Visualização de leitura

14 de Agosto de 2026, 11:22

Ransomware Threats, Americas, America,

The Americas carried the heaviest ransomware burden of any region on the planet in the first half of 2026. According to Cyble Research and Intelligence Labs (CRIL), North and South America combined experienced 2,188 documented ransomware attacks between January and June 2026.

That single figure — 2,188 attacks — represents more than 57% of the 3,836 ransomware incidents CRIL tracked worldwide, making the Americas the undisputed center of gravity for global ransomware operations.

But the Americas is not a single threat theatre — it is two. North America alone absorbed 1,981 attacks, driven by a mature, multi-group Ransomware-as-a-Service (RaaS) economy competing for market share. South America, by contrast, recorded 207 attacks concentrated around a much smaller set of operators, with one group — The Gentlemen — claiming nearly a quarter of all regional incidents outright. Understanding the Americas means understanding both halves of that story: a saturated northern market and a consolidating southern one.

North America vs. South America: Two Distinct Ransomware Landscapes

Security leaders operating across the hemisphere cannot apply a single threat model to both sub-regions. The data shows meaningfully different attacker behavior, concentration, and monetization strategy north and south of the equator.

Metric	North America	South America
Ransomware Attacks	1,981	207
Dominant Ransomware Actor	Qilin (370 attacks)	The Gentlemen (46 attacks)
Top Targeted Sector	Construction	IT & ITES
Top Targeted Nation	United States (1,721)	Brazil (71)
Distinct Ransomware Groups Active	50+	30+
% of Attacks from Top 3 Groups	~40% (Qilin, Akira, INC Ransom)	~57.5% (The Gentlemen, Qilin, LockBit)

Why the split matters: North America's threat landscape is a genuine marketplace — dozens of RaaS operators compete for affiliate loyalty, and no single group commands more than a fifth of total volume. South America's landscape is more consolidated, with three groups controlling well over half of all attacks.

For defenders, that means North American organizations need broad-spectrum threat intelligence covering a long tail of active groups, while South American organizations can build highly specific defenses against a short list of named adversaries.

The Five Dominant Ransomware Groups Targeting Americas

Across both sub-regions combined, five ransomware operators account for the overwhelming share of documented activity: Qilin, Akira, INC Ransom, Dragonforce, and The Gentlemen. Together, these five groups are linked to roughly 1,148 of the Americas' 2,188 attacks — approximately 52.5% of all regional ransomware activity.

ransomware threats, ransomware threats in Americas, ransomware threats in Americas 2026, Qilin — Fig. Top five ransomware groups in Americas for H1 2026 (Source: CRIL)

1. Qilin: The Biggest Ransomware Threat in the Americas

Attack Volume: 410 documented incidents across the Americas (370 in North America, 40 in South America) — 18.7% of the regional total.

Qilin is the single most prolific ransomware actor operating in the hemisphere, and its dominance is not evenly spread — it is concentrated hardest in the United States.

Geographic Concentration:

United States: 323 attacks (the single largest country-level concentration of any group, anywhere)

Canada: 33 attacks

Argentina: 13 attacks

Broader South America: 40 attacks

Worldwide Sectoral Targeting: Qilin's targeting logic is deliberate rather than opportunistic:

Construction: 108 incidents (primary focus)

Professional Services: 90 incidents (legal, accounting, consulting firms)

Manufacturing: 67 incidents

Healthcare: 53 incidents

IT & ITES: 43 incidents

Operational Characteristics:

Qilin's affiliate model is built for scale. Initial access brokers handle reconnaissance and compromise, mid-tier operators manage lateral movement, and dedicated crews execute encryption and exfiltration. This compartmentalization lets Qilin run dozens of concurrent operations across the United States without any single point of failure. The group's near-total dominance of the American ransomware market (323 of 1,721 US attacks) suggests either an unusually large affiliate roster or a payout structure attractive enough to pull operators away from competing platforms.

Why Qilin Dominates:

Affiliate Loyalty: Competitive payout splits keep operators recruiting and retaining talent

Rapid Exploit Weaponization: Fast turnaround from vulnerability disclosure to active exploitation

Sector Fluency: Deep understanding of which industries face the highest downtime cost

Established Data Brokerage Ties: Exfiltrated data reliably reaches monetization channels

Americas Security Implications: Any organization in construction, professional services, manufacturing, or healthcare operating in the US or Canada should treat Qilin as a primary named threat, not a generic ransomware risk.

