Loading story…
Italian organizations suffered 148 confirmed ransomware attacks in the first half of 2026, with the manufacturing sector accounting for 59 victims and Northwest Italy representing 42.6% of affected organizations, according to the RedACT H1 2026 report. Threat actors claimed to have exfiltrated more than 13,400 GB of data, though detailed volume disclosures were available in fewer than half of the incidents, underscoring both the scale of extortion activity and the limits of public reporting.
The report found a fragmented ransomware landscape in which 30 different groups claimed at least one victim, while LockBit5 and Qilin were the most active, each naming 21 victims. A spike in June was driven in part by Deadlock and Safepay, and the most common intrusion paths were reused credentials, unpatched public-facing systems, and exposed RDP, indicating that many attacks relied on basic but persistent access weaknesses rather than sophisticated tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The report identified a significant increase in ransomware claims during June 2026. It attributed the spike in part to concentrated activity by the Deadlock and Safepay groups.
The RedACT H1 2026 findings said LockBit5 saw a surge in activity in March 2026, aligning with broader global trends. LockBit5 was later identified as one of the most active ransomware groups targeting Italy during the period.
The RedACT H1 2026 report found 148 confirmed ransomware attacks against Italian organizations in the first half of 2026, averaging nearly six claims per week. Manufacturing was the most targeted sector and Northwest Italy the most affected region.
ransomNews.online published the first RedACT H1 2026 report analyzing ransomware activity targeting Italy. The report was described as an independent effort based on collection, verification, and analysis of the ransomware ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026
Dragos reported that ransomware incidents affecting industrial organizations rose to **1,140 publicly disclosed or leak-site-listed cases in Q2 2026**, up 12% from the prior quarter, with **manufacturing** accounting for 747 incidents. **Qilin, Akira, and The Gentlemen** were identified as the most active groups, while North America and Europe were the hardest-hit regions and the United States remained the most affected country. The report said attackers increasingly relied on **data-theft-only extortion** and commonly gained access through internet-facing edge devices, compromised credentials, remote management tools, and **Microsoft Teams impersonation of IT support**. The findings show that ransomware gangs often disrupted production **without reaching industrial control systems**, instead causing outages through compromised enterprise IT, ERP, and virtualization environments that support OT operations. Dragos said it observed no Q2 case in which an operator reached **Stage 2 of the ICS Cyber Kill Chain**, yet real-world impacts still included production stoppages and precautionary shutdowns at **West Pharmaceutical Services, Foxconn, and Mackay Sugar**. Huntress separately highlighted **Akira** activity involving data exfiltration, reinforcing the broader shift away from encryption-only attacks and toward extortion based on stolen data.
Aug 13, 2026
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Jul 27, 2026