CYFIRMA Report Finds Rising Ransomware and APT Activity Targeting Real Estate and Construction
Summary
CYFIRMA’s Q2 2026 industry report says ransomware victim listings for real estate and construction rose 42.9% quarter over quarter to 290, while APT campaign activity and exposure to remote-code-execution vulnerabilities also featured prominently.
Key points
- The sector appeared in 37 of 114 APT campaign activity updates (32%), up from 5 of 32 in the prior period; Stone Panda and Leviathan had the highest campaign counts.
- Ransomware victim listings rose 42.9% quarter over quarter, from 203 to 290, and spanned 45 countries. The United States accounted for 49% of victims.
- Qilin and Thegentlemen drove much of the July–August surge; specialty trade contractors made up roughly a quarter of sector victims.
- Web applications led observed attack technologies, with RDP ranking third. Remote and arbitrary code execution dominated the report’s vulnerability mentions.
- The report identifies payment redirection, third-party access, and exposed building-management systems as material risks; it also highlights dependence on government systems such as land registries.
- Publicly reported incidents were sparse, and neither of the two incidents discussed directly targeted a real estate or construction firm. CYFIRMA cautions that public reporting may understate sector exposure.
Article Details
- Publisher
- CYFIRMA
- Report Period
- Past 90 days; observed activity discussed from June through September 2026.
- Scope
- Global external threats affecting real estate & construction: APT activity, publicly reported incidents, underground chatter, vulnerability mentions, and ransomware leak-site victimology.
- Sample Size
- 114 campaign activity updates; 691 public incidents, including 515 with identified industries; 300k+ underground posts; over 10k reported or updated CVEs; 2,731 ransomware victim listings. Ransomware industry and geography classification had manually assessed accuracy of 85% ±5%.
- Key Statistics
- Real estate & construction appeared in 37 of 114 campaign activity updates (32%), compared with 5 of 32 (16%) in the previous period. Updates accumulate over time, limiting interpretation of monthly counts.
- The public incident dataset classified one incident as real estate & construction: 0.19% of 515 incidents with known industries, ranking 14th of 14. The narrative separately discusses two incidents indirectly affecting the sector; limited public reporting is not evidence of low exposure.
- Telemetry identified 609 sector mentions among 44,866 industry-linked underground mentions over 90 days: 1.36%, ranking 13th of 14 industries.
- Telemetry identified 328 sector vulnerability mentions among 7,758 industry-linked mentions over 90 days: 4.23%, ranking 7th of 14. A shared mid-period decline was assessed as a collection artefact.
- Ransomware blogs listed 290 sector victims over 90 days, representing 10.62% of 2,731 listings and a 42.9% increase from 203 in the previous period. Country coverage increased from 39 to 45; the United States accounted for 49%. These are leak-site-derived counts, not independently confirmed incidents.
- Recommendations
- Prioritize TTP-based detection over actor-specific IOC tracking because of the breadth of observed actors and overlapping targeting patterns.
- Review third-party access and remote access appliances as priority controls.
- Include mobile devices in exposure assessments because Android targeting was recorded across two campaigns.
- Use ransomware leak-site monitoring and construction trade press to improve visibility beyond public security incident reporting.