2. Akira: North America's Persistent Operator

Attack Volume: 268 documented incidents, almost entirely concentrated in North America — 12.2% of the regional total

Akira is the second most active group in the Americas, and unlike Qilin, its footprint is almost exclusively North American. CRIL's data shows Akira's South American presence is negligible to date.

Geographic Concentration:

United States: 247 attacks (92% of Akira's total Americas volume)

Canada: Remaining North American activity

South America: Minimal to no confirmed activity

Worldwide Sectoral Targeting:

Construction: 57 incidents

Manufacturing: 54 incidents

Professional Services: 47 incidents

Consumer Goods: 19 incidents

IT & ITES: 16 incidents

Operational Characteristics:

Akira has built a reliable playbook around compromising small-to-medium-sized businesses through unpatched public-facing network devices, then pivoting into construction and manufacturing environments where downtime tolerance is lowest. The group's consistency — rather than explosive growth — is its defining trait; it has neither the explosive scale of Qilin nor the geographic diversification of The Gentlemen, but it reliably executes against the same target profile month after month.

Americas Security Implications: North American SMBs in construction, manufacturing, and professional services should assume Akira is actively scanning for exposed remote access infrastructure. Its South American absence should not be mistaken for permanence — RaaS groups expand geographically once North American markets saturate.

3. INC Ransom: The Law-Firm Specialist

Attack Volume: 171 documented incidents (164 in North America, 7 in South America) — 7.8% of the regional total

INC Ransom distinguishes itself through sector specialization rather than volume. The group shows a clear, repeated preference for Professional Services organizations — particularly law firms — leveraging the sensitive, high-stakes nature of legal client data.

Geographic Concentration:

United States: 154 attacks

Canada: 6 attacks

Brazil: 4 attacks

Worldwide Sectoral Targeting:

Professional Services: 58 incidents (primary focus, with a documented preference for law firms)

Construction: 27 incidents

Manufacturing: 26 incidents

Healthcare: 21 incidents

Organisation/Non-profit: 12 incidents

Operational Characteristics:

INC Ransom's rapid operational pace and consistent targeting of law firms, healthcare providers, and transportation/energy operators reflects a strategy built entirely around double-extortion leverage. The sensitivity of the data matters more than the size of the victim. A regional law firm holding privileged client communications is, to INC Ransom, a more valuable target than a much larger manufacturer with less sensitive data.

Americas Security Implications: Law firms, accounting practices, and consulting shops across the US, Canada, and Brazil should assume INC Ransom is actively targeting client confidentiality as leverage — not just encrypting file servers for disruption.

4. Dragonforce: The Cross-Border Supply-Chain Operator

Attack Volume: 153 documented incidents (148 in North America, 5 in South America) — 7.0% of the regional total

Dragonforce maintains an aggressive operational tempo focused heavily on the United States, with a strategy that suggests supply-chain-aware targeting rather than random opportunism.

Geographic Concentration:

United States: 135 attacks

Canada: 11 attacks

South America: 5 attacks

Worldwide Sectoral Targeting:

Construction: 48 incidents

Manufacturing: 31 incidents

Professional Services: 28 incidents

IT & ITES: 18 incidents

BFSI: 17 incidents

Operational Characteristics:

Dragonforce's manufacturing and construction focus mirrors Qilin's and Akira's playbooks, but its concentration in the US combined with limited-but-present South American activity hints at interest in transnational manufacturing supply chains. North American organizations with manufacturing partners or subsidiaries in Latin America should treat this as a lateral-access risk, not just a direct-targeting one.

Americas Security Implications: Manufacturers and construction firms with cross-border operations — a common structure across USMCA supply chains — should extend Dragonforce-specific monitoring to subsidiaries and vendors, not just headquarters networks.

5. The Gentlemen: South America's Dominant Threat

Attack Volume: 146 documented incidents (100 in North America, 46 in South America) — 6.7% of the regional total, but the single most active ransomware group in South America specifically.

While The Gentlemen rank fifth across the combined Americas, they are the #1 threat actor in South America on their own — responsible for roughly 22% of every ransomware attack recorded in that sub-region.

