A Ukrainian ransomware affiliate has been sentenced to 70 months in prison for participating in cyberattacks against hospitals, businesses, law firms and government entities across multiple countries. Artem Stryzhak, 36, was sentenced in the United States for his role in ransomware conspiracies linked to more than $100 million in losses, according to the U.S. Department of Justice (DOJ).
Stryzhak worked with the Nefilim ransomware and Hive ransomware groups, targeting computer networks and disrupting operations across different sectors. The attacks included incidents affecting healthcare providers during the COVID-19 pandemic, when hospitals faced disruptions to their ability to access digital systems and treat patients.
Ukrainian Ransomware Affiliate Linked to Two Groups
According to court documents, Stryzhak joined the Nefilim ransomware operation around June 2021 as an affiliate. He received access to the group's ransomware under an arrangement with administrator Volodymyr Tymoshchuk and agreed to pay the administrators 20% of the ransom proceeds collected from victims.
One documented attack took place in June 2021, when Stryzhak stole data from a company operating in the oil and gas transportation industry. About a week later, he created email addresses that were incorporated into a ransom note sent to the company.
The attackers used ransomware to encrypt victims' files and demanded payment. If a victim paid, the perpetrators provided a decryption key to restore access to the locked data.
Stryzhak remained involved in the Nefilim conspiracy until at least October 2021, court records state.
He separately joined the Hive ransomware group as one of its earliest affiliates. Between June 2021 and January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals and businesses.
The Hive ransomware operation caused significant disruption to organizations, including healthcare facilities responding to the COVID-19 pandemic.
According to the DOJ, one hospital targeted by the group had to stop relying on digital technology to treat existing patients and was temporarily unable to accept new patients immediately following the attack.
As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims. These included law firms, a dental office and a healthcare provider during the pandemic.
The attacks left victims unable to access encrypted data, affecting their day-to-day operations.
The FBI had previously conducted a months-long disruption campaign against Hive. During that effort, investigators obtained a decryption key and provided it to one of Stryzhak's victims, enabling the organization to recover its encrypted data without paying a ransom.
FBI Investigation Spanned Multiple Countries
The investigation involved several FBI field offices and international law enforcement partners.
The FBI Springfield Field Office investigated the Nefilim ransomware case, while the FBI Tampa Field Office investigated the Hive operation. The FBI's New York Field Office, the Justice Department's Office of International Affairs and Spanish law enforcement authorities also assisted in locating, arresting and extraditing Stryzhak.
He was arrested in Spain in June 2024 and extradited to the United States in April 2025. In December 2025, he pleaded guilty to two counts of conspiracy involving fraud, extortion and related activity connected to computers.
The sentence follows a broader effort by U.S. authorities to pursue ransomware affiliates and their associates, including individuals operating outside the country.
$11 Million Reward Offered for Co-Conspirator
Authorities are continuing to seek Volodymyr Viktorovych Tymoshchuk, identified by prosecutors as Stryzhak's co-conspirator and a ransomware developer.
The U.S. Department of State's Transnational Organized Crime Rewards Program is offering up to $11 million for information leading to Tymoshchuk's arrest and/or conviction or location.
Individuals with information can contact the FBI at +1-917-242-1407, email TymoTips@fbi.gov, contact a local FBI field office in the United States or approach the nearest U.S. Embassy overseas.
The DOJ's Computer Crime and Intellectual Property Section, which investigates and prosecutes cybercrime in coordination with domestic and international partners, has secured more than 180 convictions involving cybercrime and intellectual property offenses since 2020. The department also reports obtaining court orders for the return of more than $350 million in victim funds during that period.
Stryzhak's sentence highlights the consequences for individuals who participate in ransomware operations that target critical services and businesses. The investigation into his alleged co-conspirators remains ongoing.
The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and Australia.
The advisory was released by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the United States Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency and the UK’s North West Regional Organised Crime Unit. It draws on investigations conducted as recently as August 2026.
How SafePay Ransomware Gains Initial Access
According to the agencies, SafePay actors break into networks by stealing or guessing passwords, running brute force attacks, using phishing and exploiting VPN access. The group uses IP addresses from the VPN provider Mullvad and phished account profiles to exploit two flaws in edge devices: CVE-2020-3259 and CVE-2023-20269.
The actors also use automated scripts to exploit three vulnerabilities in internet-exposed systems: CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
Living Off the Land Inside Victim Networks
Once inside, SafePay actors establish persistence by gaining administrative privileges on existing accounts or creating new ones. They rely on built-in tools such as PsExec, Windows Remote Management and Remote Desktop Protocol to execute commands and move laterally.
