Loading story…
A joint advisory from the FBI, CISA, NSA, the Australian Cyber Security Centre and the UK National Cyber Security Centre warned that ransomware became more sophisticated and globally disruptive during 2021. Attacks affected 14 of the 16 U.S. critical infrastructure sectors, alongside widespread targeting of Australian and UK organizations. Phishing, compromised Remote Desktop Protocol access and exploitation of software vulnerabilities remained the leading entry points. An increasingly professional ransomware-as-a-service ecosystem enabled attackers to share victim information and apply multiple forms of extortion.
Attackers extended their reach into cloud environments, managed service providers, software supply chains and industrial processes, increasing the potential for disruption beyond individual victims. The agencies urged organizations to prioritize timely patching, multifactor authentication, restricted remote access, network segmentation and least privilege. They also recommended monitoring cloud environments and maintaining tested offline backups to support recovery, while strongly discouraging ransom payments. For security leaders, the advisory highlights the need to address both common initial-access weaknesses and dependencies that can amplify an attack’s impact.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
On February 9, 2022, the FBI, CISA, NSA, ACSC and NCSC-UK jointly issued an advisory describing increasingly sophisticated, high-impact ransomware activity observed during 2021. It reported incidents affecting 14 of the 16 U.S. critical infrastructure sectors and recommended defensive measures while strongly discouraging ransom payments.
Conti ransomware actors began selling access to victims' networks in October 2021, enabling follow-on attacks by other threat actors.
Following disruptions by U.S. authorities in mid-2021, the FBI observed some ransomware actors shifting toward mid-sized victims to reduce scrutiny. Australian and UK authorities continued to observe targeting of organizations of all sizes.
Kaseya Limited was cited as a high-profile ransomware victim in the advisory's discussion of first-half 2021 targeting of high-value organizations and critical-service providers.
JBS Foods was among the high-profile ransomware victims cited in the advisory as examples of first-half 2021 targeting of high-value organizations and critical-service providers.
Colonial Pipeline Company was among the high-profile ransomware victims cited in the advisory as examples of first-half 2021 targeting of high-value organizations and critical-service providers.
After announcing its shutdown, BlackMatter transferred its existing victims to infrastructure owned by LockBit 2.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026
Government organizations worldwide are facing escalating cyber threats, with ransomware and extortion attacks sharply increasing in frequency and sophistication. Over 117 US federal and state entities were impacted in 2024, and attackers are increasingly targeting third-party providers and leveraging new tactics such as data extortion without encryption. The MOVEit and GoAnywhere supply chain breaches have had lasting repercussions, exposing sensitive data from government-linked organizations. Attackers are also employing advanced techniques, including the use of AI for phishing and deepfakes for social engineering, further complicating defense efforts. International coalitions, such as the Counter Ransomware Initiative (CRI), are urging stronger supply-chain cyber defenses and coordinated global action, highlighting the immediate and urgent threat ransomware poses to national security and economic stability. Despite some progress in reducing ransomware payments, attacks continue to disrupt major companies and public sector entities worldwide. The CRI, now comprising 61 countries and six international organizations, has released new guidance emphasizing the need for improved cyber hygiene and legislative action to address supply-chain vulnerabilities. Critics warn that legislative gaps persist, leaving critical systems exposed, while the ongoing digital transformation and prevalence of legacy systems in the public sector further increase risk. The convergence of these factors underscores the urgent need for comprehensive cybersecurity strategies and international cooperation to bolster resilience against evolving threats.
Jun 29, 2026
Reporting highlighted elevated ransomware activity and evolving access-broker ecosystems. BlackFog’s February ransomware roundup counted **82 publicly disclosed ransomware incidents** across **20 countries**, with the **U.S.** most affected (51 incidents) and **healthcare** the most targeted sector (31%). The report attributed publicly claimed attacks to **24 ransomware groups**, led by **Shiny Hunters** (8) and **Qilin** (6), while noting **41%** of incidents were not yet attributed; it also cited individual victim disclosures/claims involving **Nova Biomedical** (PII exposure affecting 10,764 people), **Hosokawa Micron** (files accessed; **Everest** claimed ~30GB theft), and **Iron Mountain** (Everest claim of 1.4TB theft, while Iron Mountain stated access was limited to a single marketing folder via a compromised credential). Separately, Huntress described how investigation of a “routine” **RDP brute-force** success led to discovery of credential-hunting behavior and **geo-distributed infrastructure** consistent with a **ransomware-as-a-service** ecosystem and associated initial access activity, illustrating how exposed remote access can connect to broader ransomware operations. Arctic Wolf warned of **heightened cyber risk** following the February 2026 U.S./Israel-Iran escalation (*Operation Epic Fury*), advising increased vigilance—especially for sectors historically targeted by Iranian-linked actors (e.g., energy, defense, transportation, healthcare, government)—and anticipating potential **wiper activity, DDoS, targeted intrusions, supply-chain risk**, and possible collaboration with ransomware-affiliate activity amid geopolitical retaliation dynamics.
Jun 29, 2026