Geographic Concentration:

United States: 77 attacks

North America: 100 attacks

Brazil: 15 attacks

South America: 46 attacks (largest single-group share in the sub-region)

Worldwide Sectoral Targeting:

Manufacturing: 56 incidents

Construction: 45 incidents

Healthcare: 37 incidents

IT & ITES: 36 incidents

Consumer Goods: 34 incidents

Operational Characteristics:

The Gentlemen are a relatively new operator that has achieved outsized scale in a short window, and their South American concentration is the most important regional signal in this dataset. Unlike Qilin or Akira — which built North American dominance first and are only beginning to diversify — The Gentlemen appear to have prioritized South America as a primary theatre from early in their operational life, an unusual strategic choice that may reflect lower defensive maturity, less aggressive law enforcement cooperation, or simply less competitive pressure from other RaaS operators in the sub-region.

Americas Security Implications: South American organizations — especially in healthcare, manufacturing, and IT services — should treat The Gentlemen as their single highest-priority named adversary. North American organizations should not discount them either; 100 US-focused attacks is a substantial footprint for a group still building its brand.

Other Notable Threats: Play, LockBit, and CL0P

Three additional groups warrant inclusion in any Americas threat model:

Play (144 attacks, North America only): Continues its "Big Game Hunting" approach layered with high-volume SMB attacks via unpatched public-facing network devices, concentrated almost entirely on US and Canadian construction, professional services, and manufacturing targets.

LockBit (80 attacks combined — 47 in North America, 33 in South America): Despite sustained international law enforcement pressure and repeated takedown attempts, LockBit remains operationally resilient across both sub-regions, notably compromising Chile's Clínica Dávila in South America.

CL0P (93 attacks combined — 91 in North America, 2 in South America): Operated differently from its peers, executing a large-scale campaign concentrated in January and February 2026 that exploited a single zero-day vulnerability across hundreds of organizations at once — reminiscent of the group's historical MOVEit campaign.

The Five Most Targeted Nations in the Americas

United States: The Global Ransomware Epicenter

Attack Volume: 1,721 ransomware attacks — 78.7% of all Americas ransomware activity, and roughly 45% of every ransomware attack recorded worldwide.

No other country on Earth comes close to the volume of ransomware activity absorbed by the United States in H1 2026. The country functions as the default target for nearly every major RaaS operator active today.

Threat Actor Concentration:

Qilin: 323 attacks

Akira: 247 attacks

INC Ransom: 154 attacks

Dragonforce: 135 attacks

Play: 134 attacks

Sectoral Breakdown: Manufacturing, Professional Services, Construction, and Healthcare bear the brunt, consistent with the broader North American pattern of operationally sensitive, low-downtime-tolerance industries.

Why the United States Faces Maximum Pressure

The scale of the US economy, its dense concentration of mid-market manufacturers, law firms, and healthcare providers, and its comparatively high ransom-payment history combine to make it the most economically rational target for every major ransomware operator. US organizations also frequently anchor cross-border supply chains stretching into Canada, Mexico, and South America — meaning a US compromise can cascade into lateral access against hemispheric partners.

Defensive Priority: US organizations across construction, manufacturing, professional services, and healthcare should assume Qilin, Akira, INC Ransom, Dragonforce, Play, and The Gentlemen are all actively scanning for exploitable entry points into their networks simultaneously — not sequentially.

Canada: The Cross-Border Extension

Attack Volume: 179 ransomware attacks — 8.2% of the regional total.

Canada's threat profile closely tracks the United States, reflecting deep economic integration and shared supply chains rather than a distinct targeting logic of its own.

Sectoral Breakdown: Manufacturing, professional services, and construction dominate, mirroring the US pattern almost directly.

Why Canada Faces Sustained Pressure

Canadian organizations are frequently subsidiaries, suppliers, or joint-venture partners of US enterprises, which means the same RaaS groups saturating the US market extend naturally northward. Cross-border manufacturing in particular creates lateral access opportunities that Dragonforce and Akira appear well-positioned to exploit.

Defensive Priority: Canadian organizations should not assume distance from US headquarters provides insulation — the same threat actors, exploiting the same vulnerability classes, are already active on both sides of the border.

Brazil: The Financial Malware and Ransomware Convergence Point

Attack Volume: 71 ransomware attacks — 3.2% of the regional total, but the largest single concentration in South America.

Brazil represents South America's most complex threat environment, combining traditional ransomware pressure with a maturing, sophisticated financial malware ecosystem.

Threat Actor Concentration: The Gentlemen (15 attacks), LockBit, and a fragmented tail of smaller operators.

Sectoral Breakdown: Government & Law Enforcement, BFSI, and Healthcare are the most consistently targeted sectors.