To find valuable files, the group has used ShareFinder.ps1 and SharpShares.exe to enumerate network shares. Before moving laterally, the actors commonly disable security software. In some cases, they changed system users’ passwords, locking legitimate users out. The advisory also notes the use of a User Account Control bypass, token impersonation and the credential dumper Mimikatz.
Data Exfiltration Before Encryption
Data exfiltration is a central part of the group’s playbook. SafePay actors compress files using 7-Zip, WinRAR, FileZilla and RClone, then move stolen data out through WinSCP, RClone, OneDrive and the Backblaze command-line tool b2.exe. Remote desktop tools such as AnyDesk and TeamViewer have been installed to transfer ransomware onto victim systems.
To block recovery, the actors halt the Volume Shadow Copy Service and reset network attached storage holding backups to factory settings.
Files are then encrypted using a hybrid scheme combining the ChaCha20 stream cipher with RSA public-key cryptography. Encrypted files carry the .SafePay extension and, according to the advisory, cannot be recovered without the decryption key.
The group typically demands a portion of company revenue in cryptocurrency. A ransom note left on the desktop or root directory directs victims to a TOR chat portal, using a victim ID to log in. A representative also makes phone calls to pressure victims. If payment is refused, stolen data is posted to SafePay’s leak site. The ransomware may delete itself after encryption.
SafePay Ransomware Advisory: Recommended Defenses
To reduce the risk of ransomware attacks from SafePay, the agencies urge organizations to prioritize patching known exploited vulnerabilities, especially on firewalls and other internet-facing systems. They recommend requiring multifactor authentication for webmail, VPNs and accounts that access critical systems.
Other measures include passwords of 15 to 64 characters, account lockouts after failed logins, offline backups that are encrypted and immutable, network segmentation, least privilege access and time-based admin access. The advisory also recommends restricting command-line and scripting permissions.
The advisory lists IP addresses, file names, hashes and hostnames observed between November 2024 and August 2026. The agencies advise verifying these indicators before blocking, as some IP addresses may later be reassigned to benign services.
The authoring agencies do not encourage paying ransom, noting payment does not guarantee file recovery. Incidents can be reported to the FBI’s Internet Crime Complaint Center, a local FBI or Secret Service field office, or CISA. In the UK, victims can report through Report Fraud or their local police force.
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content. Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
A Ransom Cartel ransomware leader has been sentenced to 16 years in prison after being convicted of conspiracy to commit offenses against the United States, conspiracy to commit wire fraud, and aggravated identity theft, according to the U.S. Department of Justice.
Maksim Silnikau, a 40-year-old Belarusian national, was identified in court documents as the creator and administrator of the Ransom Cartel ransomware strain, which was developed in 2021. Silnikau had been active on Russian-speaking cybercrime forums since at least 2005 and was also a member of the cybercrime website Direct Connection between 2011 and 2016.
Ransom Cartel Ransomware Operation
Beginning in May 2021, Silnikau developed the ransomware scheme and recruited participants through cybercrime forums. He distributed information and tools to participants, including stolen credentials linked to compromised computers and tools designed to encrypt or lock those systems.
Silnikau also maintained a hidden website used by himself and his co-conspirators to monitor and control ransomware operations. According to the court documents, the website provided a platform for the group to communicate with one another, interact with victims, send and negotiate ransom demands, and manage the distribution of funds among the conspirators.
The operation targeted companies between 2021 and 2023. During that period, Ransom Cartel ransomware conspirators carried out attacks against at least 18 companies around the world, including organizations based in California, New York, Nebraska, and other countries outside the United States.
Ransomware Attacks Targeted Companies Worldwide
The ransomware attacks involved data theft and monetary demands. The attackers sought payment in exchange for providing keys to unlock stolen data or for promises not to publish the information taken from victims.
The operation’s growth was disrupted following Silnikau’s arrest in July 2023. He was later extradited from Poland to face prosecution in the Eastern District of Virginia and the District of New Jersey.
The sentencing announcement was made by Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia; Acting Special Agent in Charge Andrew Forrest of the U.S. Secret Service Criminal Investigative Division; Chris Ormerod, Special Agent in Charge of the FBI Kansas City Field Office; and Craig L. Tremaroli, Special Agent in Charge of the FBI Albany Field Office.
Maksim Silnikau Sentenced to 16 Years
The Justice Department’s Office of International Affairs provided substantial assistance with Silnikau’s extradition and the collection of evidence. The U.S. Attorney’s Office for the District of New Jersey and the Computer Crime and Intellectual Property section also assisted with the case.
