cyber.hendryadrian.com
Security Report · asec.ahnlab.com

AhnLab’s March 2026 Report Tracks Ransomware Activity and DLS Extortion Trends

· Original article ↗

Summary

AhnLab’s March 2026 report describes ransomware activity across critical sectors and groups, including DLS-based exposure and blackmail. It cautions that a methodology change in December 2025 limits comparisons with earlier months.

Key points

  • Ransomware sample and victimized-system statistics were grouped by AhnLab detection name; targeted-business statistics were based on disclosures on groups’ Dedicated Leak Sites (DLS).
  • A methodology change beginning in December 2025 means targeted-business figures should not be directly compared with earlier monthly figures.
  • The report identifies manufacturing, healthcare, and finance among the critical infrastructure sectors targeted in March 2026.
  • Qilin, The Gentlemen, and INC Ransom remained active, and the report observed new ransomware groups.
  • The report describes extortion patterns combining traditional encryption with victim exposure and blackmail through DLS.
  • It includes top-10 country and industry statistics and three-year trends for leading groups.

Article Details

Publisher
AhnLab
Report Period
March 2026
Scope
Ransomware sample and victimized-system counts, DLS-based targeted-business statistics, and major Korean and global ransomware activity.
Sample Size
Unknown
Recommendations
  • Maintain monitoring, detection, and analysis capabilities.

Threat Actors

INC RansomThe report says INC Ransom's activity continued in March 2026; it provides no specific incident details.QilinThe report says Qilin's activity continued in March 2026; it provides no specific incident details.The GentlemenThe report says The Gentlemen's activity continued in March 2026; it provides no specific incident details.

Industries

financeMarch was marked by attacks on critical infrastructure—including manufacturing, healthcare, and finance—with continued activity from groups such as Qilin, The Gentlemen, and INC Ransom and increased use of DLS-basedHealthcareMarch was marked by attacks on critical infrastructure—including manufacturing, healthcare, and finance—with continued activity from groups such as Qilin, The Gentlemen, and INC Ransom and increased use of DLS-basedManufacturingMarch was marked by attacks on critical infrastructure—including manufacturing, healthcare, and finance—with continued activity from groups such as Qilin, The Gentlemen, and INC Ransom and increased use of DLS-based

Related Articles