CYFIRMA Reports Record 1,178 Ransomware Victim Claims in October
Summary
CYFIRMA counted 1,178 publicly disclosed ransomware victim claims in October 2026, its highest monthly total, and described shifts in edge access, hypervisor pivots and backup sabotage. Claims were not independently verified.
Key points
- CYFIRMA recorded 1,178 publicly disclosed victim claims, up 36.7% from September; its leak-site monitoring counts may include duplicate, disputed or historical claims.
- Qilin led with 177 claims, followed by The Gentlemen with 145 and N0n with 142; CYFIRMA said N0n rose from 18 in September.
- The United States accounted for 518 claims (44%); 78 countries were represented, and Professional Goods & Services had the most claims.
- The report describes attackers using edge-device access, including reported abuse of CVE-2026-0257 to open GlobalProtect sessions without MFA and pivot toward vCenter and ESXi.
- Reported tradecraft includes offline credential extraction from domain-controller VMDKs, NAS factory resets, cloud-sync tools for data theft, and BYOVD kits to impair security tools.
- CYFIRMA recommends patching exposed VPN, firewall and backup systems, isolating management planes, alerting on suspicious VMDK and NAS activity, and maintaining immutable backups.
Article Details
- Publisher
- CYFIRMA Research
- Report Period
- October 2026
- Scope
- Publicly claimed ransomware victims and reported ransomware tradecraft, based on leak-site monitoring and public disclosures.
- Sample Size
- 1,178 publicly claimed victims; claims were not independently verified and may include reposted, duplicated, disputed, or historical victims.
- Key Statistics
- CYFIRMA tracked 1,178 publicly claimed victims in October 2026, up 36.7% from 862 in September and the highest monthly total in its tracking.
- Qilin (177), The Gentlemen (145), and N0n (142) accounted for 39% of October's claimed victims.
- The United States accounted for 518 claims (44%); victims were identified in 78 countries.
- Professional Goods & Services had 170 claims, followed by Manufacturing (123), Real Estate & Construction (122), and Healthcare (120).
- 113 victims (10%) had their organization identity obfuscated and could not be assigned to an industry.
- Recommendations
- Patch or mitigate CVE-2026-0257 on PAN-OS GlobalProtect portals and gateways, and review authentication logs for sessions completed without MFA.
- Check VPN, firewall, and backup consoles together for exposure; enforce phishing-resistant MFA and review unexpected successful edge logins for possible compromise.
- Isolate vCenter and ESXi management networks from general VPN users, and alert on security-flag changes and unexpected access to domain-controller VMDK files.
- Separate NAS and backup administration credentials from domain credentials, alert on factory resets and volume deletions, and verify an immutable, identity-separated backup copy.
- Enable Microsoft's vulnerable-driver blocklist and WDAC or HVCI where feasible, and investigate unusual driver-service installs paired with security tools stopping.
MITRE ATT&CK
T1003 · OS Credential DumpingCredential theft included extracting secrets from a domain-controller VMDK and credentials from Veeam SQL stores.T1021.001 · Remote Desktop ProtocolRDP was listed among the remote-access methods used during ransomware staging.T1021.002 · SMB/Windows Admin SharesSMB was listed among the methods used for lateral movement.T1021.006 · Windows Remote ManagementWinRM was listed among the remote-administration methods used during ransomware staging.T1078 · Valid AccountsReported use of stolen or phished credentials for edge logins and access.T1133 · External Remote ServicesAttackers reportedly used GlobalProtect VPN sessions, including sessions opened without completing MFA.T1135 · Network Share DiscoveryShare discovery was reported using ShareFinder and SharpShares.T1210 · Exploitation of Remote ServicesReported exploitation of vulnerabilities in internet-facing VPN, firewall, and backup products to gain access.T1490 · Inhibit System RecoveryReported recovery inhibition included stopping VSS and factory-resetting NAS backup appliances.T1562.001 · Disable or Modify ToolsBYOVD tooling was reportedly used to kill security processes, alongside Defender tampering.T1567.002 · Exfiltration to Cloud StorageThe report describes data theft using cloud-sync clients and other transfer tools.