Assistant U.S. Attorney Jonathan S. Keim and former Assistant U.S. Attorney Zoe Bedell prosecuted the case.
The 16 years in prison sentence follows the disruption of an international ransomware operation that targeted at least 18 companies during its active period. Silnikau’s role, according to court documents, extended across the development and administration of the ransomware strain, recruitment of participants, provision of attack tools, victim communications, and management of funds generated through the operation.
Europe faced a ransomware onslaught in the first half of 2026 that sets a troubling precedent for the remainder of the year. According to Cyble Research and Intelligence Labs (CRIL), the region experienced 866 documented ransomware attacks, 51 confirmed data breach incidents, and 7 initial access sales between January and June 2026. These figures represent not just a volume problem, but a fundamental shift in how threat actors are organizing, targeting, and monetizing their operations within European territory.
What distinguishes the ransomware threats in Europe from other global regions is the concentration of power among a small number of highly sophisticated threat actors. While the threat ecosystem encompasses dozens of groups, five dominant ransomware operators account for approximately 55% of all documented activity. This concentration creates predictability—European security leaders can now identify, profile, and build specific defensive strategies against known adversaries.
The Five Dominant Ransomware Groups Targeting Europe
1. Qilin: The Biggest Ransomware Threat in Europe
Attack Volume: 158 documented incidents (18.2% of regional total)
Qilin stands as the dominant ransomware threat actor targeting Europe, commanding operational superiority through sophisticated affiliate management, rapid exploit weaponization, and industry-specific targeting intelligence.
Qilin's dominance stems from understanding European organizational economics. Construction projects operate under time-sensitive contracts with contractually-defined penalties for delay. A single day of downtime on a €50 million construction project can trigger cascading costs exceeding €100,000. This economic reality translates directly into ransom payment likelihood, making Qilin's targeting strategy rational and highly effective.
The group maintains an extensive affiliate network capable of concurrent operations across multiple European nations. Evidence suggests Qilin has compartmentalized its operations: initial access brokers handle reconnaissance and network compromise, mid-tier operators manage lateral movement and privilege escalation, and final-stage operators execute encryption and exfiltration. This division of labor enables rapid scaling and reduces attribution risk.
Why Qilin Dominates:
Industry Expertise: Deep understanding of construction project timelines and financial exposure
Exploit Library: Rapid weaponization of both known and zero-day vulnerabilities
Data Monetization: Established data brokerage partnerships ensure exfiltrated data reaches buyers
European Security Implications: Organizations in construction, professional services, and manufacturing should treat Qilin as their primary threat actor concern. Defensive strategies must prioritize data exfiltration prevention, network segmentation, and immutable backup infrastructure.
2. The Gentlemen: The Rising European Threat
Attack Volume: 144 documented incidents (16.6% of regional total)
The Gentlemen represent an emerging threat actor that has achieved remarkable scale in a relatively short operational window. Unlike established groups that evolved from other cybercriminal operations, The Gentlemen appear purpose-built for ransomware-as-a-service operations.
Geographic Concentration:
Europe: 144 attacks (primary focus)
United States: 100 attacks (secondary focus)
Thailand: 35 attacks (supply-chain targeting)
South Asia: 40 attacks
Worldwide Sectoral Targeting:
Construction: 45 incidents
Manufacturing: 56 incidents
Healthcare: 37 incidents
IT & ITES: 36 incidents
Professional Services: 29 incidents
Operational Characteristics:
The Gentlemen's rapid emergence and sustained growth suggest significant operational funding and technical sophistication. The group's geographic diversification—maintaining European dominance while aggressively expanding into Asia-Pacific—indicates either organizational scale or partnerships with regional threat actors.
Notably, The Gentlemen's Thailand targeting (35 incidents) suggests supply-chain attack sophistication. By compromising manufacturing and logistics operations in Thailand, the group can leverage these beachheads for downstream attacks against Western European organizations. This cross-continental supply-chain targeting represents a significant evolution in ransomware operational sophistication.
Key Distinction: While Qilin focuses on maximizing ransom payments from individual targets, The Gentlemen appear to prioritize operational scale and geographic expansion. This suggests the group may be building toward either:
A mega-RaaS platform rivaling LockBit's historical dominance
Preparation for potential acquisition or partnership with state-sponsored actors
Geographic arbitrage—leveraging lower prosecution risk in developing nations while maintaining European operations
European Security Implications: The Gentlemen's emergence signals market competition is intensifying. Organizations should monitor this group's operational evolution closely, as aggressive growth often precedes operational mistakes that create defensive opportunities.
