Security Report · github.com/jacobdjwilson

CYFIRMA Reports 1,046 Ransomware Victim Claims in August 2026, Up 18.2%

Oct 21, 2026 · Original Report (PDF) ↗

Summary

CYFIRMA tracked 1,046 publicly claimed ransomware victims in August 2026, up 18.2% from July. Qilin led with 150 claims. The report highlights VPN exploitation, persistent appliance implants and identity theft; victim claims remain unverified.

Key points

The report covers August 1–31, using ransomware leak sites and public disclosures; counts may include duplicate, disputed or historical claims and exclude undisclosed incidents.
Public victim claims rose from 885 in July to 1,046 in August. Qilin accounted for 150, followed by The Gentlemen with 95 and Cl0p with 90.
The United States represented 431 claims, or 41%, across a total footprint of 77 countries. Professional Goods & Services and Manufacturing led sector counts with 174 and 153 respectively.
Cl0p’s increase from one to 90 claims may reflect batch publication rather than a comparable increase in operational activity; delayed disclosure could also affect other group rankings.
The report cites public reporting linking INC Ransom operators to exploitation of SonicWall SMA 1000 through CVE-2026-15409 and CVE-2026-15410.
Reported appliance intrusion techniques include persistent implants, Java-process injection, covert tunnels, and theft of credentials, sessions and MFA seeds, potentially preserving access after patching.
Recommended responses to compromised remote-access appliances include integrity assessment, re-imaging, credential and session rotation, and identity invalidation rather than relying on patches alone.

Article Details

Publisher: Cyfirma
Report Period: 2026-08-01 to 2026-08-31
Scope: Global ransomware activity monitored through group leak sites and public disclosures.
Sample Size: 1,046 publicly claimed victims; not independently verified and potentially including duplicated, re-posted, disputed, or historical victims. Undisclosed incidents are excluded.
Key Statistics: Publicly claimed victims increased from 885 in July 2026 to 1,046 in August 2026, an increase of 18.2%.
Qilin led August activity with 150 claimed victims, followed by The Gentlemen with 95 and Cl0p with 90.
The United States accounted for 431 of 1,046 publicly claimed victims, approximately 41%.
Publicly claimed victims were identified in 77 countries during August 2026.
Professional Goods & Services recorded 174 claimed victims and Manufacturing recorded 153, the highest reported sector counts for August 2026.
Recommendations: Prioritize emergency patching of internet-facing VPN and remote-access appliances, followed by compromise assessment rather than assuming patching removes existing access.
After appliance compromise, rebuild or re-image affected systems and invalidate compromised credentials, sessions, and MFA seed material.
Monitor appliance processes, init-script changes, listening ports, Java injection artifacts, and anomalous localhost or outbound tunnels.
Require managed remote-access providers to maintain emergency patching SLAs, shared telemetry, clear response ownership, and re-imaging rights.
Restrict Run-dialog and script-host abuse, alert on unusual PowerShell and rundll32 execution chains, and train users to recognize fake CAPTCHA and repair prompts.