The first half of 2026 reinforced a familiar reality in ransomware: a small number of highly capable operators continue to drive a disproportionate share of global attacks. Among them, Qilin ransomware emerged as the most active threat group tracked by Cyble Research and Intelligence Labs (CRIL), demonstrating the scale and reach of today’s ransomware-as-a-service (RaaS) ecosystem.
CRIL observed Qilin targeting organizations across multiple regions and industries, with activity spanning North
The first half of 2026 reinforced a familiar reality in ransomware: a small number of highly capable operators continue to drive a disproportionate share of global attacks. Among them, Qilin ransomware emerged as the most active threat group tracked by Cyble Research and Intelligence Labs (CRIL), demonstrating the scale and reach of today’s ransomware-as-a-service (RaaS) ecosystem.CRIL observed Qilin targeting organizations across multiple regions and industries, with activity spanning North America, Europe, Asia-Pacific, South America, and other global markets. Its widespread campaigns highlight how modern ransomware groups leverage affiliate networks, purchased access, and proven extortion techniques to maintain sustained operational momentum.
Qilin’s activity was particularly significant in North America, where the group accounted for 370 ransomware attacks during H1 2026. This represented nearly one-fifth of all ransomware incidents recorded in the region.The group also maintained a strong presence in Europe and the UK, claiming 158 attacks, while Asia-Pacific recorded 64 incidents linked to Qilin. In South America, the group was responsible for 40 attacks, further demonstrating its ability to operate across diverse geographic environments.Rather than concentrating on a single market, Qilin followed a broad targeting strategy designed to maximize opportunities across industries.
Targeting Sectors Where Downtime Hurts Most
Qilin’s victim profile reflected a common ransomware strategy: focusing on organizations where operational disruption creates immediate pressure.Manufacturing organizations remain especially attractive because ransomware incidents can interrupt production lines and affect supply chains. Healthcare organizations face additional pressure due to the critical nature. Construction, Healthcare, and Professional Services were among the sectors most frequently targeted. These industries often depend on continuous availability, hold sensitive information, and face significant financial or regulatory consequences when systems are disrupted.Manufacturing organizations remain especially attractive because ransomware incidents can interrupt production lines and affect supply chains. Healthcare organizations face additional pressure due to the critical nature of their services and the sensitivity of patient information.Professional Services firms, including legal and consulting organizations, also represent valuable targets because they manage confidential client data that can increase the impact of double-extortion campaigns.
The RaaS Model Behind Qilin’s Growth
Qilin’s success reflects the maturity of the ransomware-as-a-service model. Instead of relying on a single internal team to handle every stage of an attack, RaaS groups operate through specialized ecosystems that include affiliates, initial access brokers, and other underground service providers.This structure allows ransomware brands to expand quickly, launch simultaneous campaigns, and maintain activity even as individual operators face disruption.The continued success of groups like Qilin shows why ransomware remains difficult to contain. Law enforcement actions and infrastructure takedowns can affect individual operations, but decentralized affiliate models allow new campaigns to continue.
Defending Against the Qilin Threat
The group’s activity reinforces several priorities for organizations: reducing exposed attack surfaces, strengthening identity controls, monitoring suspicious access activity, and preparing for data theft alongside encryption.Since ransomware operators increasingly rely on stolen credentials and compromised infrastructure, security programs must focus on preventing initial access as much as responding to active attacks.
To explore Qilin’s attack patterns, global ransomware trends, targeted industries, and the broader threat landscape observed in H1 2026, download the complete Cyble H1 2026 Cyber Threat Landscape Report.
Ransomware often dominates cybersecurity headlines, but stolen data has become an equally valuable commodity in the cybercrime economy. In the first half of 2026, one threat actor stood out in the data leak ecosystem: Tanaka, a prolific data leak broker responsible for more publicized leak activity than any other actor tracked by Cyble.
Cyble researchers recorded 367 data breach and leak incidents worldwide between January and June 2026. While dozens of actors participated in selling or publ
Ransomware often dominates cybersecurity headlines, but stolen data has become an equally valuable commodity in the cybercrime economy. In the first half of 2026, one threat actor stood out in the data leak ecosystem: Tanaka, a prolific data leak broker responsible for more publicized leak activity than any other actor tracked by Cyble.Cyble researchers recorded 367 data breach and leak incidents worldwide between January and June 2026. While dozens of actors participated in selling or publishing stolen information, Tanaka emerged as the most active, accounting for 25 distinct leak posts — more than double the activity of several other major actors.
A Data Leak Operation Without Industry Boundaries
Unlike threat actors that specialize in a single vertical, Tanaka followed a broad targeting approach across multiple industries and regions. The actor’s campaigns showed no strict preference for a specific sector, instead focusing on organizations where stolen information could hold financial or strategic value.The Banking, Financial Services, and Insurance (BFSI) sector remained the most targeted industry globally, accounting for 38 breach incidents during the reporting period. Financial organizations continue to attract attackers due to the value of customer information, account data, and personally identifiable information (PII).Government and Technology organizations were also frequent targets, reflecting the wider value of sensitive records, intellectual property, and institutional data.