3. LockBit: The Persistent Legacy Threat
Attack Volume: 61 documented incidents (7.0% of regional total)
LockBit's presence in European targeting represents a significant finding given sustained law enforcement pressure and multiple platform disruption attempts. Despite being targeted by coordinated international takedown operations, LockBit maintained operational capability throughout H1 2026.
Geographic Concentration:
Europe: 61 attacks (Primary operations)
North America: 47 attacks (Secondary operations)
Distributed: Global presence indicating resilient infrastructure
Worldwide Sectoral Targeting:
Construction: 22 incidents
Manufacturing: 22 incidents
Government & LEA: 12 incidents
Healthcare: 19 incidents
Professional Services: 13 incidents
Operational Resilience:
LockBit's continued operations despite international enforcement actions demonstrate several critical lessons:
Affiliate Compartmentalization: By maintaining separate operational cells, LockBit can continue operations even when core infrastructure is disrupted
Rapid Rebranding: The group has adopted multiple identities and platform variants, complicating attribution
Infrastructure Redundancy: Multiple command-and-control server locations across jurisdictions with varying law enforcement cooperation levels
Operator Recruitment: Continuous recruitment of new affiliates from emerging cybercriminal talent pools
The group's continued viability suggests that law enforcement actions, while disruptive, are insufficient to eliminate established RaaS operations. Organizations cannot rely on law enforcement intervention as a defensive strategy; they must assume LockBit and similar groups will remain operational threats indefinitely.
European Security Implications: LockBit should remain on European security teams' active threat monitoring lists. The group maintains technical sophistication, access to critical zero-day exploits, and demonstrated willingness to target European critical infrastructure.
4. Akira: The Opportunistic European Operator
Attack Volume: 59 documented incidents (6.8% of regional total)
Akira represents a secondary-tier ransomware group with focused European operations. The group demonstrates strong preference for Manufacturing and Construction sectors, suggesting industry-specific expertise or targeted affiliate recruitment.
Geographic Concentration:
Europe & UK: 59 attacks (Secondary focus)
North America: 268 attacks (Primary focus)
Secondary: Limited operations in other regions
Worldwide Sectoral Targeting:
Manufacturing: 54 incidents
Construction: 57 incidents
Professional Services: 47 incidents
Consumer Goods: 34 incidents
Healthcare: 13 incidents
Operational Profile:
Akira's disproportionate North American presence (268 attacks) with lower European activity (59 attacks) suggests the group may have established affiliate networks in North America with secondary capacity for European operations. The strong manufacturing and construction focus mirrors Qilin's strategy, indicating these sectors offer superior ransom payment likelihood across multiple geographic markets.
European Security Implications: While not as immediately threatening as Qilin or The Gentlemen, Akira's persistent operations warrant inclusion in threat modeling exercises. European manufacturing and construction organizations should monitor Akira's affiliate recruitment channels and tactical innovations.
5. Dragonforce: The Supply-Chain Specialist
Attack Volume: 54 documented incidents (6.2% of regional total)
Dragonforce rounds out the top-five European threat actors with apparent specialization in Manufacturing and Technology sectors, suggesting possible supply-chain attack capabilities.
Geographic Concentration:
North America: 135 attacks (Primary focus)
Europe & UK: 54 attacks (Secondary focus)
Secondary: Limited global operations
Worldwide Sectoral Targeting:
Manufacturing: 31 incidents
Construction: 48 incidents
Professional Services: 28 incidents
Food & Beverages: 9 incidents
Healthcare: 9 incidents
Operational Pattern:
Dragonforce's heavy US focus with secondary European operations suggests the group may be leveraging North American-based supply chains to gain access to European targets. Manufacturing supply chains are deeply interconnected across transatlantic partners; compromising US manufacturers could provide lateral access into European operations.
European Security Implications: European manufacturing organizations should implement aggressive third-party risk management programs, particularly for US-based suppliers. Dragonforce's supply-chain sophistication suggests the group may bypass direct targeting in favor of compromising upstream vendors.
Top five European Nations Attacked by Ransomware Actors in 2026 H1 (Source: Cyble Research)
Germany: The Manufacturing Battleground
Attack Volume: 155 ransomware attacks (17.9% of regional total)
Germany's position as Europe's manufacturing powerhouse places it at the center of ransomware targeting campaigns. The nation's industrial sector—encompassing automotive, machinery, chemicals, and precision manufacturing—represents the most valuable ransomware target set in Europe.
