Qilin Leads Global Ransomware Victim Claims Across Multiple Sectors
Threat Actor Intelligence · 57 sources · Updated 2mo ago · First seen Jul 20, 2026

Ransomware monitoring sources recorded a surge of victim claims led by Qilin, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included Cafar, Droguería Martorani, AK Preparedness, Armara, Sicc, KLD Labs, St Martha Catholic Church, Salina Supply, The Nueva School, City Ambulance Service, Famesa, Associated Theatrical Contractors, Don Tortaco Mexican Grill, Eana, PP+K, Synergy Products, and Bolt & Nut Manufacturing. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign.
Other groups also continued to post new victims. Incransom claimed attacks on v-silicon.com in Taiwan, Reatile Group in South Africa, Vedan Corp in Vietnam, and V&P Nurseries in the United States; DragonForce claimed NewNet S.A. in Colombia and separately threatened Switzerland's Ifage with publication of 850 GB of allegedly stolen data after an earlier intrusion; Krybit listed Euroins Insurance Company AD in Bulgaria; and Akira claimed McKeever, Varga & Senko in the United States, alleging theft of 12 GB of corporate and personal data. A weekly ransomware trend report based on eCrime.ch data counted 187 claims for the period, down from 233 the prior week, but still identified Qilin as the most active group with 33 claims, ahead of DragonForce with 27.


