AhnLab’s September 2026 Ransomware Report Details Group Activity and Victim Trends
Summary
AhnLab’s September 2026 report summarizes ransomware activity, including 470 incidents attributed to the top 10 groups, affected sectors and regions, new groups, and several officially announced disruptions in Japan.
Key points
- The report draws on ATIP and AhnLab Smart Defense data, as well as ransomware groups’ Dedicated Leak Site posts; AhnLab cautions that changes to its business-target statistics since February 2025 limit direct comparisons with earlier figures.
- The top 10 ransomware groups were associated with 470 incidents, up from 453 the previous month; The Gentlemen led with 102, followed by Qilin with 78.
- Information and communication had the highest sector count at 39, followed by manufacturing at 29; the US led reported incidents by country with 88.
- AhnLab reported activity from established groups and new entrants, including Vladivostok, Vexy, and BlackLocks; Vladivostok released a leak site, and Vexy began a RaaS affiliate program.
- AUDIT TEAM posted gownet[.]Net and dg[.]Ac[.]Kr, which the report says were not confirmed to be actual existing domains.
- In Japan, Keio Corporation, Keio Plaza Hotel, and Tottori Prefecture’s radiation monitoring system officially reported ransomware damage. Keio reported some business-system disruptions; Tottori said its backup servers remained unaffected and monitoring continued.
- The report recommends prompt vulnerability patching, reviewing third-party access, network segmentation, stronger backups, threat intelligence, and continuous monitoring.
Article Details
- Publisher
- Asec Ahnlab
- Report Period
- September 2026
- Scope
- Ransomware samples, compromised systems, affected businesses, and major Korean and global ransomware incidents, based on ATIP, AhnLab Smart Defense, and DLS information.
- Key Statistics
- The top 10 industry sectors accounted for 140 reported incidents of damage in September 2026.
- The top 10 countries accounted for 159 reported incidents of damage; the US had the highest count, at 88.
- The top 10 ransomware groups were associated with 470 incidents, up from 453 in the previous month.
- The Gentlemen was associated with 102 incidents, and Qilin with 78, among the top 10 groups.
- Panzer claimed 19 victim organizations since emerging in August; this is a group claim reported by the article.
- Recommendations
- Promptly apply vulnerability patches.
- Review third-party and supply-chain access permissions.
- Implement network segmentation and strengthen data backups.
- Use threat intelligence and enhance continuous monitoring.
Threat Actors
AkiraListed among the top 10 ransomware groups by reported affected-company count, with 47 incidents.AuditTeamGroup reported to have posted gownet.Net and dg.Ac.Kr; the article says these were not confirmed to be actual existing domains.BlackLockReported to have posted Gwangmyeong Industry as its first victim.BlackLocksIdentified as a new group in the report.Cl0pRansomware group reported to have revealed new DLS and onion domains after ShinyHunters compromised an existing DLS, and posted organizations as attack targets.DarkProjectListed among the top 10 ransomware groups by reported affected-company count, with 27 incidents.emperadorRansomware group reported to have targeted AB Electrolux and RDA MOTORS S.P.A.EverestRansomware group reported to have attacked UNIRITA.incransomListed among the top 10 ransomware groups by reported affected-company count, with 31 incidents.KillSecurityListed among the top 10 ransomware groups by reported affected-company count, with 37 incidents.KrybitListed among the top 10 ransomware groups by reported affected-company count, with 34 incidents.LockBitRansomware group reported to have listed SPG and targeted Siinqee Bank.metaencryptorRansomware group reported to have targeted organizations in South Korea, Japan, and the US.PanzerGroup reported to claim 19 victim organizations since emerging in August and to operate a RaaS model.QilinRansomware group reported to have targeted organizations in Japan, the US, and the Philippines; associated with 78 incidents among the top 10 groups.RansomHouseRansomware group reported to have targeted Pertamina, the Namibian Defense Force, and REXT Holdings Co., Ltd.RhysidaRansomware group reported to have targeted General Santos Doctors Hospital and Széchenyi Programiroda Nonprofit Kft.RhysidaarchiveListed among the top 10 ransomware groups by reported affected-company count, with 45 incidents.SafepayRansomware group reported to have attacked Ryomo Systems.ShinyHuntersReported to have compromised an existing CL0P DLS.SovcaliReported to have shared 159 GB of design data for Lucid Motors’ next-generation midsize vehicle on Rehub.StormGroup reported to have targeted US financial and advisory institutions and a company in Canada.The GentlemenRansomware group reported to have targeted organizations in multiple countries and associated with 102 incidents among the top 10 groups.Vexy RansomwareNew group reported to have attacked companies in Ecuador and Brazil and begun operating a RaaS affiliate program.VladivostokNew group reported to have released a DLS and recruited collaborators.