German organizations represent an optimal target combination: high asset value, supply-chain criticality, strong operational technology integration, and proven willingness to pay ransoms to maintain production schedules. Additionally, Germany's federal structure creates jurisdictional complexity that may slow law enforcement response.
The nation's Mittelstand (mid-market manufacturing firms) are particularly vulnerable—large enough to justify ransom payments, but sometimes lacking enterprise-grade security infrastructure.
Defensive Priority: German manufacturing organizations should assume Qilin, The Gentlemen, Akira, and Dragonforce all maintain active operations targeting their sector. Network segmentation between IT and operational technology (OT) environments should be elevated to critical priority.
United Kingdom: The Financial Services Crosshairs
Attack Volume: 138 ransomware attacks (15.9% of regional total)
The UK faces a different threat profile than Germany, driven primarily by London's position as a global financial services hub. While manufacturing is targeted, Banking, Financial Services, and Insurance (BFSI) organizations command disproportionate attention.
Threat Actor Concentration:
Qilin: 26 attacks
The Gentlemen: 26 attacks
LockBit: 18 attacks
Akira: 13 attacks
Dragonforce: 11 attacks
Sectoral Breakdown:
BFSI: 38 incidents (concentrated targeting)
Technology: 32 incidents
Retail: 26 incidents
Professional Services: 24 incidents
Government & LEA: 16 incidents
Why the UK Is Targeted
London's financial services ecosystem manages trillions in assets, making it extraordinarily valuable to data-exfiltrating threat actors. BFSI organizations hold customer financial data, internal financial records, and strategic information that commands premium prices on dark web marketplaces.
Additionally, regulatory requirements (FCA, PRA, etc.) create pressure for rapid ransom payment to avoid breach notification delays that could trigger regulatory sanctions.
Data Exfiltration Risk: The UK's status as a financial services hub makes it particularly vulnerable to data-centric attack strategies. Organizations should assume that successful breach attempts will include aggressive data exfiltration alongside encryption deployment.
Defensive Priority: UK BFSI organizations must implement robust data loss prevention (DLP), encryption for data in transit and at rest, and aggressive monitoring for unauthorized data access or exfiltration attempts.
France: The Balanced Threat
Attack Volume: 119 ransomware attacks (13.7% of regional total)
France experiences balanced threat distribution across multiple sectors, reflecting both its manufacturing capacity and significant professional services sector.
Threat Actor Concentration:
Qilin: 28 attacks
The Gentlemen: 28 attacks
LockBit: 15 attacks
Akira: 14 attacks
Dragonforce: 8 attacks
Sectoral Breakdown:
Professional Services: 26 incidents
Manufacturing: 24 incidents
Construction: 19 incidents
Technology: 14 incidents
Healthcare: 10 incidents
Why France Faces Distributed Threat
As Europe's second-largest economy, France is attractive to ransomware operators across multiple sectors. The nation's professional services sector (legal, accounting, consulting) is particularly valuable for data exfiltration, while manufacturing remains a consistent target.
Defensive Priority: French organizations should implement sector-specific defensive strategies: professional services firms should prioritize client data protection and DLP, while manufacturing organizations should focus on OT segmentation and operational resilience.
Italy: The Construction and Manufacturing Hub
Attack Volume: 115 ransomware attacks (13.3% of regional total)
Italy faces concentrated targeting in construction and manufacturing sectors, with particular pressure on small-to-medium enterprises in industrial regions.
Threat Actor Concentration:
Qilin: 19 attacks
The Gentlemen: 18 attacks
LockBit: 12 attacks
Akira: 16 attacks
Dragonforce: 8 attacks
Sectoral Breakdown:
Construction: 48 incidents (concentrated)
Manufacturing: 38 incidents
Professional Services: 18 incidents
Retail: 14 incidents
Why Italy Faces Sector-Specific Pressure
Italy's construction industry is particularly vulnerable to ransom attacks due to tight project timelines and significant financial exposure. The nation's manufacturing sector, while sophisticated, sometimes operates with legacy infrastructure that creates exploitation opportunities.
Defensive Priority: Italian construction and manufacturing organizations should prioritize incident response readiness, backup infrastructure resilience, and supply-chain risk management.
Spain: The Emerging Risk
Attack Volume: 87 ransomware attacks (10.0% of regional total)
Spain experiences lower absolute attack volume than Germany, UK, France, or Italy, but faces concentrated pressure in manufacturing and professional services sectors.
