Loading story…
Ransomware monitoring sources recorded a surge of victim claims led by Qilin, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included Cafar, Droguería Martorani, AK Preparedness, Armara, Sicc, KLD Labs, St Martha Catholic Church, Salina Supply, The Nueva School, City Ambulance Service, Famesa, Associated Theatrical Contractors, Don Tortaco Mexican Grill, Eana, PP+K, Synergy Products, and Bolt & Nut Manufacturing. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign.
Other groups also continued to post new victims. Incransom claimed attacks on v-silicon.com in Taiwan, Reatile Group in South Africa, Vedan Corp in Vietnam, and V&P Nurseries in the United States; DragonForce claimed NewNet S.A. in Colombia and separately threatened Switzerland's Ifage with publication of 850 GB of allegedly stolen data after an earlier intrusion; Krybit listed Euroins Insurance Company AD in Bulgaria; and Akira claimed McKeever, Varga & Senko in the United States, alleging theft of 12 GB of corporate and personal data. A weekly ransomware trend report based on eCrime.ch data counted 187 claims for the period, down from 233 the prior week, but still identified Qilin as the most active group with 33 claims, ahead of DragonForce with 27.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
29 events from the most recent confirmed update back to the earliest known activity.
Postres Reina in Spain was identified as a victim of a ransomware attack attributed to Qilin. The incident was discovered on July 21, 2026 at 07:04 UTC and was described as a data breach affecting the food production company.
In the McKeever, Varga & Senko case, Akira claimed it would soon upload 12 GB of stolen corporate data. The threatened leak allegedly included client internal data, employee personal information, contracts, agreements, confidential files, and NDAs.
McKeever, Varga & Senko in the United States was identified as a victim of a ransomware incident attributed to Akira. The incident was reportedly discovered later the same day at 13:53 UTC.
Bolt & Nut Manufacturing in Great Britain was identified as a victim of a Qilin ransomware attack. The breach was listed at 09:40 UTC on July 20, 2026 and discovery at 09:41 UTC.
Roughly three months after the mid-April intrusion, DragonForce claimed responsibility for the Ifage incident. The group said it had stolen 850 GB of files, issued a ransom demand, and threatened to publish the exfiltrated data.
ICT Journal reported that the Fondation genevoise pour la formation des adultes (Ifage) in Geneva suffered a cyber intrusion in mid-April 2026. The incident involved exfiltration of personnel-related data.
PP+K in Brazil was identified as a victim of a ransomware attack attributed to Qilin. The breach and discovery were both listed at 18:10 UTC on July 19, 2026.
Eana in Argentina was reported as a victim of a Qilin ransomware attack. The breach was listed at 18:09 UTC on July 19, 2026 and discovery at 18:10 UTC.
Synergy Products in Turkey was reported as a victim of a ransomware attack attributed to Qilin. The incident was discovered on July 19, 2026 shortly after the reported breach time.
Don Tortaco Mexican Grill in the United States was identified as a victim of a ransomware attack attributed to Qilin. The breach was dated July 19, 2026 and discovery was recorded one minute later.
Associated Theatrical Contractors in the United States was reported as a victim of a Qilin ransomware attack. The breach was dated July 19, 2026 at 16:03 UTC and discovered at 16:04 UTC.
City Ambulance Service, a U.S. healthcare organization, was reported as a victim of a Qilin ransomware attack. The incident was identified on July 19, 2026 at 09:06 UTC.
Famesa in Peru was identified as a victim of a ransomware attack attributed to Qilin. The incident was discovered on July 19, 2026 at 09:05 UTC.
Euroins Insurance Company AD in Bulgaria was reported as a victim of a ransomware attack attributed to Krybit. The incident was discovered on July 18, 2026 at 16:26 UTC.
Salina Supply in the United States was identified as a victim of a Qilin ransomware attack. The breach occurred on July 18, 2026 at 13:35 UTC and was discovered at 13:36 UTC.
St Martha Catholic Church in the United States was identified as a victim of a ransomware attack attributed to Qilin. The breach was listed at 13:34 UTC on July 18, 2026 and discovery at 13:35 UTC.
The Nueva School in the United States was reported as a victim of a Qilin ransomware attack. The breach was listed at 13:33 UTC on July 18, 2026 and discovery at 13:34 UTC.
NewNet S.A. in Colombia was reported as a victim of a ransomware attack attributed to DragonForce. The incident was discovered on July 18, 2026, shortly after the reported breach time the same day.
KLD Labs, a U.S. technology organization, was reported as a victim of a Qilin ransomware attack. The breach was discovered on July 18, 2026 at 11:38 UTC.
Sicc in Italy was reported as suffering a ransomware attack attributed to Qilin. The breach and discovery were both listed at 11:39 UTC on July 18, 2026.
Armara in France was identified as a victim of a Qilin ransomware attack. The associated data breach was discovered on July 18, 2026 at 11:37 UTC.
AK Preparedness in the United States was reported as a victim of a ransomware attack attributed to Qilin. The breach was discovered on July 18, 2026 at 10:38 UTC.
Arizona-based V&P Nurseries was reported as a victim of an Incransom ransomware attack. The breach was listed at 01:32 UTC on July 18, 2026 and discovery at 02:00 UTC.
