July 2026 Ransomware Report Finds Manufacturing Most Affected as New Groups Emerge
Summary
AhnLab’s July 2026 report says manufacturing had the most reported ransomware incidents, Gentlemen led group rankings, and established and newly emerged groups claimed attacks worldwide.
Key points
- The report compiled statistics on new ransomware samples, compromised systems, targeted businesses, and claims published on ransomware groups’ leak sites.
- Manufacturing led reported incidents with 85, followed by information and communication with 59 and wholesale and distribution with 40.
- The United States had the most reported cases at 247, followed by France at 60 and Germany at 54.
- Gentlemen ranked first with approximately 159 affected companies, ahead of Qilin with 126; Settra and KryBit newly entered the top 10.
- The report describes activity across multiple regions by established groups and newly emerged data-theft and ransomware groups.
- ExfilSquad claimed attacks on Microsoft and 15 other companies after an attack on Zenith Bank; the report also notes exposed NightSpire site information and a SOCKS5 proxy disguised as Nezha RMM and vmtools.Exe.
- Recommended measures include prompt vulnerability patching, auditing third-party access, network segmentation, stronger backups, and continuous threat monitoring.
Article Details
- Publisher
- Asec Ahnlab
- Report Period
- July 2026
- Scope
- Korean and global ransomware trends, including ransomware samples, compromised systems, targeted businesses, and reported group activity.
- Key Statistics
- Manufacturing had the highest reported industry incident count, with 85 incidents.
- The US had the highest reported country incident count, with 247 cases.
- Gentlemen ranked first by affected companies, with approximately 159 incidents; the report attributes its ranking to corrections for data-collection omissions and cross-referencing with external statistics.
- Qilin ranked second by affected companies, with 126 incidents.
- Everest announced that it had leaked 201 GB of data from Stadler Rail AG; this is a group claim reported by the source.
- Recommendations
- Apply vulnerability patches promptly.
- Audit third-party and supply-chain access privileges.
- Implement network segmentation.
- Strengthen data backup systems.
- Use threat intelligence for proactive response and continuous monitoring.
Threat Actors
AkiraRanked among the groups by affected companies, with 30 incidents.chaosListed among established groups continuing their activities.Coinbase CartelListed among established groups continuing their activities.CRPx0Identified as a new data-stealing and ransomware group.D1RIdentified as a new data-stealing and ransomware group.DoommageddonIdentified as a new data-stealing and ransomware group.DragonForceReported as active; claimed responsibility for attacks targeting multiple organizations.EverestListed as active; announced that it had leaked 201 GB of data from Stadler Rail AG.ExfilSquadIdentified as a new group; claimed attacks on Microsoft and 15 companies worldwide, following an attack on Zenith Bank.GammaxIdentified as a new data-stealing and ransomware group; claimed to have attacked numerous companies.GLOBAL SECRET GROUPIdentified as a new group; claimed to have attacked numerous companies.GunraListed among established groups continuing their activities.incransomListed among groups active in July 2026; the report also refers to INC Ransom.KrybitNewly entered the Top 10, with 27 cases; also written as “krybit” in the report.LockBitListed among established groups continuing their activities; the report specifies LockBit 5.0.MorpheusListed among established groups continuing their activities.NovaReported as active and targeting Indonesian public and healthcare institutions.QilinRanked second by affected companies, with 126 incidents.SafepayRanked among the groups by affected companies, with 33 incidents.SECTION9Identified as a new data-stealing and ransomware group; claimed to have attacked numerous companies.SettraNewly entered the Top 10, with 28 cases.ShibaIdentified as a new data-stealing and ransomware group.ShinyHuntersListed among established groups continuing their activities.The Crypt ApadosIdentified as a new data-stealing and ransomware group.The GentlemenRanked first by affected companies; the report attributes approximately 159 incidents to the group and says it claimed attacks across multiple regions.The GentlemenListed among established groups continuing their activities; the report says it claimed attacks across multiple regions.worldleaksListed among groups active in July 2026.