Threat Actor Concentration:
Qilin: 20 attacks
The Gentlemen: 18 attacks
LockBit: 8 attacks
Akira: 12 attacks
Dragonforce: 7 attacks
Sectoral Breakdown:
Manufacturing: 28 incidents
Professional Services: 19 incidents
Construction: 16 incidents
Technology: 10 incidents
Regional Observation: Spain's lower attack volume may reflect either lower overall ransomware targeting or more effective defensive implementations. Spanish security teams should not interpret lower numbers as reduced threat but rather as a baseline for future comparison.
Where European Organizations Face Maximum Risk: A Sectoral Analysis
Construction: The Ransomware Goldmine
Attack Volume: 107 documented incidents (58% of all sector targeting across regions – not just in Europe – analyzed)
Construction organizations face disproportionate ransomware targeting across the entire European region. This concentration reflects understood economic vulnerabilities that threat actors exploit with precision.
Why Construction Is Targeted
Time-Sensitive Financial Exposure: Construction projects operate under contractually-defined timelines. Each day of delay triggers cascading costs, financial penalties, and potential contract termination. Organizations facing potential loss of €50-100 million contracts will prioritize rapid recovery over law enforcement involvement.
Operational Technology Integration: Modern construction increasingly relies on Building Information Modeling (BIM), cloud-based project management, and real-time equipment tracking. This IT/OT convergence creates exploitation pathways unavailable in purely IT-based industries.
Supply-Chain Complexity: Construction projects depend on dozens of subcontractors and suppliers. Compromising a single upstream supplier can provide lateral access into prime contractors.
Financial Pressure: Construction firms often operate with tight cash flow, making ransom negotiation essential to preserve solvency.
Accessibility: Many construction firms, particularly smaller regional players, operate with basic security infrastructure, creating easy exploitation opportunities.
European Construction Risk Mapping:
Germany (14 attacks): Heavy machinery and precision manufacturing integration
Supply-Chain Due Diligence: Implement security requirements for subcontractors and equipment suppliers
Professional Services: The Data Exfiltration Target
Attack Volume: 86 documented incidents
Professional services firms (law, accounting, consulting) face sophisticated targeting driven by data exfiltration opportunities rather than operational disruption pressure.
Why Professional Services Are Targeted
Client Confidentiality Risk: Legal privilege and client confidentiality create existential regulatory and reputational exposure. Threat actors leverage this to demand premium ransoms.
Sensitive Data Concentration: Professional services firms accumulate client financial records, litigation strategies, tax information, and corporate secrets—all commanding premium dark web prices.
Regulatory Exposure: GDPR breach notification requirements create pressure for rapid response and ransom payment to avoid regulatory sanctions.
Supply-Chain Position: Professional services firms advise major corporations; compromising advisors provides indirect access to clients.
Trust-Based Business Model: Client relationships depend on confidentiality. A single breach can destroy long-term client relationships and firm reputation.
European Professional Services Risk:
France (16 attacks): Concentrated targeting of Paris-based firms
Germany (16 attacks): Heavy focus on Frankfurt financial advisory firms
UK (17 attacks): London-based legal and accounting partnerships
Italy (6 attacks): Milan and Rome-based advisory firms
Spain (7 attacks): Barcelona and Madrid professional services sector
Key Finding: Professional services firms experience disproportionate data breach incidents (exfiltration with confirmed leak activity) compared to other sectors. Of the 51 total data breach incidents across Europe and UK, professional services represents a concentrated target.
Defensive Recommendations:
Client Data Segregation: Isolate client data on separate network segments with distinct access controls
Data Loss Prevention (DLP): Deploy DLP solutions with aggressive egress controls monitoring client data exfiltration
Encryption Standards: Implement client-facing encryption for all sensitive communications
Access Auditing: Maintain comprehensive logs of all access to sensitive client data
Ransomware-Specific Insurance: Consider cyber insurance with specific ransomware coverage addressing confidentiality exposure
Manufacturing: The Supply-Chain Critical Target
Attack Volume: 123 documented incidents
European manufacturing organizations face sophisticated, supply-chain-aware threat actors who understand production dependencies and downtime economics.
Why Manufacturing Is Targeted
Operational Technology Integration: Modern factories integrate IT and OT systems. Ransomware deployment can halt production lines, creating catastrophic financial exposure.
Supply-Chain Criticality: Manufacturing downtime cascades through dependent enterprises. A single organization's compromise can impact dozens of downstream customers.
Export Dependency: European manufacturers serve global markets. Production delays translate directly into lost revenue and market share.
Legacy Infrastructure: Many manufacturing facilities operate aging, unpatched systems integrated with newer IT infrastructure, creating exploitation bridges.
