Loading story…
Recorded ransomware activity rose 22% month over month to 894 victim organizations in July, the highest monthly total reported in 2026. North America and Europe accounted for 70% of incidents, with the United States representing 41%; the industrial sector was the most targeted, accounting for 28% of reported attacks. Notable reported victims included EY, Fairlife, and Analog Devices, although some public claims have not been independently verified.
The Gentlemen was the most active named operation, responsible for 15% of recorded attacks, while Qilin was also among the leading groups. Newly observed group CRPxO claimed 36 victims but had not provided credible evidence supporting those claims, underscoring the limitations of leak-site metrics. Researchers also warned that AI-enabled capabilities, including the reportedly autonomous JADEPUFFER agent, could allow ransomware operators to accelerate and scale attacks.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Ernst & Young suffered a data leak involving client information and tax records in July 2026. ShinyHunters claimed responsibility for the attack.
The newly observed ransomware-as-a-service group CRPxO appeared in July 2026 and claimed compromises of 36 organizations, including Johnson & Johnson and Turkish Airlines. NCC Group found the supporting evidence inconsistent and assessed the group’s credibility as low to moderate.
NCC Group recorded 894 ransomware cases worldwide in July 2026, a 22% increase from June and the highest monthly volume of 2026 to that point. Industrials accounted for 28% of incidents, while North America and Europe represented 41% and 29% of reported activity, respectively.
NCC Group described JADEPUFFER as the first known fully autonomous, end-to-end AI-driven agent capable of infiltrating systems and carrying out attacks without human instruction. The assessment warned that such agents could accelerate intrusions from compromise through extortion.
ExfilSquad claimed it stole 570,000 records from Analog Devices, although the claim had not been verified.
Fairlife, a Coca-Cola subsidiary, reportedly suffered a ransomware attack attributed to Anubis. The group claimed it had stolen more than 1 TB of data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NCC Group recorded **1,073 organizations** worldwide as ransomware victims in August 2026, a 12% increase from 973 in July and the highest monthly total reported that year. North America represented 44% of known incidents, while industrial organizations were the most targeted sector, accounting for 31% of reported attacks. **Qilin** and **The Gentlemen** were the most frequently attributed groups, linked to 164 and 116 incidents respectively; reported victims included Boston Dynamics and Manchester Airport Group. The report also identified a growing reliance on data theft and extortion without file encryption, reinforcing the need for tested ransomware response plans and tabletop exercises.
Sep 23, 2026
Ransomware activity intensified in 2026 as the criminal ecosystem expanded to **146 active groups** by midyear, with **61 new groups** emerging and public victim counts rising sharply across multiple regions and sectors. Black Kite reported **7,551 victims** globally, a **55.1% year-over-year increase in Europe** during the first four months of the year, and continued dominance by a small number of operators despite broader fragmentation. **Qilin** remained the leading ransomware-as-a-service operation across much of the market, benefiting from the decline of rivals such as LockBit and ALPHV, while researchers said attackers frequently gained initial access by exploiting **critical vulnerabilities** with `CVSS >= 9` and, in some cases, through phishing and supply-chain compromise. At the same time, **The Gentlemen** emerged as one of the fastest-growing threats, especially against higher education. Comparitech counted **104 ransomware attacks** against the global education sector in the first half of 2026, with attacks increasingly concentrated on colleges and universities and the United States recording the most confirmed victims. ESET said The Gentlemen equipped affiliates with the **GentleKiller** framework, a bring-your-own-vulnerable-driver toolkit designed to disable endpoint defenses before encryption, targeting more than **400 processes** across roughly **48 security products**. The group was also linked to steep growth in university attacks, including a case at **Mount Royal University** involving a **$1.9 million** ransom demand, alleged theft of more than **10TB** of data, and destructive deletion of drives.
Aug 18, 2026
Ransomware and cyber-extortion activity rose again in Q2 2026, with industry reporting showing more than 2,250 publicly named victims across roughly 90 active groups and nearly 100 countries. GuidePoint Security’s GRIT report counted 2,279 victims, up 7% from the prior quarter and 43% year over year, while ReliaQuest recorded 2,252 victims and found the United States accounted for about 49% of observed activity. **Qilin** remained a leading force in one dataset for a fifth straight quarter, while **The Gentlemen** surged into the top tier and was ranked the most active group by ReliaQuest; **DragonForce** also remained prominent despite reported declines in some rankings. Professional, scientific, and technical services stayed the most targeted sector, and researchers noted a broader shift toward **data-only extortion** and continued pressure on organizations through public leak-site exposure. Researchers also highlighted technical changes in attacker tradecraft rather than a wholesale change in ransomware operations. The quarter saw increased use of **AI and LLMs** by threat actors, including analysis of exfiltrated databases and more tailored extortion messaging, alongside continued exploitation of high-impact vulnerabilities such as `CVE-2026-50751`, `CVE-2026-48027`, `CVE-2026-46817`, and `CVE-2026-35273`. ReliaQuest identified **Deadlock** as a notable re-emerging threat after 11 months of silence, using blockchain-hosted command-and-control through a Polygon smart contract and a **BYOVD** technique to terminate EDR tools via `CVE-2024-51324`. The reports say supply-chain compromise, remote access abuse, identity attacks, lateral movement, and defense evasion remain central to ransomware operations even as payment rates decline.
Aug 11, 2026