Americas Ransomware Trends H1 2026: Qilin, Akira, and Exploitation of Ivanti and Fortinet Infrastructure

In H1 2026, the Americas emerged as the global epicenter for ransomware, accounting for 57% of worldwide incidents (2,188 total). The landscape is transitioning to extortion-centric models, where actors prioritize exfiltrating high-leverage data—such as legal and patient records—over encryption. Technical indicators show significant integration of AI to accelerate Active Directory enumeration and malware generation, increasing operational "signal speed." Attackers are actively weaponizing vulnerabilities in edge infrastructure, specifically Ivanti, Fortinet, Cisco, SolarWinds, and Palo Alto Networks appliances. The market is bifurcated: North America features a hyper-competitive RaaS ecosystem led by Qilin and Akira, while South America is a consolidating market dominated by 'The Gentlemen.'

• Strategic Context: Regional Market Bifurcation

  • Americas dominance: Regional activity constitutes 57% of the global ransomware volume.
  • North American landscape: A mature, hyper-competitive RaaS marketplace focusing on downtime-sensitive sectors like construction and manufacturing.
  • South American landscape: A consolidating market characterized by high actor concentration, specifically under 'The Gentlemen.'

• Attack Vector: Infrastructure and Access Mechanics

  • Edge appliance exploitation: High-frequency targeting of Ivanti, Fortinet, Cisco, SolarWinds, and Palo Alto Networks devices.
  • Initial access methodology: Heavy reliance on Initial Access Brokers (IABs) to establish footholds for ransomware deployment.
  • Shift to extortion: Strategic pivot from system encryption to high-leverage data exfiltration to maximize pressure.

• Threat Group Profile: Scale and Specialization

  • Dominant North American actors: Qilin (410 incidents) and Akira (268 incidents) maintain the highest operational volume.
  • Sector specialization: INC Ransom focuses specifically on Professional Services, accounting for 171 incidents.
  • Mass-scale impact: Notable data exfiltration events, such as the Serasa Brazil breach impacting 250 million records.

• Technical TTPs: AI-Augmented Operations

  • AI-driven enumeration: Integration of AI to accelerate Active Directory enumeration and malware generation.
  • Signal speed optimization: Prioritizing rapid exploitation and movement over traditional stealth-based persistence.
  • Convergence risks: Exploitation of OT/IT convergence bridges and cross-border supply chain lateral movement within the USMCA context.

• Defensive Implications: Mitigation and Response

  • Vulnerability management: Immediate patching of edge infrastructure, utilizing CISA KEV catalog as a primary reference.
  • Exfiltration controls: Implementation of robust data loss prevention (DLP) to counter extortion-only attack models.
  • Mobile threat detection: Enhanced monitoring for Android banking trojans, specifically TCLBANKER and BTMOB RAT.