Products
Countries
Brazilcases), Germany (de) (54 cases), Thailand (th) (43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb) (19 cases).CanadaFrance (fr) (60 cases), Germany (de) (54 cases), Thailand (th) (43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb)FranceFrance (fr) (60 cases), Germany (de) (54 cases), Thailand (th) (43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb)GermanyFrance (fr) (60 cases), Germany (de) (54 cases), Thailand (th) (43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb)IndiaFrance (fr) (60 cases), Germany (de) (54 cases), Thailand (th) (43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb)IndonesiaThe Gentlemen claimed responsibility for attacks targeting multiple regions, including Saudi Arabia, Indonesia, Malaysia, Japan, the US, and Norway; in South Korea, Line Up Korea was listed as a victim.Italycases), Thailand (th) (43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb) (19 cases).JapanThe Gentlemen claimed responsibility for attacks targeting multiple regions, including Saudi Arabia, Indonesia, Malaysia, Japan, the US, and Norway; in South Korea, Line Up Korea was listed as a victim.MalaysiaThe Gentlemen claimed responsibility for attacks targeting multiple regions, including Saudi Arabia, Indonesia, Malaysia, Japan, the US, and Norway; in South Korea, Line Up Korea was listed as a victim.NorwayThe Gentlemen claimed responsibility for attacks targeting multiple regions, including Saudi Arabia, Indonesia, Malaysia, Japan, the US, and Norway; in South Korea, Line Up Korea was listed as a victim.Saudi ArabiaThe Gentlemen claimed responsibility for attacks targeting multiple regions, including Saudi Arabia, Indonesia, Malaysia, Japan, the US, and Norway; in South Korea, Line Up Korea was listed as a victim.South KoreaThe Gentlemen claimed responsibility for attacks targeting multiple regions, including Saudi Arabia, Indonesia, Malaysia, Japan, the US, and Norway; in South Korea, Line Up Korea was listed as a victim.Spain(43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb) (19 cases).ThailandFrance (fr) (60 cases), Germany (de) (54 cases), Thailand (th) (43 cases), India (in) (36 cases), Canada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb)United KingdomCanada (ca) (33 cases), Brazil (br) (28 cases), Italy (it) (25 cases), Spain (es) (19 cases), and the United Kingdom (gb) (19 cases).United States
Industries
Accommodation and food services(11 cases), education services (10 cases), public administration and defense (10 cases), accommodation and food services (8 cases), and Construction (7 cases).Constructioncases), public administration and defense (10 cases), accommodation and food services (8 cases), and Construction (7 cases).Education servicesIncidents were also confirmed in the Finance and insurance sector (11 cases), education services (10 cases), public administration and defense (10 cases), accommodation and food services (8 cases), and Construction (7Finance and insuranceIncidents were also confirmed in the Finance and insurance sector (11 cases), education services (10 cases), public administration and defense (10 cases), accommodation and food services (8 cases), and Construction (7Health and social welfare servicessector (59 incidents), the Wholesale and distribution sector (40 incidents), the Health and social welfare services sector (27 incidents), and the Professional, scientific, and technical services sector (22Information and communicationThis was followed by the Information and communication sector (59 incidents), the Wholesale and distribution sector (40 incidents), the Health and social welfare services sector (27 incidents), and the Professional,ManufacturingIn July 2026, the Manufacturing sector (85 incidents) had the highest number of incidents.Professional, scientific, and technical servicesincidents), the Health and social welfare services sector (27 incidents), and the Professional, scientific, and technical services sector (22 incidents).Public administration and defenseconfirmed in the Finance and insurance sector (11 cases), education services (10 cases), public administration and defense (10 cases), accommodation and food services (8 cases), and Construction (7 cases).Wholesale and distributionThis was followed by the Information and communication sector (59 incidents), the Wholesale and distribution sector (40 incidents), the Health and social welfare services sector (27 incidents), and the Professional,