Financial Pressure: Manufacturing organizations face razor-thin margins; production downtime can drive solvency crises.
UK (14attacks): Aerospace, automotive, precision manufacturing
Critical Vulnerability Pattern: Manufacturing organizations are disproportionately targeting known, exploitable vulnerabilities in critical infrastructure appliances (network appliances, security tools, identity systems). Rather than deploying zero-days, threat actors exploit patched vulnerabilities that organizations have not implemented.
Defensive Recommendations:
OT/IT Segmentation: Implement airgapped network separation between operational technology and corporate IT
Vulnerability Management Prioritization: Focus patching efforts on network appliances, security tools, and identity systems
Industrial Control System (ICS) Monitoring: Deploy behavioral monitoring for unusual activity on manufacturing control systems
Healthcare organizations face a unique threat dynamic where ransomware directly endangers patient safety, creating existential operational pressure distinct from financial threats.
Why Healthcare Is Targeted
Patient Safety Risk: Ransomware disables critical medical systems (diagnostic equipment, pharmaceutical dispensing, patient records). Unlike other industries, downtime directly threatens life.
Regulatory Pressure: GDPR, HIPAA-equivalent regulations, and national privacy laws create breach notification requirements that incentivize ransom payment.
Data Value: Patient medical records, pharmaceutical research data, and clinical trial information command premium dark web prices.
Continuous Operation Requirement: Unlike manufacturing or services, healthcare cannot delay critical procedures. The operational pressure to pay ransoms is existential.
System Complexity: Healthcare IT environments integrate numerous legacy systems (PACS, EHR, medical devices) with varying security architectures.
European Healthcare Risk Distribution:
Germany (14 attacks): Concentrated in Berlin, Munich, and Frankfurt urban medical centers
Austria (2 attacks): private healthcare sector
France (5 attacks): Concentrated in Paris and Lyon region hospitals
Switzerland (3 attacks): medical centers
Spain (3 attacks): Barcelona and Madrid hospital networks
Critical Finding: Healthcare organizations experience disproportionately high data breach incident rates, suggesting organized threat actors specifically target health information exfiltration.
Defensive Recommendations:
Clinical System Isolation: Implement complete network separation between clinical systems and corporate IT
Redundant Critical Systems: Deploy redundant diagnostic and pharmaceutical systems capable of manual operation
Patient Data Encryption: Implement end-to-end encryption for all patient medical records
Breach Response Planning: Develop healthcare-specific incident response plans addressing patient notification and continuity of care
Medical Device Security: Implement inventory and monitoring for all connected medical devices
Supply-Chain Assessment: Assess security of medical device manufacturers and pharmaceutical distributors
The Data Exfiltration Reality: Beyond Encryption
Confirmed Data Breaches: 51 Incidents Across Europe and UK
While ransomware attacks total 866, only 51 incidents resulted in confirmed data breaches and leaks (5.9% confirmation rate). This apparent low percentage masks a critical operational truth: organizations cannot distinguish between encryption-only attacks and data exfiltration scenarios until exfiltration attempts or threats emerge.
Data Breach Distribution by Sector:
Sector
Confirmed Breaches
Percentage
BFSI
9
17.6%
Telecom
9
17.6%
Retail
8
15.7%
Government & LEA
6
11.8%
Media & Entertainment
5
9.8%
Technology
4
7.8%
Healthcare
4
7.8%
Automotive
3
5.9%
Construction
2
3.9%
Education
1
2.0%
Others
6
11.8%
Critical Observation: BFSI and Telecom sectors experience disproportionate data breach incidents, suggesting these industries are specifically targeted for data exfiltration rather than operational disruption. The strategic implication is clear: threat actors targeting financial and telecommunications organizations prioritize data monetization over ransom payment.
Most Active Threat Actors in Data Exfiltration: The Leak Economy
Primary Exfiltration Actors:
Actor
Confirmed Leak Posts
Targeting Pattern
tanaka
6
Industry-agnostic, global operations
kazutlg
4
BFSI and Professional Services focus
aslan1
2
Government and Technology sectors
darkcybervault
2
Retail and Professional Services
breach3d
2
Technology focus
frog
2
Diverse sector targeting
ken6k
2
BFSI concentration
max9898
2
Retail and Technology
worldrdp
2
Technology sector
zyad2drkwb
2
Government targeting
zoozkooz
2
Diverse sector
mr_x1
1
Retail focus
ventuuas
1
Professional Services
Others
18
Distributed diverse targeting
Strategic Finding: While Qilin, The Gentlemen, and LockBit dominate ransomware attack volume, data exfiltration is fragmented across numerous smaller actors, including tanaka (6 posts), kazutlg (4 posts), and dozens of single-incident operators. This suggests a mature data brokerage ecosystem where extracted data is resold to specialized exfiltration actors.
