CYFIRMA Report Tracks January 2026 Ransomware Trends and Tactics
Summary
CYFIRMA’s January 2026 report compares ransomware activity, victims, industries and countries, and describes trends including browser-mediated access, brokered intrusion, persistent loaders, data theft and delayed extortion.
Key points
- The report counts 683 ransomware incidents in January 2026, compared with 511 in January 2025 and 284 in January 2024; it reports 801 incidents in December 2025.
- Among the listed groups, Qilin had the most reported victims in January at 107, down from 175 in December; LockBit was nearly unchanged at 90, compared with 92.
- Professional Goods & Services had the most reported victims by industry (142), followed by manufacturing (109) and information technology (78).
- The United States led the report’s country figures with 317 victims; the UK had 42 and Canada 37.
- The report describes growing use of trusted browser interactions and brokered initial access, distinguishing the browser-mediated approach from browser vulnerability exploitation.
- It highlights long-lived loaders, silent data theft and delayed extortion, and says ransomware operations increasingly separate access acquisition from extortion.
- Recommendations include employee training, incident response planning, patching, network segmentation and multifactor authentication.
Article Details
- Publisher
- CYFIRMA
- Report Period
- January 2026
- Scope
- Global ransomware activity, including victim counts, targeted industries, geography, and reported business impacts.
- Key Statistics
- The report records 683 ransomware incidents in January 2026, compared with 511 in January 2025 and 284 in January 2024.
- December 2025 had 801 incidents, described as the highest monthly total in the report's 2023–2026 dataset.
- Qilin had 107 reported victims in January 2026, down from 175 in December 2025; Lockbit had 90, down from 92.
- Professional Goods & Services had 142 reported victims in January 2026, Manufacturing 109, and Information Technology 78.
- The United States had 317 reported victims in January 2026, followed by the United Kingdom with 42 and Canada with 37.
- Recommendations
- Conduct regular employee training on phishing, social engineering, and safe online practices.
- Develop and regularly update an incident response plan.
- Regularly apply security patches to software and systems.
- Implement network segmentation to limit ransomware lateral movement.
- Enable multi-factor authentication for privileged accounts and critical systems.
Threat Actors
AkiraNamed among the ransomware groups tracked in the report; it had 51 reported victims in January 2026, down from 66 in December 2025.Coinbase CartelNamed among the ransomware groups tracked in the report; it had 25 reported victims in January 2026, up from 22 in December 2025.DevManNamed among the ransomware groups tracked in the report; it had 39 reported victims in January 2026, down from 48 in December 2025.DragonForceNamed among the ransomware groups tracked in the report; it had 32 reported victims in January 2026, down from 33 in December 2025.incransomNamed among the ransomware groups tracked in the report; it had 28 reported victims in January 2026, down from 32 in December 2025.LockBitNamed among the ransomware groups tracked in the report; it had 90 reported victims in January 2026, down from 92 in December 2025.PlayNamed among the ransomware groups tracked in the report; it had 26 reported victims in January 2026, up from 22 in December 2025.QilinNamed among the ransomware groups tracked in the report; it had 107 reported victims in January 2026, down from 175 in December 2025.SafepayNamed among the ransomware groups tracked in the report; it had 56 reported victims in January 2026, down from 68 in December 2025.sinobiNamed among the ransomware groups tracked in the report; it had 47 reported victims in January 2026, down from 50 in December 2025.