CVE
CVE-2021-21974Vmware · Cloud foundation; Vmware · EsxiThe same stash held exploit scripts for VMware ESXi (CVE-2021-21974) and Veeam Backup Enterprise Manager (CVE-2024-29849), both adapted from public proof-of-concept code, and helpers that pull credentials out of VeeamCVE-2024-29849Vendor / Product unavailablesame stash held exploit scripts for VMware ESXi (CVE-2021-21974) and Veeam Backup Enterprise Manager (CVE-2024-29849), both adapted from public proof-of-concept code, and helpers that pull credentials out of Veeam SQLCVE-2026-0257Palo Alto Networks · PAN-OS; Palo Alto Networks · Prisma Access; +1 moreshould prioritize patching of internet-facing VPN, firewall, and backup consoles, including CVE-2026-0257 in PAN-OS GlobalProtect, harden hypervisor and backup administration planes, and monitor for the
Threat Actors
INC RansomUnit 42 reported INC Ransom using CVE-2026-0257 to open GlobalProtect sessions without MFA and pivot to vCenter and ESXi; CYFIRMA recorded 28 claimed victims.N0nCYFIRMA recorded 142 publicly claimed victims for N0n in October, up from 18 in September; the report notes that victim claims are not independently verified.QilinUnit 42 reported Qilin using CVE-2026-0257 to open GlobalProtect sessions without MFA and pivot to vCenter and ESXi; CYFIRMA recorded 177 claimed victims.SafepayJoint advisory AA26-293a reported SafePay tradecraft including credential abuse, Mullvad egress, NAS factory resets, and cloud-sync theft.SettraPublic reporting linked Settra ransomware operators to activity involving CVE-2026-0257; Unit 42 did not independently confirm that link.The GentlemenOctober threat reporting described The Gentlemen abusing BootRepair.sys and ProcessMonitorDriver to kill security processes; CYFIRMA recorded 145 claimed victims.
Malware
Vendors
CiscoMulti-vendor exploitation of older Cisco, SonicWall and Veeam flaws continues through the next quarter (Moderate).LenovoOctober threat reporting on The Gentlemen described abuse of Lenovo’s BootRepair.sys and Safetica’s ProcessMonitorDriver to kill security processes, while kits such as Terminator, AvNeutralizer, and EDRKillShifter keptMicrosoftEnable Microsoft’s vulnerable-driver blocklist and WDAC or HVCI where feasible; hunt for driver-service installs (BootRepair.sys, ProcessMonitorDriver) paired with security tools stopping.SafeticaOctober threat reporting on The Gentlemen described abuse of Lenovo’s BootRepair.sys and Safetica’s ProcessMonitorDriver to kill security processes, while kits such as Terminator, AvNeutralizer, and EDRKillShifter keptSonicWallMulti-vendor exploitation of older Cisco, SonicWall and Veeam flaws continues through the next quarter (Moderate).VeeamMulti-vendor exploitation of older Cisco, SonicWall and Veeam flaws continues through the next quarter (Moderate).VMwareThe same stash held exploit scripts for VMware ESXi (CVE-2021-21974) and Veeam Backup Enterprise Manager (CVE-2024-29849), both adapted from public proof-of-concept code, and helpers that pull credentials out of Veeam
Products
Cisco ASARun one external exposure check across VPN, firewall, and backup consoles together, Cisco ASA/FTD, SonicWall, Veeam, against the vulnerabilities in CISA advisory AA26-293a; trigger a compromise review after anyCisco FTDRun one external exposure check across VPN, firewall, and backup consoles together, Cisco ASA/FTD, SonicWall, Veeam, against the vulnerabilities in CISA advisory AA26-293a; trigger a compromise review after anyESXiUnit 42 reported Qilin and INC Ransom opening GlobalProtect sessions without MFA and pivoting to vCenter and ESXi.GlobalProtectpatching of internet-facing VPN, firewall, and backup consoles, including CVE-2026-0257 in PAN-OS GlobalProtect, harden hypervisor and backup administration planes, and monitor for the living-off-the-land stagingPAN-OSprioritize patching of internet-facing VPN, firewall, and backup consoles, including CVE-2026-0257 in PAN-OS GlobalProtect, harden hypervisor and backup administration planes, and monitor for theSonicWallMulti-vendor exploitation of older Cisco, SonicWall and Veeam flaws continues through the next quarter (Moderate).Veeam Backup Enterprise ManagerThe same stash held exploit scripts for VMware ESXi (CVE-2021-21974) and Veeam Backup Enterprise Manager (CVE-2024-29849), both adapted from public proof-of-concept code, and helpers that pull credentials out of VeeamVMware vCenter ServerUnit 42 reported Qilin and INC Ransom opening GlobalProtect sessions without MFA and pivoting to vCenter and ESXi.
