Cyble Reports Over 3,800 Ransomware Attacks in First Half of 2026
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Cyble's H1 2026 report tracks over 3,800 ransomware attacks, 367 breach and leak incidents, and 129 initial access listings, highlighting data-theft extortion, exploited perimeter flaws and regional differences in threats.
Key points
- For January–June 2026, Cyble reports approximately 3,800 ransomware attacks, 367 breach and leak incidents, and 129 initial access sale listings; the report includes publicly claimed ransomware activity.
- Qilin was identified as the most prolific ransomware operator globally, alongside major activity from Akira, Dragonforce, INC Ransom and The Gentlemen.
- The report describes data exfiltration as a primary extortion lever, emphasizing that backup recovery alone does not address the risk of stolen-data publication.
- Financial services led observed breach and leak incidents, while Technology and Retail each accounted for eight initial access listings.
- Nearly 90% of the 146 CVEs analyzed were rated critical or high severity, with recurring exposure involving enterprise network, security and management products.
- Cyble tracked 261 threat actor profiles worldwide. Ransomware groups represented 63% of profiles observed in Australia and New Zealand, while Europe and the UK had nearly equal numbers of ransomware and APT profiles.
- Recommendations include risk-prioritized patching of internet-facing systems, phishing-resistant MFA, network segmentation, tested offline backups and monitoring for access-broker exposure.
Article Details
- Publisher
- Cyble
- Report Period
- 2026-01-01 to 2026-06-30
- Scope
- Worldwide ransomware, data breaches and leaks, initial access sales, hacktivism, threat actor activity, and exploited vulnerabilities, with regional breakdowns.
- Sample Size
- 146 analyzed CVEs and 261 tracked threat actor profiles; incident datasets are reported separately.
- Key Statistics
- CRIL reported 3,836 ransomware attacks worldwide in H1 2026 in the executive summary; the ransomware overview instead reports 3,837. The report includes publicly claimed attacks, which should not all be treated as independently confirmed incidents.
- CRIL observed 367 data breach and leak incidents worldwide in H1 2026, compared with 372 in H1 2025; BFSI accounted for 38 incidents.
- CRIL observed 129 initial access sale listings worldwide in H1 2026; Technology and Retail each accounted for eight listings.
- Hacktivist-branded activity reportedly impacted over 32,400 unique domains and produced approximately 9,825 data leak and dump posts worldwide in H1 2026.
- Nearly 90% of the 146 analyzed CVEs were rated critical or high severity; over 88% of nine tracked major zero-day CVEs had CVSS scores of at least 7.0.
- Recommendations
- Prioritize risk-based patching of known exploited flaws in internet-facing network, security, and remote access infrastructure, supported by continuous asset discovery and rapid patching SLAs.
- Enforce phishing-resistant MFA, least privilege, credential hygiene, and continuous identity monitoring, including for third-party access.
- Segment perimeter, corporate, IT, and OT environments, and implement data loss prevention to restrict lateral movement and exfiltration.
- Maintain regularly tested offline, immutable backups and rehearse incident response and breach-disclosure communications.
- Monitor access-broker markets for organizational exposure, treat confirmed access listings as active incidents, and hunt for unauthorized remote management tools, web shells, and dormant administrative accounts.
MITRE ATT&CK
T1090.002 · External ProxyUNC6508 routes activity through US-based residential proxies and compromised routers to obscure attribution.T1114.003 · Email Forwarding RuleUNC6508 was observed creating malicious mail-forwarding rules to exfiltrate correspondence.T1190 · Exploit Public-Facing ApplicationThe report describes exploitation of internet-facing enterprise appliances and externally accessible REDCap environments for initial access.T1486 · Data Encrypted for ImpactRansomware operators use encryption alongside threats to publish exfiltrated data in double-extortion operations.T1491.002 · External DefacementHacktivist collectives conduct website defacements; Brotherhood Capung BCI (Cyber) uploads web shells for defacement.T1498 · Network Denial of ServiceBlazer Team Attack coordinates and logs Layer 4 DDoS attacks, including traffic-volume and packet-rate measurements.T1499 · Endpoint Denial of ServiceBlazer Team Attack coordinates and logs Layer 7 DDoS attacks with request-rate measurements.T1505.003 · Web ShellUNC6508 deploys web shells in compromised REDCap environments; attackers exploiting the Ivanti Endpoint Manager Mobile zero-day also deploy persistent web shells.T1566.002 · Spearphishing LinkBluenoroff impersonates established investors and plants malicious links inside victims' Calendly scheduling accounts.