Threat Actors
AiLockRansomware group with 33.3% of its listed victims in the sector.AkiraRansomware group that built activity steadily and was among the most active in September; 26.1% of its listed victims were in the sector.APT27Listed among suspected China-aligned actors in observed sector campaigns.Apt73Listed jointly as Apt73/bashe in the ransomware breakdown, with 33.3% of listed victims in the sector.basheListed jointly as Apt73/bashe in the ransomware breakdown, with 33.3% of listed victims in the sector.Cozy BearRussia-linked actor appearing in observed sector campaigns.Earth EstriesListed among suspected China-aligned actors in observed sector campaigns.Fancy BearRussia-linked actor appearing in observed sector campaigns.FIN11Financially motivated actor recording significant sector campaign counts.FIN7Financially motivated actor recording significant sector campaign counts.GamaredonRussia-linked actor appearing in observed sector campaigns.GammaxRansomware group with 40.0% of its listed victims in the sector.GenesisRansomware group concentrating all eight sector victim listings in July; 32.0% of its listed victims were in the sector.HafniumListed among suspected China-aligned actors in observed sector campaigns.KrybitRansomware group that built activity steadily and was among the most active in September.Lazarus GroupNorth Korea-associated actor whose observed campaign count matched TA505.LeviathanSuspected China-linked actor ranked second in observed campaigns; the report highlights its documented engineering, maritime, and infrastructure targeting.MISSION2074Listed among suspected China-aligned actors in observed sector campaigns.OilRigIran-linked actor appearing in observed sector campaigns.OrovaRansomware group recording 10 sector victims in August; the report gives its sector share as 23.4%.QilinRansomware group whose sector victim postings increased from one in June to 21 in July and 25 in August; a leading contributor to the leak-site listing surge.ShadowByt3$Ransomware group with 57.1% of its listed victims in the sector, the highest share among multi-victim gangs.Stone PandaSuspected China-linked, state-sponsored actor with the highest observed sector campaign count.TA505Financially motivated actor recording significant sector campaign counts.The GentlemenRansomware group recording no June sector victims before posting 15 in July and 18 in August; a leading contributor to the listing surge.Transparent TribePakistan-linked actor appearing in observed sector campaigns.Turla GroupRussia-linked actor appearing in observed sector campaigns.Volt TyphoonListed among suspected China-aligned actors in observed sector campaigns.
Vendors
Products
Active DirectoryRouters, Active Directory, and network monitoring tools appear alongside three Fortinet products, firewall software, and firewall security management software, indicating sustained interest in perimeter appliances andAndroidAndroid appearing across two campaigns is notable and points to mobile devices as a target, consistent with a workforce operating across distributed and temporary sites.Atlassian ConfluenceMicrosoft Exchange Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.DeCYFIRUsing dictionary-based tagging and processing of underground & dark web chatter logs, our DeCYFIR platform can now identify industry-based topics and multiple categories of context in which the industry is beingDeTCTOver the past 90 days, DeCYFIR and DeTCT platforms tracked 691 cyber incidents reported publicly.Microsoft Exchange ServerMicrosoft Exchange Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.Microsoft WindowsDatabase management software, VPN solutions, and Microsoft Windows also feature across multiple campaigns.
Tools
PowerShellPost-exploitation tooling, including PowerShell, Windows Management Instrumentation, Server Message Block, and SSH, is also recorded, indicating campaigns progressing beyond initial access.Windows Management InstrumentationPost-exploitation tooling, including PowerShell, Windows Management Instrumentation, Server Message Block, and SSH, is also recorded, indicating campaigns progressing beyond initial access.
