Loading story…
Ransomware activity remained at historically high levels as new reporting showed attackers increasingly gaining entry through phishing, malicious email, and compromised identities rather than software exploits. Sophos reported that malicious email accounted for 26% of ransomware intrusions, phishing for 24%, and compromised credentials for 23%, while exploitation of vulnerabilities fell to 18% from 32% in the prior survey. The findings indicate that identity compromise now sits at the center of ransomware operations, with nearly four in five attacks tied to compromised identities and 67% of organizations describing ransomware as their most serious identity-related incident.
Industry reporting also said claims of a ransomware slowdown are misleading. Check Point previously recorded a 126% year-over-year increase in public extortion cases in early 2025, while NCC Group counted 2,229 ransomware attacks in Q2 2026, a 3% rise from the prior quarter. Qilin remained the most active group for a fifth straight quarter, with The Gentlemen, Dragonforce, and KryBi also prominent. Researchers warned that attackers are bypassing MFA through adversary-in-the-middle phishing, stolen browser cookies, session tokens, and MFA fatigue, and urged organizations to strengthen identity defenses, patch internet-facing systems, secure VPNs and firewalls, and deploy phishing-resistant authentication and continuous monitoring.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Sophos' State of Ransomware 2026 report found that malicious email, phishing, and compromised credentials had overtaken software vulnerability exploitation as the leading initial access paths for ransomware. The report was based on responses from 2,158 IT and cybersecurity leaders across 17 countries whose organizations experienced ransomware in the prior year.
Coveware's Q2 2026 cyber extortion analysis said ransom payment rates fell to record lows, including a 15% payment rate in data-exfiltration-only cases, while the average payment rose to $1,880,612 and the median fell to $150,000. The report attributed some of the largest payments to Silent Ransom, also known as Luna Moth, whose social-engineering-led attacks targeted law firms.
Check Point published its Q1 2025 ransomware assessment, describing a record-breaking 126% year-over-year increase in public extortion cases. This marked a notable escalation in observed ransomware activity.
An unusually large Cl0P campaign mass-exploited the Cleo file transfer platform, creating a distortion in 2025 ransomware trendlines cited by later reporting. The event is referenced as a major campaign rather than a general background condition.
Q2 2026 reporting said Qilin was the most active ransomware group for the fifth consecutive quarter. The same reporting highlighted The Gentlemen, Dragonforce, and KryBi as other prominent actors, indicating a reshuffling among leading groups.
New Q2 2026 reporting from NCC Group recorded 2,229 ransomware attacks, which was described as a 3% increase from Q1 2026. The figures were cited as evidence that ransomware activity remained historically high.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
coveware.com
Open sourcezdnet.com
Open sourcecysecurity.news
Open sourceblog.checkpoint.com
Open sourceinsights.nccgroup.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that identity-focused intrusion methods have overtaken software exploitation as the leading root cause of ransomware incidents, marking a shift in how attackers gain access to victim environments. In its *State of Ransomware 2026* survey of 2,158 IT and cybersecurity leaders across 17 countries whose organizations were hit by ransomware in the past year, malicious email accounted for 26% of attacks, phishing for 24%, and compromised credentials for 23%, while vulnerability exploitation fell to 18% from 32% previously. The findings also showed that 67% of victims said their ransomware incident was the most significant identity attack they faced during the year, underscoring the overlap between ransomware and identity compromise. Sophos said the presence of MFA in 97% of credential-compromise cases indicates that MFA alone often failed to stop intrusions, likely due to incomplete deployment and evolving bypass techniques, and urged organizations to strengthen identity threat detection, credential auditing, segmentation, **ZTNA**, and continuous detection and response alongside patch management.
Jul 26, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026
**Credential compromise** and identity abuse are increasing as attackers rely more on stolen logins, session artifacts, and phishing rather than noisy exploitation alone. Recorded Future reported a sharp rise in exposed credentials during 2025, including nearly **2 billion** credentials indexed from malware combo lists, with the second half of the year up **50%** over the first and Q4 up **90%** over Q1. The trend is being driven by the industrialization of **infostealer malware**, malware-as-a-service ecosystems, and AI-enabled phishing and social engineering, while weak identity governance continues to expand the attack surface. A separate survey of UK organizations found **77%** fail to promptly disable former employees' accounts, **34%** grant overly broad access, and many still use manual processes such as spreadsheets for account validation, creating persistent opportunities for unauthorized access. A targeted phishing attempt against **Outpost24** illustrates how these identity-focused attacks are being operationalized against even security vendors. Attackers used a convincing fake JP Morgan email, valid **DKIM** authentication via Amazon SES infrastructure, and a **seven-stage redirect chain** leveraging trusted brands including Cisco to steer a C-suite executive toward a Microsoft Office credential-harvesting page while evading email defenses. The broader threat environment shows the same shift toward access abuse and stealthier post-compromise tradecraft: Google Threat Intelligence Group found ransomware actors increasingly favor native Windows tools over **Cobalt Strike**, with data theft present in **77%** of incidents and exploitation of VPNs and firewalls still common for initial access. Together, the reporting shows attackers are increasingly **logging in rather than breaking in**, then using legitimate access and built-in tools to deepen compromise and extort victims.
Jun 29, 2026