Loading story…
Dragos reported that ransomware incidents affecting industrial organizations rose to 1,140 publicly disclosed or leak-site-listed cases in Q2 2026, up 12% from the prior quarter, with manufacturing accounting for 747 incidents. Qilin, Akira, and The Gentlemen were identified as the most active groups, while North America and Europe were the hardest-hit regions and the United States remained the most affected country. The report said attackers increasingly relied on data-theft-only extortion and commonly gained access through internet-facing edge devices, compromised credentials, remote management tools, and Microsoft Teams impersonation of IT support.
The findings show that ransomware gangs often disrupted production without reaching industrial control systems, instead causing outages through compromised enterprise IT, ERP, and virtualization environments that support OT operations. Dragos said it observed no Q2 case in which an operator reached Stage 2 of the ICS Cyber Kill Chain, yet real-world impacts still included production stoppages and precautionary shutdowns at West Pharmaceutical Services, Foxconn, and Mackay Sugar. Huntress separately highlighted Akira activity involving data exfiltration, reinforcing the broader shift away from encryption-only attacks and toward extortion based on stolen data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Dragos reported that in Q2 2026 ransomware extortion continued shifting away from file encryption toward data theft-only operations. It also highlighted Microsoft Teams impersonation of internal IT support as a prominent initial access method used to install remote management tools or harvest credentials.
Dragos reported that Qilin, Akira, and The Gentlemen were the most active ransomware groups affecting industrial organizations in Q2 2026, with 140, 129, and 125 claims respectively. The report also noted Akira's reliance on compromised VPN devices and The Gentlemen's targeting of edge devices.
In its Q2 2026 analysis, Dragos said it observed no ransomware case in which operators reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system. The report said operational disruption generally stemmed from enterprise IT and virtualization outages rather than direct ICS compromise.
Dragos reported 1,140 publicly disclosed or leak-site-listed ransomware incidents affecting industrial organizations in Q2 2026, up 12% from 1,020 in Q1. The firm assessed ransomware as the most persistent and disruptive cyber threat to industrial organizations during the quarter.
Halcyon published its Q2 2026 Ransomware Evolution Report on July 27, saying ransomware groups increasingly disabled endpoint detection and response tools before encryption as standard practice rather than a specialist capability. The report also recorded 1,988 publicly claimed attacks by 89 groups across 101 countries in Q2 2026 and said attacker tradecraft became faster and more automated despite a quarter-over-quarter decline in total claims.
Mackay Sugar disclosed a cyberattack on June 10 that stopped milling and cane haulage at two of its three Queensland mills. Dragos said it found no evidence the attackers reached ICS or directly manipulated OT.
West Pharmaceutical Services disclosed a ransomware attack on 4 May 2026 that prompted a precautionary global shutdown and disrupted shipping, receiving, and manufacturing across multiple international sites.
After the Mackay Sugar disruption, The Gentlemen ransomware group added the company to its leak site. This linked the incident to a named ransomware operation.
Two days after the June 10 incident, one Mackay Sugar mill resumed limited manual crushing. The recovery followed the disruption that had halted milling and cane haulage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcehelpnetsecurity.com
Open sourcedragos.com
Open sourceinfosecurity-magazine.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware and cyber-extortion activity rose again in Q2 2026, with industry reporting showing more than 2,250 publicly named victims across roughly 90 active groups and nearly 100 countries. GuidePoint Security’s GRIT report counted 2,279 victims, up 7% from the prior quarter and 43% year over year, while ReliaQuest recorded 2,252 victims and found the United States accounted for about 49% of observed activity. **Qilin** remained a leading force in one dataset for a fifth straight quarter, while **The Gentlemen** surged into the top tier and was ranked the most active group by ReliaQuest; **DragonForce** also remained prominent despite reported declines in some rankings. Professional, scientific, and technical services stayed the most targeted sector, and researchers noted a broader shift toward **data-only extortion** and continued pressure on organizations through public leak-site exposure. Researchers also highlighted technical changes in attacker tradecraft rather than a wholesale change in ransomware operations. The quarter saw increased use of **AI and LLMs** by threat actors, including analysis of exfiltrated databases and more tailored extortion messaging, alongside continued exploitation of high-impact vulnerabilities such as `CVE-2026-50751`, `CVE-2026-48027`, `CVE-2026-46817`, and `CVE-2026-35273`. ReliaQuest identified **Deadlock** as a notable re-emerging threat after 11 months of silence, using blockchain-hosted command-and-control through a Polygon smart contract and a **BYOVD** technique to terminate EDR tools via `CVE-2024-51324`. The reports say supply-chain compromise, remote access abuse, identity attacks, lateral movement, and defense evasion remain central to ransomware operations even as payment rates decline.
Aug 11, 2026
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Jul 27, 2026