Products
AhnLab Smart DefenseThe analysis is based on data collected through ATIP (AhnLab Threat Intelligence Platform) and AhnLab Smart Defense, as well as information posted on DLS (Dedicated Leak Sites, which disclose affected companies) byATIPThe analysis is based on data collected through ATIP (AhnLab Threat Intelligence Platform) and AhnLab Smart Defense, as well as information posted on DLS (Dedicated Leak Sites, which disclose affected companies) by
Countries
BrazilBy region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each.CanadaBy region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each.EcuadorAmong the new groups, Vladivostok released a DLS and recruited collaborators, while Vexy attacked two companies in Ecuador and Brazil and began operating a RaaS affiliate program.FranceBy region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each.GermanyBy region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each.IndiaBy region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each.ItalyGermany GoreSpiders government Gunra Healthcare Hungary India Indonesia 스페인 스웨덴 우루과이 튀르키예 IT-services Italy 페루 이탈리아 인도 인도네시아 일본 캐나다 탄자니아 영국 에콰도르 에티오피아 헝가리 사우디아라비아 프랑스 한국 아르헨티나 필리핀 앙골라 싱가포르 Japan kazu KillSec KryBitJapanThe Gentlemen targeted Aware and Veradigm in the US, Air Canada in Canada, the Japanese restaurant franchise Sarku Japan, TENTAC in Japan, and the Zanini Auto Group in Spain.NamibiaJapan kazu KillSec KryBit LockBit logistics Malaysia Manufacturing MedusaLocker MetaEncryptor Myanmar namibia norway Panzer Peru Philippines PwnForums Qilin RaaS RansomHouse Ransomware Rehub Rhysida SafepayPhilippinesIn Japan; ADM and Colonial Hyundai in the US; and the Philippine Ports Authority in the Philippines.South KoreaBy region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each.SpainBy region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each.
Industries
Constructionscientific, and technical services with 19, Health and social welfare services with 17, and Construction with 7.Energyattacks also continued in the information and communication, finance, government and public sectors, energy, transportation and logistics, and healthcare sectors.financesuffered the most widespread damage, while attacks also continued in the information and communication, finance, government and public sectors, energy, transportation and logistics, and healthcare sectors.Government and public sectorsdamage, while attacks also continued in the information and communication, finance, government and public sectors, energy, transportation and logistics, and healthcare sectors.Health and social welfare servicesand distribution with 13, Professional, scientific, and technical services with 19, Health and social welfare services with 17, and Construction with 7.Healthcareand communication, finance, government and public sectors, energy, transportation and logistics, and healthcare sectors.Information and communicationAs of September 2026, the Information and communication sector had the highest number of incidents with 39, followed by Manufacturing with 29, Wholesale and distribution with 13, Professional, scientific, and technicalManufacturingthe Information and communication sector had the highest number of incidents with 39, followed by Manufacturing with 29, Wholesale and distribution with 13, Professional, scientific, and technical services with 19,Professional, scientific, and technical serviceswith 39, followed by Manufacturing with 29, Wholesale and distribution with 13, Professional, scientific, and technical services with 19, Health and social welfare services with 17, and Construction with 7.Transportation and Logisticsin the information and communication, finance, government and public sectors, energy, transportation and logistics, and healthcare sectors.Wholesale and distributionsector had the highest number of incidents with 39, followed by Manufacturing with 29, Wholesale and distribution with 13, Professional, scientific, and technical services with 19, Health and social welfare