Why Brazil Faces a Dual Threat

Beyond ransomware, Brazil emerged in H1 2026 as a focal point for new Android banking trojan families — TCLBANKER and BTMOB RAT — which use self-propagation, evasion techniques, and Malware-as-a-Service (MaaS) distribution models to target banking and cryptocurrency users directly. Brazil also suffered an alleged 250-million-record breach of Serasa, one of the country's largest credit bureaus, alongside an access sale allegedly targeting the Central Bank of Brazil — a listing that, if genuine, represents one of the most significant initial-access offerings tracked anywhere in the report.

Defensive Priority: Brazilian financial institutions should treat mobile banking malware and ransomware as converging risks rather than separate problems — the same underground economy is monetizing both. Government and BFSI entities should assume access-broker listings referencing critical national infrastructure require immediate incident-response-level validation, not routine monitoring.

Mexico: The Emerging Nearshoring Risk

Attack Volume: 39 ransomware attacks — 1.8% of the regional total.

Mexico's attack volume is meaningfully lower than the US, Canada, or Brazil, but its position within North American manufacturing supply chains — accelerated by ongoing nearshoring trends — makes it a nation to watch closely rather than dismiss.

Why Mexico Warrants Increased Attention

As global manufacturers continue relocating production closer to the US market, Mexican facilities increasingly sit inside the same supply chains that Dragonforce, Akira, and Qilin already target aggressively north of the border. Lower current attack volume may reflect earlier-stage targeting rather than lower risk — a pattern security teams should not mistake for durable safety.

Defensive Priority: Manufacturers with Mexican operations should extend the same OT/IT segmentation and vulnerability management discipline applied to US and Canadian facilities to their Mexican sites, rather than treating them as lower priority.

Colombia: Where Hacktivism Meets Cybercrime

Attack Volume: 33 ransomware attacks — 1.5% of the regional total.

Colombia's ransomware volume is modest, but the country stands out for the density of ideologically motivated activity layered on top of financially driven attacks.

Why Colombia Faces a Blended Threat

Groups such as Anonymous Colombia (#OpColombia) ran active campaigns throughout H1 2026 blending website defacement, DDoS attacks, and data leak activity — consistent with the broader South American pattern in which hacktivist-branded channels frequently overlap with financially motivated cybercrime infrastructure.

Defensive Priority: Colombian government and law enforcement entities — the most frequently targeted sector across South America overall — should treat hacktivist claims as credible threat intelligence signals rather than dismissing them as purely ideological noise.

Where Americas Organizations Face Maximum Risk: A Sectoral Analysis

Professional Services: One of the Top Targets

Attack Volume: The second most heavily impacted sector in North America.

Professional services firms — law, accounting, and consulting practices — are one of the top jobs on North America's ransomware target list, driven overwhelmingly by INC Ransom and AiLock's aggressive targeting of client-confidential data.

Why Professional Services Are Targeted

Privileged Data Concentration: Legal privilege and client confidentiality create existential regulatory and reputational exposure that threat actors exploit for maximum ransom leverage.

Regulatory Pressure: Breach notification requirements incentivize rapid ransom payment to avoid compounding disclosure penalties.

Trust-Based Business Model: A single confirmed breach can permanently damage client relationships built entirely on confidentiality.

Documented Actor Preference: INC Ransom has shown a specific, repeated preference for law firms — this is not incidental targeting.

Notable Incident Pattern: AiLock's activity stood out for a coordinated wave of victim disclosures on a single day — March 3, 2026 — a pattern consistent with mass-exploitation of a shared vulnerability rather than individually researched targeting.

Defensive Recommendations:

Segregate client data on separate network segments with distinct, audited access controls

Deploy data loss prevention (DLP) with aggressive egress monitoring for client-data exfiltration

Maintain comprehensive access logs for all sensitive client-data touchpoints

Evaluate ransomware-specific cyber insurance addressing confidentiality exposure

Construction and Manufacturing: The Downtime Economy

Attack Volume: Construction and Manufacturing rank first and third in North America; combined, they represent the largest share of Qilin, Akira, Dragonforce, and The Gentlemen's worldwide targeting.

Constructions and manufacturing share a common vulnerability across the Americas: both operate on tight, contractually enforced timelines where downtime translates directly into cascading financial penalties.

Why Construction and Manufacturing Are Targeted

Time-Sensitive Financial Exposure: Missed construction deadlines trigger contractual penalties; halted production lines trigger lost revenue and breached delivery commitments.