Countries
ArgentinaGermany and India recorded the highest elevations in the last 90 days, both rising by 8 victims, followed by France, Italy, Canada, and Argentina.AustraliaAustralia, India, and South Korea form the next tier, with Saudi Arabia notable at seventh overall, higher than in most sectors and consistent with large-scale regional construction and development activity.AustriaEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.BahrainMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.BelgiumEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.CambodiaSoutheast Asian representation is broad, covering the Philippines, Thailand, Malaysia, Indonesia, Singapore, Vietnam, and Cambodia.CanadaGermany and India recorded the highest elevations in the last 90 days, both rising by 8 victims, followed by France, Italy, Canada, and Argentina.ChinaObserved APT campaigns are led by suspected China-linked, state-sponsored actors, with Stone Panda recording the highest campaign count, followed by Leviathan.FranceEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.GermanyEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.HungaryEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.IndiaAustralia, India, and South Korea form the next tier, with Saudi Arabia notable at seventh overall, higher than in most sectors and consistent with large-scale regional construction and development activity.IndonesiaSoutheast Asian representation is broad, covering the Philippines, Thailand, Malaysia, Indonesia, Singapore, Vietnam, and Cambodia.IranIran-linked OilRig and Pakistan-linked Transparent Tribe complete the profile.IraqMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.IsraelMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.ItalyGermany and India recorded the highest elevations in the last 90 days, both rising by 8 victims, followed by France, Italy, Canada, and Argentina.JapanVictim distribution spans 47 countries, with the United States recording the highest victim count, followed by Japan and the United Kingdom.JordanMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.KuwaitMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.LebanonMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.MalaysiaSoutheast Asian representation is broad, covering the Philippines, Thailand, Malaysia, Indonesia, Singapore, Vietnam, and Cambodia.New ZealandAustria, Malaysia, New Zealand, and Poland saw the largest declines, though all were small in absolute terms.North KoreaNorth Korea-associated Lazarus Group matches TA505 in campaign count.NorwayEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.OmanMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.PakistanIran-linked OilRig and Pakistan-linked Transparent Tribe complete the profile.PhilippinesSoutheast Asian representation is broad, covering the Philippines, Thailand, Malaysia, Indonesia, Singapore, Vietnam, and Cambodia.PolandAustria, Malaysia, New Zealand, and Poland saw the largest declines, though all were small in absolute terms.QatarMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.RomaniaRomania’s land registry disruption showed the sector’s dependency on government systems it does not control.RussiaRussia-linked Gamaredon, Cozy Bear, Turla Group, and Fancy Bear all appear, the broadest Russian representation recorded this period.Saudi ArabiaAustralia, India, and South Korea form the next tier, with Saudi Arabia notable at seventh overall, higher than in most sectors and consistent with large-scale regional construction and development activity.SingaporeSoutheast Asian representation is broad, covering the Philippines, Thailand, Malaysia, Indonesia, Singapore, Vietnam, and Cambodia.South KoreaAustralia, India, and South Korea form the next tier, with Saudi Arabia notable at seventh overall, higher than in most sectors and consistent with large-scale regional construction and development activity.SpainEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.SwitzerlandEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.SyriaMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.ThailandSoutheast Asian representation is broad, covering the Philippines, Thailand, Malaysia, Indonesia, Singapore, Vietnam, and Cambodia.the NetherlandsEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.UAEMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.UkraineEuropean presence spans Germany, France, Hungary, Ukraine, Spain, the Netherlands, Belgium, Switzerland, Austria, and Norway.United KingdomVictim distribution spans 47 countries, with the United States recording the highest victim count, followed by Japan and the United Kingdom.United StatesVictim distribution spans 47 countries, with the United States recording the highest victim count, followed by Japan and the United Kingdom.VietnamSoutheast Asian representation is broad, covering the Philippines, Thailand, Malaysia, Indonesia, Singapore, Vietnam, and Cambodia.YemenMiddle Eastern presence is wide, covering Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.
Industries
Architecture & Design FirmsArchitecture & Design Firms and Building Materials Distribution each recorded 21 victims.Building Materials DistributionArchitecture & Design Firms and Building Materials Distribution each recorded 21 victims.General ContractorsReal Estate Developers, Industrial & Infrastructure Construction, Real Estate Agencies, and General Contractors in commercial and mixed-use work formed a substantial second tier.Industrial & Infrastructure ConstructionReal Estate Developers, Industrial & Infrastructure Construction, Real Estate Agencies, and General Contractors in commercial and mixed-use work formed a substantial second tier.real estate & constructionREAL ESTATE & CONSTRUCTIONReal Estate AgenciesReal Estate Developers, Industrial & Infrastructure Construction, Real Estate Agencies, and General Contractors in commercial and mixed-use work formed a substantial second tier.Real Estate DevelopersReal Estate Developers, Industrial & Infrastructure Construction, Real Estate Agencies, and General Contractors in commercial and mixed-use work formed a substantial second tier.Specialty Trade ContractorsSpecialty Trade Contractors led victims at roughly a quarter of the total.