycles and emerging technologies.

Pulse Analysis

The March 2026 ransomware landscape reveals a troubling consolidation of threat actors, with three groups—Qilin, Akira and Dragonforce RaaS—accounting for almost half of all reported incidents. This concentration suggests that cyber‑criminals are optimizing their operations, leveraging shared tools and affiliate networks to maximize profit while minimizing exposure. Check Point’s data underscores how ransomware gangs have matured, moving beyond opportunistic attacks to precise, timed campaigns that align with business cycles and the rollout of new technologies.

For U.S. firms, the stakes are especially high. Over half of the compromised entities were American, reflecting both the size of the market and the attractiveness of its critical infrastructure. Akira’s focus on industrial manufacturing and business‑services sectors, combined with its targeting of ESXi, Windows and Linux environments, highlights a shift toward high‑value, operational technology targets. Meanwhile, Dragonforce’s surge, driven by aggressive social‑engineering and the integration of RansomHub affiliates, illustrates the growing potency of ransomware‑as‑a‑service (RaaS) platforms that lower the entry barrier for less‑skilled actors.

Looking ahead, the trend of refined timing and seasonal exploitation is likely to intensify as attackers synchronize assaults with fiscal year‑ends, supply‑chain peaks, and major software releases. Organizations must therefore adopt a layered defense strategy: continuous threat hunting, rapid patch management, and employee awareness programs that counter social‑engineering lures. Investing in endpoint detection and response (EDR) solutions, coupled with robust backup and recovery protocols, will be essential to mitigate the financial and reputational fallout of a ransomware breach.