Coveware: Q2 2026 Extortion Data Shows Rising Identity Abuse and Volatile Ransom Outcomes
Summary
Coveware’s Q2 2026 analysis reports a 176% quarter-over-quarter rise in average ransom payments, a record-low payment rate, and continued identity-driven access. It highlights volatile post-payment outcomes and recommends hardening trusted access paths.
Key points
- Operation Cronos revealed that LockBit retained victims’ stolen data despite promises to delete it after payment, showing that payment did not guarantee data removal.
- The article describes an Icarus supply-chain compromise of Klue in which millions of customer CRM records were reportedly exfiltrated; a purported ransom payment did not prevent a separate criminal group from retaining victim names and data samples.
- Coveware attributes unusually large Q2 payments partly to Silent Ransom, also known as Luna Moth, which targeted law firms using vishing and, in some cases, physical impersonation of IT staff.
- Average ransom payments rose 176% from Q1 to $1,880,612, while the median was $150,000; a few large data-exfiltration extortions skewed the average.
- The share of clients choosing to pay fell to a record low, and the data-exfiltration-only payment rate was 15%.
- Phishing, social engineering, credential abuse, account recovery and other trusted identity workflows were prominent access paths. Coveware recommends phishing-resistant MFA and tighter monitoring and controls for account recovery, OAuth grants, remote access and vendor access.
- Lateral movement and exfiltration each appeared in 76% of cases; command and control appeared in 69%, and discovery in 52%.
Article Details
- Publisher
- Coveware
- Report Period
- Q2 2026
- Scope
- Coveware-observed ransomware and cyber extortion cases, with selected historical examples.
- Sample Size
- Not disclosed
- Key Statistics
- The average ransom payment in Q2 2026 was $1,880,612, up 176% from Q1 2026.
- The median ransom payment was $150,000, down 50% from Q2 2022.
- The data-exfiltration-only payment rate was 15%, described as a historically low level.
- Lateral Movement and Exfiltration each appeared in 76% of cases.
- Command and Control appeared in 69% of cases, up 11% from the prior quarter.
- Recommendations
- Treat help desk, password and MFA resets, device enrollment, and account recovery workflows as security controls.
- Prioritize phishing-resistant MFA for privileged, remote-access, SaaS, cloud, and backup administrator accounts.
- Monitor remote access broadly, including SaaS administration portals, cloud consoles, RMM tools, APIs, and delegated access.
- Audit OAuth grants, API tokens, service principals, connected apps, and delegated permissions; tighten vendor and MSP access with named accounts, least privilege, logging, time limits, and disciplined offboarding.
- Patch and monitor internet-facing appliances and management planes; prepare to contain lateral movement, disrupt remote control, assess exfiltration, and execute recovery decisions.
MITRE ATT&CK
T1021 · Remote ServicesThe report describes lateral movement using remote services including RDP, SMB, WinRM, WMI, and SSH.T1078 · Valid AccountsThe report describes intrusions using stolen credentials and trusted identity workflows to log in through seemingly legitimate access paths.T1135 · Network Share DiscoveryThe report identifies network-share enumeration as an observed discovery behavior.T1219 · Remote Access ToolsThe report describes use of RMM platforms, remote desktop utilities, mesh VPNs, and similar tools for command and control.T1566.004 · Spearphishing VoiceSilent Ransom used voice-phishing calls to manipulate employees into providing credentials or remote access.T1567 · Exfiltration Over Web ServiceThe report describes exfiltration using legitimate web services, cloud storage, and file-transfer tools.
Threat Actors
AkiraListed among the most common ransomware threat actors in Coveware’s Q2 2026 cases, with 8% market share.DragonForceListed among the most common ransomware threat actors in Coveware’s Q2 2026 cases, with 4% market share.IcarusThe article attributes the June 2026 SaaS supply-chain attack on Klue to Icarus, reporting that the attackers exfiltrated sensitive customer CRM records.LockBitOperation Cronos revealed that LockBit retained victims’ stolen data despite promises to delete it after ransom payment.Lone WolfListed as the most common ransomware threat actor category in Coveware’s Q2 2026 cases, with 17% market share.ShinyHuntersListed among the most common ransomware threat actors in Coveware’s Q2 2026 cases, with 12% market share.Silent RansomThe article describes Silent Ransom as targeting law firms through vishing and physical infiltration, and reports that its data-exfiltration extortion operations secured large payments.Silent Ransom GroupThe article identifies Luna Moth as another name for Silent Ransom, which it describes as targeting law firms through vishing and physical infiltration.The GentlemenListed among the most common ransomware threat actors in Coveware’s Q2 2026 cases, with 8% market share.
Malware
Industries
Financial ServicesIn Q2, the most represented industries in Coveware cases were Software Services at 17.2%, Healthcare at 14.1%, Professional Services at 13.1%, Financial Services at 9.1%, and Materials at 9.1%.HealthcareIn Q2, the most represented industries in Coveware cases were Software Services at 17.2%, Healthcare at 14.1%, Professional Services at 13.1%, Financial Services at 9.1%, and Materials at 9.1%.MaterialsIn Q2, the most represented industries in Coveware cases were Software Services at 17.2%, Healthcare at 14.1%, Professional Services at 13.1%, Financial Services at 9.1%, and Materials at 9.1%.Professional ServicesIn Q2, the most represented industries in Coveware cases were Software Services at 17.2%, Healthcare at 14.1%, Professional Services at 13.1%, Financial Services at 9.1%, and Materials at 9.1%.Public SectorHigh-impact sectors such as Healthcare and Public Sector can experience outsized disruption because downtime tolerance is low and response capacity is often constrained, even when the intrusion itself is not especiallySoftware ServicesIn Q2, the most represented industries in Coveware cases were Software Services at 17.2%, Healthcare at 14.1%, Professional Services at 13.1%, Financial Services at 9.1%, and Materials at 9.1%.