Loading story…
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. DragonForce claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while Qilin was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, nova to Italian ICT provider SistNet, Akira to digital marketing firm Emerge2 Digital, and incransom to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records.
Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the United States had the highest incident volume, and Qilin, Dire Wolf, and World Leaks were the most active groups by leak-site postings; it also noted LockBit 5.0 had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found 148 confirmed ransomware claims against organizations in the first half of 2026, with manufacturing the top target and LockBit5 and Qilin the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
A semi-annual RedACT tracker by ransomNews recorded 148 confirmed ransomware claims against Italian organizations in the first half of 2026. Manufacturing was the most targeted sector, and LockBit5 and Qilin were the most active groups with 21 claimed Italian victims each.
Universitatea de Vest „Vasile Goldiș” din Arad in Romania was reported as the victim of a ransomware attack attributed to Qilin. The incident was described as a data breach affecting an education-sector organization.
Syntron Bioresearch, a U.S.-based manufacturer of rapid diagnostic tests, was reported as the victim of a ransomware attack attributed to DragonForce. The incident was identified as a data breach affecting a healthcare-sector organization.
Deluxe Medical Supply, a U.S.-based healthcare supply distributor, was identified as the victim of a ransomware attack attributed to DragonForce. The report states the breach occurred on July 26, 2026 and affected the organization associated with deluxemedical.com.
Health Law Advocates, a Boston-based nonprofit public interest law firm, was identified as the victim of a ransomware incident attributed to Incransom. The breach was dated July 25, 2026, affecting an organization in the professional services sector.
SistNet, an Italy-based ICT organization and division of Sistemi Tre s.r.l., was identified as the victim of a ransomware attack attributed to Nova. The reporting said stolen data was involved and that Nova offered a file tree, data samples, and a decrypt sample if contacted.
Emerge2 Digital, a U.S.-based digital marketing company, was identified as the victim of a ransomware incident attributed to Akira. The threat actor claimed it would publish 30 GB of stolen corporate data including employee, client, financial, and contract records.
ASEC noted that LockBit 5.0 changed from fixed TOR leak domains to victim-specific non-fixed domains and private torrent distribution, marking a tactical change in how the group publishes stolen data.
ASEC reported that ransomware activity observed in June 2026 heavily affected manufacturing, with the United States seeing the highest number of incidents. Qilin, Dire Wolf, and World Leaks were identified as the most active groups based largely on leak-site postings.
The ASEC report describes an ICARUS supply-chain intrusion in which exposed Klue credentials were used to obtain OAuth tokens and exfiltrate Salesforce CRM data affecting multiple organizations, including confirmed impacts in South Korea.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Jul 27, 2026
Italian organizations suffered **148 confirmed ransomware attacks** in the first half of 2026, with the **manufacturing sector** accounting for 59 victims and **Northwest Italy** representing 42.6% of affected organizations, according to the RedACT H1 2026 report. Threat actors claimed to have exfiltrated more than **13,400 GB** of data, though detailed volume disclosures were available in fewer than half of the incidents, underscoring both the scale of extortion activity and the limits of public reporting. The report found a fragmented ransomware landscape in which **30 different groups** claimed at least one victim, while **LockBit5** and **Qilin** were the most active, each naming 21 victims. A spike in June was driven in part by **Deadlock** and **Safepay**, and the most common intrusion paths were **reused credentials**, **unpatched public-facing systems**, and **exposed RDP**, indicating that many attacks relied on basic but persistent access weaknesses rather than sophisticated tradecraft.
Jul 31, 2026
Threat intelligence reporting describes **DragonForce** as a rapidly evolving ransomware operation that brands itself as a “cartel” and runs an affiliate service called *Ransombay*, offering customizable payload options and reportedly advertising an **80% revenue split** to attract pentesters and initial access brokers. Researchers assess DragonForce’s tooling as heavily derived from **LockBit 3.0** and **Conti**, and report signs of consolidation behavior, including infrastructure/code overlap with groups such as **BlackLock**, **RansomHub**, and **LockBit**; one cited incident involved DragonForce abusing a rival’s misconfiguration and a **Local File Inclusion (LFI)** weakness to obtain information including credentials, followed by defacement of the rival’s leak site. Separate industry reporting indicates ransomware victimization continued to rise sharply in 2025, with GuidePoint Security tracking a **58% year-over-year increase** and **7,515 claimed victims** across leak sites, alongside a more **fragmented** landscape (124 named groups, up 46% from 2024). The same reporting highlights concentration of victimization in the **United States (55%)** and heavy targeting of **manufacturing**, with healthcare also significantly impacted (500+ victims) and **Qilin** described as the most prolific RaaS group in 2025 with disproportionate healthcare targeting—context that aligns with the broader trend of many smaller, high-volume groups rather than a few dominant actors.
Jun 29, 2026