CVE
Threat Actors
AkiraA leading ransomware operator targeting Manufacturing, Construction, and Professional Services, particularly in North America and Europe.Cl0pConducted concentrated ransomware activity in January and February; CRIL reports 12 Australian and New Zealand attacks on 2026-01-27, which it interprets as indicative of mass exploitation.DragonForceA prominent RaaS operator with substantial activity against Construction, Manufacturing, and Professional Services.INC RansomA ransomware operator targeting Healthcare, Manufacturing, Professional Services, Transportation, and Energy, using sensitive data for double extortion.LockBitA ransomware operation that remained active despite prior law enforcement action, with reported activity across multiple regions.QilinIdentified by CRIL as the most prolific ransomware actor worldwide in H1 2026, with broad sector targeting and substantial activity across multiple regions.sanguineThe leading initial access seller in the worldwide dataset, associated with 12 listings in H1 2026.tanakaThe most active data-leak broker in the worldwide dataset, associated with 25 distinct leak posts and broad, industry-agnostic targeting.The GentlemenA leading ransomware group credited with 56 claimed incidents in Middle East and Africa and 114 claimed victims in Asia and Pacific during H1 2026.UNC6508Described as a PRC-nexus espionage cluster targeting North American research and regulatory organizations through compromised REDCap environments, web shells, custom malware, and malicious mail-forwarding rules.
Malware
BTMOBas a focal point for sophisticated financial malware, with new Android trojan families — TCLBANKER and BTMOB RAT — using self-propagation, evasion, and Malware-as-a-Service (MaaS) distribution to target banking andRustyWaterintroduced novel malware such as RustyWater and ZionSiphon against targets in Israel, Iraq,TCLBANKERBrazil emerged as a focal point for sophisticated financial malware, with new Android trojan families — TCLBANKER and BTMOB RAT — using self-propagation, evasion, and Malware-as-a-Service (MaaS) distribution to targetVidarsuch as Vidar.ZionSiphonintroduced novel malware such as RustyWater and ZionSiphon against targets in Israel, Iraq,
Vendors
Ciscorated critical or high severity, and repeat offenders — SmarterTools, SolarWinds, Fortinet, Ivanti, and Cisco — continued to appear in both the CISA Known Exploited Vulnerabilities (KEV) catalog and active zero-dayFortinetcycle, nearly 90% were rated critical or high severity, and repeat offenders — SmarterTools, SolarWinds, Fortinet, Ivanti, and Cisco — continued to appear in both the CISA Known Exploited Vulnerabilities (KEV) catalogIvanti90% were rated critical or high severity, and repeat offenders — SmarterTools, SolarWinds, Fortinet, Ivanti, and Cisco — continued to appear in both the CISA Known Exploited Vulnerabilities (KEV) catalog andPalo Alto NetworksTwo zero-days in particular, affecting Ivanti Endpoint Manager Mobile and Palo Alto Networks Cloud NGFW, illustrate the continued attacker preference for network and device management platforms as an entry point intoSmarterToolspart of this reporting cycle, nearly 90% were rated critical or high severity, and repeat offenders — SmarterTools, SolarWinds, Fortinet, Ivanti, and Cisco — continued to appear in both the CISA Known ExploitedSolarWindsreporting cycle, nearly 90% were rated critical or high severity, and repeat offenders — SmarterTools, SolarWinds, Fortinet, Ivanti, and Cisco — continued to appear in both the CISA Known Exploited Vulnerabilities
Products