Regional Presence Across Major Markets
Tanaka’s activity was visible across multiple regions. In North America, the actor was responsible for seven leak posts, making it the most active data leak actor in the region alongside other prominent sellers.Europe and the UK also saw significant activity, with Tanaka linked to six leak posts during H1 2026. The region’s BFSI, Telecommunications, and Retail sectors faced heightened exposure due to the amount of valuable customer and financial data they hold.The actor’s global footprint demonstrates how modern data leak operations can function independently of geography. Instead of focusing on a single country or industry, operators like Tanaka exploit opportunities wherever valuable information becomes available.
The Rise of the Data Leak Marketplace
Tanaka’s activity reflects a broader shift in the cybercrime ecosystem. Data leaks are no longer only a byproduct of ransomware attacks; they have become a standalone business model.Threat actors monetize stolen information through underground marketplaces, using leaked databases for fraud, extortion, intelligence gathering, or resale. This specialization mirrors other parts of the cybercrime economy, where access brokers, ransomware affiliates, and data sellers perform separate roles.For organizations, this means a breach does not always begin with a ransomware demand. A stolen database appearing in underground channels may indicate an earlier compromise that requires immediate investigation.
Staying Ahead of Data Exposure Risks
Security teams must treat underground data exposure monitoring as part of their broader defense strategy. Identifying leaked credentials, compromised databases, or mentions in cybercrime marketplaces can provide early warning before stolen information is weaponized.To understand the 2026 data breach landscape, including the most active threat actors, targeted industries, and regional trends, access the full Cyble H1 2026 Cyber Threat Landscape Report.
The 2026 threat landscape continued to intensify in March, with ransomware attacks, expanding data breach activity, and a growing underground market for compromised access shaping the global cybersecurity environment. According to analysis from CRIL (Cyble Research & Intelligence Labs), organizations worldwide faced a highly active and coordinated threat ecosystem throughout the month.
CRIL’s findings point to a cybercriminal landscape driven by financial extortion, credential theft, and
The 2026 threat landscape continued to intensify in March, with ransomware attacks, expanding data breach activity, and a growing underground market for compromised access shaping the global cybersecurity environment. According to analysis from CRIL (Cyble Research & Intelligence Labs), organizations worldwide faced a highly active and coordinated threat ecosystem throughout the month.CRIL’s findings point to a cybercriminal landscape driven by financial extortion, credential theft, and operational disruption. Attackers consistently targeted industries that rely heavily on uptime or store large volumes of sensitive data, reinforcing the urgency for stronger defensive strategies.
Ransomware Attacks Dominate the 2026 Threat Landscape
One of the most defining aspects of the March 2026 threat landscape was the scale of ransomware attacks. CRIL recorded 702 ransomware incidents globally, underscoring the continued dominance of ransomware as a primary attack vector.Among the most active threat groups were Qilin, Akira, The Gentlemen, Dragonforce, and INC Ransom. Collectively, these actors were responsible for over 56% of all observed ransomware activity, reflecting their operational maturity and extensive affiliate networks.Industries most affected by ransomware attacks included:
Construction
Professional Services
Manufacturing
Healthcare
Energy & Utilities
Attackers frequently employed double-extortion tactics, combining data theft with system disruption to increase pressure on victims. Geographically, the United States remained the primary target, influenced in part by ongoing geopolitical tensions, including those involving Iran.
Rise of Access Brokers in the CRIL Threat Analysis
Another notable trend in the 2026 threat landscape, as identified by CRIL, was the continued growth of the compromised access market. During March, 20 separate incidents involving the sale of unauthorized network access were tracked across cybercrime forums.The most targeted sectors for access sales were:
Professional Services (25%)
Retail (20%)
IT & ITES
Manufacturing
A small group of threat actors, vexin, holyduxy, and algoyim, dominated this space, accounting for more than 55% of observed listings. These access brokers play a critical upstream role, enabling ransomware attacks, espionage campaigns, and financial fraud operations.
Data Breaches and Leak Markets Stay Active
CRIL also documented 54 significant data breach and leak incidents in March, further highlighting the scale of data exposure risks in the current 2026 threat landscape.The most targeted sectors for data breaches included:
Government & Law Enforcement
Retail
Technology
Several incidents stood out:
A threat actor known as “nightly” claimed to have stolen over 5TB of data from Hospitality Holdings, including biometric data, CCTV footage, and financial records.
Another actor, XP95, advertised 3.8TB of allegedly stolen South African government data for sale.
A separate breach exposed more than 95,000 travel-related records, including passport and payment information.
Exploitation of Critical Vulnerabilities Accelerates
The 2026 threat landscape also saw increased exploitation of critical vulnerabilities, particularly those listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.Key vulnerabilities targeted included:
CRIL observed attackers exploiting both newly disclosed zero-day vulnerabilities and older, unpatched flaws. This trend reflects persistent gaps in patch management and exposure mitigation across organizations.
Emerging Threat Developments in March 2026
Beyond ransomware attacks and data breaches, CRIL identified several strategic developments shaping the 2026 threat landscape:
AI-Driven Attacks: Threat actors reportedly leveraged an open-source framework called CyberStrikeAI to target Fortinet FortiGate devices across 55 countries, compromising more than 600 systems.
Supply Chain Risks: North Korean-linked actors were associated with 26 malicious npm packages distributing remote access trojans (RATs) via infrastructure hosted on Pastebin and Vercel.
Geopolitical Cyber Activity: Iran-linked cyber operations are expected to increase, with potential ransomware attacks and hacktivist campaigns targeting organizations in the Middle East.
Entrar