OT/IT Convergence: Modern factories and job sites increasingly integrate operational technology with corporate IT, creating exploitation bridges unavailable in pure-IT industries.

Supply-Chain Complexity: Both industries depend on dense webs of subcontractors and suppliers — compromising one upstream partner can provide lateral access into prime contractors.

Cross-Border Exposure: US-Canada-Mexico manufacturing integration (and increasingly, US-Brazil trade relationships) means a single compromise can propagate across national borders.

Defensive Recommendations:

Implement airgapped network segmentation between OT and corporate IT environments

Prioritize vulnerability patching for network appliances and identity systems over blanket patch cycles

Maintain fully offline, immutable backups of critical project and production data

Extend third-party risk assessments to subcontractors, suppliers, and cross-border subsidiaries

Healthcare: South America's Critical Infrastructure Threat

Attack Volume: One of the top four most heavily impacted sectors in South America.

Healthcare organizations across the Americas — but particularly in South America — face a threat dynamic distinct from financial pressure alone: ransomware attacks against hospitals directly endanger patient safety.

Why Healthcare Is Targeted

Patient Safety Leverage: Downtime in diagnostic systems, pharmaceutical dispensing, and patient records directly threatens continuity of care, creating existential pressure to pay quickly.

Documented Regional Incidents: The Gentlemen's claimed attack on Primero Medicina Privada and LockBit's compromise of Chile's Clínica Dávila both illustrate ransomware groups' willingness to target hospital networks directly.

Data Value: Patient medical records and clinical data command premium prices on dark web marketplaces.

System Complexity: Healthcare IT environments blend legacy diagnostic equipment, electronic health records, and connected medical devices — each with distinct security postures.

Defensive Recommendations:

Implement complete network isolation between clinical systems and corporate IT

Deploy redundant diagnostic and pharmaceutical systems capable of manual fallback operation

Encrypt all patient medical records end-to-end

Build healthcare-specific incident response plans addressing patient notification and continuity of care

Agriculture & Livestock: The Americas' Emerging Supply-Chain Target

Attack Volume: 33% of all North American initial access listings — the second-most targeted sector in the region's access brokerage market.

A distinctive Americas finding: initial access brokers targeting the region show unusually strong interest in Agriculture & Livestock, second only to Technology.

Why Agriculture & Livestock Is an Emerging Target

North America's food supply chain increasingly depends on connected logistics, cold-chain monitoring, and precision agriculture technology — creating an attack surface that did not meaningfully exist a decade ago. Access brokers appear to be positioning themselves ahead of ransomware operators, selling footholds into agricultural operations before ransomware crews weaponize them. This mirrors a pattern seen elsewhere globally but is particularly pronounced in North America's access brokerage data.

Defensive Recommendations:

Treat agricultural technology platforms (precision ag, cold-chain IoT) with the same security rigor as manufacturing OT

Monitor initial access broker markets specifically for agriculture and food-sector listings

Build incident response plans accounting for food-supply-chain continuity, not just data confidentiality

Geopolitical and Ideological Dimensions: Hacktivism Across the Hemisphere

SOLDADOS DIGITALES – UNIÓN AMERICANA: A Hemispheric Hacktivist Collective

Unlike most hacktivist channels tracked in this report, SOLDADOS DIGITALES – UNIÓN AMERICANA operates across both North and South America, making it one of the few genuinely hemispheric threat actors identified in H1 2026 — a significant finding given how regionally siloed most hacktivist activity tends to be.

Combined Hacktivism Metrics (North + South America):

~140 confirmed data leak and dump posts across both sub-regions

At least 932 unique domains impacted (360 in North America, 572 in South America)

Primary targets: Government & LEA, Technology, BFSI, Telecommunication, Education

Notable Collectives by Sub-Region:

North America: SOLDADOS DIGITALES – UNIÓN AMERICANA, Anonymous #FreeTurtleIsland, KERALA HACKERS, LYSTIC TEAM #ID

South America: SOLDADOS DIGITALES – UNIÓN AMERICANA, Anonymous Colombia (#OpColombia) Y.A.N, BLAZER TEAM ATTACK

The Convergence Problem: As with hacktivist activity documented elsewhere in CRIL's global dataset, several Americas-based channels marketed as ideological collectives function as hybrid operations — logging DDoS attacks and defacement claims alongside stolen-data brokerage and DDoS-for-hire services. Security teams should treat these channels as credible threat intelligence sources rather than dismissing their claims as purely political theater.