Tools
AvNeutralizerand Safetica’s ProcessMonitorDriver to kill security processes, while kits such as Terminator, AvNeutralizer, and EDRKillShifter kept circulating across multiple ransomware brands.ChiselOlder affiliate kits often dropped Mimikatz, Rubeus, Chisel, scanners, and scripts side by side, which left a large footprint.EDRKillShifterProcessMonitorDriver to kill security processes, while kits such as Terminator, AvNeutralizer, and EDRKillShifter kept circulating across multiple ransomware brands.MimikatzOlder affiliate kits often dropped Mimikatz, Rubeus, Chisel, scanners, and scripts side by side, which left a large footprint.PsExecHunt for the living-off-the-land window, share discovery, PsExec and WinRM spikes, sync tools on servers, vulnerable-driver loads, because custom malware now stays off stage until the final step.RubeusOlder affiliate kits often dropped Mimikatz, Rubeus, Chisel, scanners, and scripts side by side, which left a large footprint.ShareFinderrepeatedly showed PsExec, WinRM, RDP, and commercial remote-support applications for hands-on control; ShareFinder and SharpShares for finding file shares; and Rclone, WinSCP, FileZilla, OneDrive, or Backblaze clientsSharpSharesPsExec, WinRM, RDP, and commercial remote-support applications for hands-on control; ShareFinder and SharpShares for finding file shares; and Rclone, WinSCP, FileZilla, OneDrive, or Backblaze clients for bulk theftStreamerStreamer adoption. The Eclipse framework is known from one leaked server analyzed by one research team (Low).TerminatorBootRepair.sys and Safetica’s ProcessMonitorDriver to kill security processes, while kits such as Terminator, AvNeutralizer, and EDRKillShifter kept circulating across multiple ransomware brands.
Countries
BrazilIt was followed by Germany (54), Canada (39), Spain (29), Brazil (28), India (26), and Italy (25).CanadaIt was followed by Germany (54), Canada (39), Spain (29), Brazil (28), India (26), and Italy (25).GermanyIt was followed by Germany (54), Canada (39), Spain (29), Brazil (28), India (26), and Italy (25).IndiaIt was followed by Germany (54), Canada (39), Spain (29), Brazil (28), India (26), and Italy (25).ItalyIt was followed by Germany (54), Canada (39), Spain (29), Brazil (28), India (26), and Italy (25).SpainIt was followed by Germany (54), Canada (39), Spain (29), Brazil (28), India (26), and Italy (25).United StatesReal Estate & Construction and Healthcare absorbed the most claims, with 44% of victims in the United States.
Industries
Consumer Goods & Services(123), Real Estate & Construction (122), Healthcare (120), Information Technology (96), Consumer Goods & Services (79), Transportation & Logistics (71), Government & Civic (57), and Education (52) were theEducation(96), Consumer Goods & Services (79), Transportation & Logistics (71), Government & Civic (57), and Education (52) were the most-targeted industries.Government & civicInformation Technology (96), Consumer Goods & Services (79), Transportation & Logistics (71), Government & Civic (57), and Education (52) were the most-targeted industries.Healthcarerose from 18 to 142, and Professional Goods & Services, Manufacturing, Real Estate & Construction and Healthcare absorbed the most claims, with 44% of victims in the United States.Information TechnologyProfessional Goods & Services, Manufacturing, Real Estate & Construction, Healthcare, and Information Technology were the most-targeted industries; a further 113 victims (10%) were posted with the organization’sManufacturingof the rankings with 177 claimed victims, N0n rose from 18 to 142, and Professional Goods & Services, Manufacturing, Real Estate & Construction and Healthcare absorbed the most claims, with 44% of victims in the UnitedProfessional Goods & Servicesreturned to the top of the rankings with 177 claimed victims, N0n rose from 18 to 142, and Professional Goods & Services, Manufacturing, Real Estate & Construction and Healthcare absorbed the most claims, with 44%real estate & construction177 claimed victims, N0n rose from 18 to 142, and Professional Goods & Services, Manufacturing, Real Estate & Construction and Healthcare absorbed the most claims, with 44% of victims in the United States.Transportation and Logistics(122), Healthcare (120), Information Technology (96), Consumer Goods & Services (79), Transportation & Logistics (71), Government & Civic (57), and Education (52) were the most-targeted industries.