Dark Web Data Marketplace Activity:
916 unique domains impacted by data leaks
Approximately 86 distinct leak posts across dark web channels
Data types: Financial records, customer PII, medical records, intellectual property, trade secrets
Implication: Organizations can no longer assume encrypted data is "lost forever" if backups are restored. Exfiltrated data will be monetized regardless of whether organizations pay ransoms. Data loss prevention becomes as critical as ransomware detection.
Geopolitical and Ideological Dimensions: The Activism-Cybercrime Convergence
Pro-Russian Hacktivism: Blurred Lines Between Ideology and Profit
H1 2026 witnessed increasing overlap between geopolitically motivated hacktivism and financially motivated cybercrime, particularly among pro-Russian collectives targeting NATO-aligned European nations.
Key Threat Actors to Monitor
NoName057(16) - The Pro-Russian DDoS Coalition
Primary Activity: Large-scale DDoS attacks against NATO-aligned governments and Ukrainian supporters
Secondary Activity: Data exfiltration for monetization
Geographic Targets: Estonia, UK, Ukraine, Italy, Spain, France, Poland, Norway, Denmark, Lithuania, Latvia, Czech Republic, Germany, Moldova
Operational Pattern: Coordinated DDoS campaigns often accompanied by data theft and subsequent leak activity
Operational Evolution: NoName057(16) began as a purely activist collective claiming ideological motivation (anti-NATO, pro-Russia). By H1 2026, the group had evolved to include data exfiltration and monetization—suggesting either organizational evolution or infiltration by financially motivated threat actors.
Strategic Implication: European organizations cannot compartmentalize threat modeling. A geopolitically motivated attack that begins as a DDoS campaign can transition into ransomware deployment when exfiltration opportunities present themselves.
Strategic Defense Recommendations for European Organizations
Prioritized Defensive Roadmap
Based on CRIL's H1 2026 regional data, European security leaders should prioritize defensive investments in the following sequence:
Defensive Focus: Data encryption, DLP with aggressive egress controls, cyber insurance
If You're in Healthcare:
Primary Threat: Qilin, The Gentlemen, LockBit
Secondary Threat: Data exfiltration operators
Vulnerability: Patient safety risk, critical operational pressure, medical device security
Defensive Focus: Clinical system isolation, redundant critical systems, incident response for operational continuity
Conclusion: The European Ransomware Reality
Europe and the UK face a mature, organized ransomware ecosystem dominated by five sophisticated threat actors who have developed deep understanding of regional economic vulnerabilities. The threat is not random or opportunistic—it is strategic, targeted, and evolved.
Key Takeaways:
Five groups dominate: Qilin (158 attacks), The Gentlemen (144), LockBit (61), Akira (59), and Dragonforce (54) collectively account for 476 of 866 documented attacks (55%). European security leaders can build specific defensive strategies against known adversaries.
Geography matters: Germany, UK, France, Italy, and Spain face distinct threat profiles. Security strategies must be regionally and sector-specific, not generic.
Sectors are targeted deliberately: Construction, Professional Services, and Manufacturing are not randomly selected—they face extraordinary pressure due to economic vulnerabilities that threat actors systematically exploit.
Data exfiltration is the primary leverage: Of 866 attacks, only 51 resulted in confirmed breaches—but this understates the risk. Organizations must assume all breaches involve data exfiltration and cannot rely on backup restoration alone.
Patch management is the primary defense: Nearly 90% of exploited vulnerabilities had patches available. Disciplined patch management, particularly for network appliances, would prevent the vast majority of successful attacks.
Known vulnerabilities are the current threat: Despite awareness of zero-day sophistication, threat actors continue exploiting known vulnerabilities because patches lag adoption. This creates a predictable exploitation window that defensive teams can close.
For European security leaders, the path forward is to understand your regional threat actors, prioritize critical infrastructure protection, implement robust data protection measures, and establish resilient backup and recovery infrastructure. The threat is severe, but it is also understood and defensible. The question is not whether European organizations will face ransomware attacks in the remainder of 2026 and beyond—the data confirms they will. The question is whether they will be prepared.
Prinz Eugen ransomware prioritizes recently modified files and leaves no ransom note on disk, creating new pressure on backup windows, endpoint alerts, and incident response playbooks.
Entrar
