Between 2025 and mid-2026, the global cybersecurity landscape experienced a dramatic escalation in ransomware attacks, data breaches, and dark web marketplace activity. Allegedly, over 9,300 ransomware-related incidents occurred with 66 new cybercriminal groups emerging, while 164 public database breaches allegedly exposed over 600 million user records globally. The Qilin ransomware group allegedly became the most active threat actor with over 1,500 attributed attacks. Concurrently, dark web marketplaces proliferated with threat actors actively selling stolen credit card data, compromised credentials, and financial fraud services targeting victims across multiple continents. This represents a significant shift in the threat landscape characterized by increased attack sophistication, AI integration in cybercriminal operations, and the expansion of underground-as-a-service offerings. Organizations across all sectors face elevated risk from both ransomware extortion and financial fraud operations, requiring immediate attention to credential security, payment card data protection, and ransomware defense strategies.
- Alleged 9,300 ransomware incidents occurred in 2025-2026 with 66 new cybercriminal groups emerging; Qilin group allegedly responsible for over 1,500 attacks, making it the most active ransomware operation globally
- Alleged 164 public database breaches exposed over 600 million user records, with Latin America (33%), Middle East and Africa (29%) most impacted; Tajikistan allegedly suffered 217 million compromised records
- Multiple threat actors allegedly operating sophisticated carding shops selling stolen credit cards, CVV data, fullz information, and payment processing access across dark web marketplaces targeting US, UK, EU, Canada, Australia, and Asian countries
- Alleged sale of massive credential databases including 154K Japan/Asia email-password combinations and 105K mixed mailpass entries totaling 1.1TB with 33 billion records on underground marketplaces
- AI integration allegedly accelerating in cybercriminal operations with ChatGPT mentioned 108,000+ times on dark web forums; threat actors allegedly using AI chatbots for attack preparation and distributing malware disguised as AI tools