Regional Threat Actor Summary: Who Targets Your Americas Organization

If You're in Professional Services:

Primary Threat: INC Ransom, Qilin

Secondary Threat: AiLock, The Gentlemen

Vulnerability: Client data exfiltration, regulatory breach-notification pressure

Defensive Focus: DLP, client data segregation, ransomware-specific cyber insurance, cyber threat intelligence

If You're in Manufacturing or Construction:

Primary Threat: Qilin, Akira, Dragonforce

Secondary Threat: The Gentlemen, Play

Vulnerability: OT/IT convergence, cross-border supply-chain exposure, contractual downtime penalties

Defensive Focus: OT segmentation, immutable backups, cross-border third-party risk management

If You're in Healthcare:

Primary Threat: The Gentlemen (South America), Qilin (North America)

Secondary Threat: LockBit

Vulnerability: Patient-safety leverage, legacy medical device integration

Defensive Focus: Clinical system isolation, redundant critical systems, patient-notification-ready incident response

If You're in BFSI:

Primary Threat: Data exfiltration actors, mobile banking malware (Brazil)

Secondary Threat: Qilin, The Gentlemen

Vulnerability: Financial data value, mobile malware convergence, regulatory exposure

Defensive Focus: DLP with aggressive egress controls, mobile threat monitoring, data encryption

If You're in Agriculture & Livestock:

Primary Threat: Initial access brokers

Secondary Threat: Downstream ransomware operators exploiting sold access

Vulnerability: Precision agriculture and cold-chain IoT exposure

Defensive Focus: OT-equivalent segmentation for agricultural technology, access-broker monitoring

If You're in Government & Law Enforcement (South America specifically):

Primary Threat: RALord/Nova, CoinbaseCartel, hacktivist-branded channels

Secondary Threat: LockBit, The Gentlemen

Vulnerability: Public-sector data value, hybrid ideological/financial targeting

Defensive Focus: Treat hacktivist claims as credible intelligence, harden citizen-data repositories

Strategic Defense Recommendations for Americas Organizations

Based on CRIL's H1 2026 regional data, Americas security leaders should prioritize defensive investment in the following sequence.

Phase 1: Critical Infrastructure Protection (30 days)

Inventory Network Appliances: Document every internet-facing firewall, VPN, and security gateway

Patch Critical CVEs: Prioritize Ivanti, Fortinet, Cisco, SolarWinds, and Palo Alto Networks appliances — the vendors repeatedly appearing in both the CISA KEV catalog and active exploitation campaigns

Harden Remote Access: Enforce phishing-resistant MFA on all administrative and remote access paths

Deploy Behavioral Monitoring: Watch for anomalous activity on network appliances specifically

Phase 2: Data Protection (60 days)

Data Inventory: Catalog sensitive holdings — client data, financial records, patient records, intellectual property

DLP Implementation: Deploy data loss prevention with aggressive egress monitoring

Encryption Standards: Enforce encryption in transit and at rest across all sensitive data stores

Access Auditing: Maintain comprehensive logs for every access event touching sensitive data

Phase 3: Operational Resilience (90 days)

Immutable Backups: Establish offline, immutable backup infrastructure isolated from production networks

Sector-Specific Incident Response: Build playbooks addressing construction project continuity, manufacturing downtime, and healthcare patient-safety scenarios specifically

Cross-Border Continuity Planning: For organizations with US-Canada-Mexico or US-Brazil operations, extend continuity plans across all connected facilities

Recovery Testing: Conduct quarterly backup restoration drills to verify actual recovery capability

Phase 4: Threat Hunting and Detection (Ongoing)

Named-Actor Threat Intelligence: Subscribe to intelligence feeds tracking Qilin, Akira, INC Ransom, Dragonforce, and The Gentlemen specifically

Access-Broker Monitoring: Track listings for organizational exposure

Supply-Chain Monitoring: Continuously assess vendor and subsidiary security posture across borders

Mobile Malware Awareness (Brazil-specific): Financial institutions should monitor for TCLBANKER- and BTMOB RAT-style Android banking trojan activity targeting customers

Conclusion: The Americas Ransomware Reality

The Americas is not just the largest ransomware theatre in the world by volume — it is two distinct threat environments operating under a single regional label. North America hosts a saturated, competitive RaaS marketplace where no single group dominates outright. South America is consolidating around a smaller set of operators, led decisively by The Gentlemen.