Countries
AustraliaModerate activity levels were observed in Australia (17), France (13), India (12), and Spain (12), indicating continued targeting of highly digitized economies.CanadaThe United Kingdom (42) and Canada (37) followed at a considerable distance, with Germany (24) and Italy (20) forming the next most impacted tier.FranceModerate activity levels were observed in Australia (17), France (13), India (12), and Spain (12), indicating continued targeting of highly digitized economies.GermanyThe United Kingdom (42) and Canada (37) followed at a considerable distance, with Germany (24) and Italy (20) forming the next most impacted tier.IndiaModerate activity levels were observed in Australia (17), France (13), India (12), and Spain (12), indicating continued targeting of highly digitized economies.ItalyThe United Kingdom (42) and Canada (37) followed at a considerable distance, with Germany (24) and Italy (20) forming the next most impacted tier.MalaysiaAcross Asia-Pacific and other regions, activity was more distributed and remained in single-digit to low double-digit ranges, including Malaysia (9), Taiwan (8), Turkey (8), Poland (8), Hong Kong (7), and Mexico (7).MexicoAcross Asia-Pacific and other regions, activity was more distributed and remained in single-digit to low double-digit ranges, including Malaysia (9), Taiwan (8), Turkey (8), Poland (8), Hong Kong (7), and Mexico (7).PolandAcross Asia-Pacific and other regions, activity was more distributed and remained in single-digit to low double-digit ranges, including Malaysia (9), Taiwan (8), Turkey (8), Poland (8), Hong Kong (7), and Mexico (7).SpainModerate activity levels were observed in Australia (17), France (13), India (12), and Spain (12), indicating continued targeting of highly digitized economies.TaiwanAcross Asia-Pacific and other regions, activity was more distributed and remained in single-digit to low double-digit ranges, including Malaysia (9), Taiwan (8), Turkey (8), Poland (8), Hong Kong (7), and Mexico (7).TurkeyAcross Asia-Pacific and other regions, activity was more distributed and remained in single-digit to low double-digit ranges, including Malaysia (9), Taiwan (8), Turkey (8), Poland (8), Hong Kong (7), and Mexico (7).United KingdomThe United Kingdom (42) and Canada (37) followed at a considerable distance, with Germany (24) and Italy (20) forming the next most impacted tier.United StatesGeographically, ransomware remains dominated by the United States and Western Europe, but with sustained expansion across Asia-Pacific and emerging markets, reflecting a truly global and opportunistic threat.
Industries
Automotiveof targeting were observed in Finance (34), Telecommunications & Media (36), Energy & Utilities (27), Automotive (26), Transportation & Logistics (28), and Education (23), alongside 28 obfuscated or unidentifiedConsumer Goods & ServicesConsumer Goods & Services (73) and Real Estate & Construction (62) remained heavily targeted, indicating continued focus on sectors with operational disruption potential.Education& Media (36), Energy & Utilities (27), Automotive (26), Transportation & Logistics (28), and Education (23), alongside 28 obfuscated or unidentified victims.Energy & Utilitiesbut meaningful levels of targeting were observed in Finance (34), Telecommunications & Media (36), Energy & Utilities (27), Automotive (26), Transportation & Logistics (28), and Education (23), alongside 28 obfuscatedfinanceLower but meaningful levels of targeting were observed in Finance (34), Telecommunications & Media (36), Energy & Utilities (27), Automotive (26), Transportation & Logistics (28), and Education (23), alongside 28Government & civicHealthcare (55) and Materials (49) experienced notable activity, while Government & Civic entities recorded 44 incidents, highlighting ongoing public-sector exposure.HealthcareHealthcare (55) and Materials (49) experienced notable activity, while Government & Civic entities recorded 44 incidents, highlighting ongoing public-sector exposure.Information Technologycontinued concentration on high-value sectors, such as professional services, manufacturing, and information technology.Manufacturingrebounds, and continued concentration on high-value sectors, such as professional services, manufacturing, and information technology.MaterialsHealthcare (55) and Materials (49) experienced notable activity, while Government & Civic entities recorded 44 incidents, highlighting ongoing public-sector exposure.Professional Goods & Servicesransomware targeting continued to concentrate on high-impact and data-rich sectors, with Professional Goods & Services further solidifying its position as the most affected industry at 142 victims, reinforcingreal estate & constructionConsumer Goods & Services (73) and Real Estate & Construction (62) remained heavily targeted, indicating continued focus on sectors with operational disruption potential.Telecommunications & MediaLower but meaningful levels of targeting were observed in Finance (34), Telecommunications & Media (36), Energy & Utilities (27), Automotive (26), Transportation & Logistics (28), and Education (23), alongside 28Transportation and Logisticsin Finance (34), Telecommunications & Media (36), Energy & Utilities (27), Automotive (26), Transportation & Logistics (28), and Education (23), alongside 28 obfuscated or unidentified victims.