Vedan Corp in Vietnam was reported as a victim of Incransom. The breach was listed at 01:27 UTC on July 18, 2026 and discovery at 02:02 UTC.
South Africa's Reatile Group was reported as a victim of an Incransom ransomware attack. The breach time was listed as 01:30 UTC on July 18, 2026 and discovery at 02:00 UTC.
v-silicon.com, identified as 威视芯半导体(合肥)有限公司 serving smart display and visual technology markets, was reported as a victim of Incransom. The breach was listed at 01:22 UTC on July 18, 2026 and discovery at 02:03 UTC.
Droguería Martorani in Argentina was reported as a victim of a Qilin ransomware attack. The breach was listed at 00:05 UTC on July 18, 2026 and discovery at 00:06 UTC.
Cafar in Argentina was identified as a victim of a ransomware attack attributed to Qilin. The breach and discovery were both listed at 2026-07-17 16:57 UTC.
A CyberVeille weekly report covering 13 July to 19 July 2026, based on eCrime.ch data, reported 187 ransomware attack claims worldwide, down from 233 in week 28. It identified Qilin as the most active group with 33 claims, followed by DragonForce with 27 and Gentlemen with 23.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
28 references tracked. Mallory keeps watching after this page renders.
hookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcecyberveille.ch
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcecyberveille.ch
Open sourceecrime.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Qilin ransomware group has emerged as one of the most prolific ransomware operations, claiming responsibility for over 500 attacks in the past six months and targeting major organizations worldwide. Notably, Qilin has allegedly stolen 10 GB of data from International Game Technology (IGT), a multinational provider in the gaming and fintech sectors, with over 21,000 files reportedly exfiltrated. The group has also targeted other high-profile victims, including Cornerstone Staffing Solutions, Spark Power, and Habib Bank AG Zurich, and is known to collaborate with other ransomware operations such as DragonForce and LockBit. Qilin, along with Akira and INC, accounted for 65% of ransomware attacks in Q3 2025, with a significant portion of these incidents facilitated by compromised VPN credentials. Ransomware activity has seen a marked increase globally, with leak posts rising by 11% over the previous quarter and a surge in attacks reported in October. Attackers are increasingly exploiting vulnerabilities in VPNs and external services, and the prevalence of zero-day vulnerabilities has also grown, with notable bugs affecting Citrix NetScaler, CrushFTP, and Microsoft SharePoint. Security experts recommend organizations implement multi-factor authentication and strengthen vulnerability management practices to mitigate the escalating ransomware threat landscape.
Jun 29, 2026
Ransomware and cyber-extortion activity rose again in Q2 2026, with industry reporting showing more than 2,250 publicly named victims across roughly 90 active groups and nearly 100 countries. GuidePoint Security’s GRIT report counted 2,279 victims, up 7% from the prior quarter and 43% year over year, while ReliaQuest recorded 2,252 victims and found the United States accounted for about 49% of observed activity. **Qilin** remained a leading force in one dataset for a fifth straight quarter, while **The Gentlemen** surged into the top tier and was ranked the most active group by ReliaQuest; **DragonForce** also remained prominent despite reported declines in some rankings. Professional, scientific, and technical services stayed the most targeted sector, and researchers noted a broader shift toward **data-only extortion** and continued pressure on organizations through public leak-site exposure. Researchers also highlighted technical changes in attacker tradecraft rather than a wholesale change in ransomware operations. The quarter saw increased use of **AI and LLMs** by threat actors, including analysis of exfiltrated databases and more tailored extortion messaging, alongside continued exploitation of high-impact vulnerabilities such as `CVE-2026-50751`, `CVE-2026-48027`, `CVE-2026-46817`, and `CVE-2026-35273`. ReliaQuest identified **Deadlock** as a notable re-emerging threat after 11 months of silence, using blockchain-hosted command-and-control through a Polygon smart contract and a **BYOVD** technique to terminate EDR tools via `CVE-2024-51324`. The reports say supply-chain compromise, remote access abuse, identity attacks, lateral movement, and defense evasion remain central to ransomware operations even as payment rates decline.
Jul 21, 2026
The Qilin ransomware gang has claimed responsibility for significant cyberattacks against major North American organizations, including Canadian electrical services provider Spark Power and U.S.-based recruitment firm Cornerstone Staffing Solutions. In the Spark Power incident, Qilin alleges the theft of 222 GB of data, potentially including operational files, financial records, and employee personal information, with researchers warning of possible operational disruptions if systems are locked. For Cornerstone Staffing Solutions, Qilin claims to have exfiltrated 300 GB of sensitive data, including nearly 1 million files with resumes, personal records, Social Security numbers, and internal financial documents, with sample files leaked to substantiate the breach. Qilin has emerged as one of the most prolific ransomware operations, reportedly targeting nearly 1,000 organizations since 2023 and over 500 in the past six months alone. The group’s attacks have resulted in the exposure of sensitive employee and business data, raising concerns about the operational and reputational impact on affected organizations. These incidents highlight the ongoing threat posed by ransomware groups to critical infrastructure and service providers across North America.
Jun 29, 2026