Cloud NGFWTwo zero-days in particular, affecting Ivanti Endpoint Manager Mobile and Palo Alto Networks Cloud NGFW, illustrate the continued attacker preference for network and device management platforms as an entry point intoIvanti Endpoint Manager Mobile (EPMM)Two zero-days in particular, affecting Ivanti Endpoint Manager Mobile and Palo Alto Networks Cloud NGFW, illustrate the continued attacker preference for network and device management platforms as an entry point intoREDCapmedical, regulatory, and military research organizations. The group compromises externally accessible REDCap environments, deploys web shells and custom malware, and has been observed creating malicious
Countries
Australia- [Australia and New Zealand](#australia-and-new-zealand)BrazilNotably, the Americas recorded the highest cybercriminal group count of any region (10) — including Brazil-originated Lapsus$ — pointing to a maturing, home-grown cybercriminal ecosystem in South America that operatesChinaof the 261 profiles observed (over 45%) — a reflection of the sheer number of state-sponsored programs China, North Korea, Iran, and Russia alone field across espionage, IP theft, and pre-positioning operations.Indonesia| **SharpPanda** | China | Indonesia, Malaysia, Thailand, Vietnam | Government |IranInstead, the group’s targeting was rhetorical, focusing on domestic political opponents such as Israeli left-wing figures and the judiciary, as well as geopolitical adversaries including Iran, Hamas, and Hezbollah.New Zealand- [Australia and New Zealand](#australia-and-new-zealand)North Korea261 profiles observed (over 45%) — a reflection of the sheer number of state-sponsored programs China, North Korea, Iran, and Russia alone field across espionage, IP theft, and pre-positioning operations.RussiaA diverse set of actors — including IT ARMY OF RUSSIA, “BLAZER TEAM ATTACK”, and various Indonesian-affiliated collectives — ran widespread campaigns combining DDoS attacks, website defacements, and data breaches,ThailandThis threat actor also gained spotlight in South Asia particularly for the extensive targeting of Thailand where it accounted for nearly 50% of all ransomware attacks. The European region, however, remained theUnited States| **UNC6508** | China (PRC-nexus espionage cluster) | United States, Canada | Education & Academic Research, Healthcare & Medical Research, Government/Regulatory, Aerospace & Defense |
Industries
Banking, Financial Services and Insurance (BFSI)while data-leak brokers like ‘tanaka’ ran industry-agnostic operations disproportionately impacting BFSI and Government & Law Enforcement entities.Constructionaccounted for a disproportionate share of claimed victims, with Manufacturing, Professional Services, Construction, and Healthcare bearing the brunt.Government & LEA- **367 Data Breach & Leak Incidents**: BFSI was followed by Government & LEA and Technology.Healthcaredisproportionate share of claimed victims, with Manufacturing, Professional Services, Construction, and Healthcare bearing the brunt.IT & ITES| **5** | **IT & ITES** | Compromising an IT or Managed Service Provider (MSP) can provide access to dozens of downstream client networks, magnifying the impact of a single breach. |ManufacturingINC Ransom, and The Gentlemen — accounted for a disproportionate share of claimed victims, with Manufacturing, Professional Services, Construction, and Healthcare bearing the brunt.Professional ServicesThe Gentlemen — accounted for a disproportionate share of claimed victims, with Manufacturing, Professional Services, Construction, and Healthcare bearing the brunt.RetailInitial access brokers such as ‘sanguine’ and ‘dark_alpha’ concentrated on Technology and Retail organizations, while data-leak brokers like ‘tanaka’ ran industry-agnostic operations disproportionately impacting BFSITechnologyInitial access brokers such as ‘sanguine’ and ‘dark_alpha’ concentrated on Technology and Retail organizations, while data-leak brokers like ‘tanaka’ ran industry-agnostic operations disproportionately impacting BFSITelecommunication| Aerospace & Defense, Education, BFSI, Energy & Utilities, Government, Healthcare, Manufacturing, Telecommunication, Transport, Media, IT |