Key Takeaways:

The Americas carries the global center of gravity: 2,188 of the world's 3,836 documented ransomware attacks (57%) struck North or South America in H1 2026.

Five groups anchor the threat: Qilin (410), Akira (268), INC Ransom (171), Dragonforce (153), and The Gentlemen (146) collectively account for over half of all Americas ransomware activity — but their dominance splits sharply by sub-region.

North America and South America require different playbooks: North America's threat model demands broad coverage against a long tail of competing operators; South America's demands deep, specific defense against The Gentlemen, Qilin, and LockBit.

The United States remains the world's single largest target: 1,721 attacks — nearly 45% of global ransomware volume — makes the US the default target for virtually every major RaaS operator active today.

Brazil's threat is compounding, not singular: ransomware, mass data breach, and mobile banking malware are converging in the same underground economy targeting the same financial institutions.

Sector risk follows economic logic, not chance: Professional Services, Manufacturing, Construction, Healthcare, and — distinctively for the Americas — Agriculture & Livestock face targeting because threat actors have identified specific, exploitable economic pressure points in each.

Access brokers are a leading indicator: a small number of sellers control the region's initial access market and routinely precede ransomware deployment by weeks.

For security leaders across North and South America, the strategic imperative is the same even where the tactical details diverge: know which named actors are active in your specific country and sector, prioritize risk-based patching over blanket cycles, treat data exfiltration as inevitable rather than optional, and build recovery infrastructure that assumes an attack will happen — not one that hopes it won't. The data confirms the Americas will remain the world's most heavily targeted ransomware region through the remainder of 2026. The only open question is how prepared each organization chooses to be.

Frequently Asked Questions (FAQs)

How many ransomware attacks hit the Americas in H1 2026?

2,188 documented ransomware attacks were observed across North and South America in H1 2026, according to Cyble Research and Intelligence Labs (CRIL) findings.

Which ransomware group is most active in the Americas in H1 2026?

Qilin is the most active group across the combined Americas, with 410 documented attacks (370 in North America, 40 in South America). Within South America specifically, however, The Gentlemen — not Qilin — is the dominant actor.

How many ransomware attacks hit North America in H1 2026?

CRIL recorded 1,981 ransomware attacks in North America during H1 2026, representing roughly 52% of all ransomware activity tracked worldwide.

How many ransomware attacks targeted the US in H1 2026? Is it the highest?

Yes. CRIL observed 1,721 ransomware attacks targeted at the US — which is 78.7% of the American continent (North and South, both), and nearly 45% of every ransomware attack recorded worldwide.

Which sector was the most targeted in South America?

IT & ITES remained the most targeted sector in South America for H1 2026.

Ransomware actors targeted which country the most in South America?

Brazil. With 71 attacks, it was the prime target of ransomware actors in H1 2026.

Is Brazil a significant ransomware target?

Yes. Brazil recorded 71 ransomware attacks — the highest total in South America — and additionally faced an alleged 250 million record breach at credit bureau Serasa, an access sale allegedly targeting the Central Bank of Brazil, and new Android banking trojan families (TCLBANKER, BTMOB RAT) targeting financial and cryptocurrency users.

What is the most targeted industry in the Americas?

Construction tops North America's target list, while IT & ITES, Healthcare, and Professional Services top South America's. Across the whole Americas, Construction and Manufacturing remain consistently high-risk due to their low tolerance for operational downtime.

The post Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors appeared first on Cyble.

Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors

Blog – Cyble

7 de Agosto de 2026, 07:58

Ransomware, Ransomware Threats Europe, Ransomware in Europe

Europe faced a ransomware onslaught in the first half of 2026 that sets a troubling precedent for the remainder of the year. According to Cyble Research and Intelligence Labs (CRIL), the region experienced 866 documented ransomware attacks, 51 confirmed data breach incidents, and 7 initial access sales between January and June 2026. These figures represent not just a volume problem, but a fundamental shift in how threat actors are organizing, targeting, and monetizing their operations within European territory.

What distinguishes the ransomware threats in Europe from other global regions is the concentration of power among a small number of highly sophisticated threat actors. While the threat ecosystem encompasses dozens of groups, five dominant ransomware operators account for approximately 55% of all documented activity. This concentration creates predictability—European security leaders can now identify, profile, and build specific defensive strategies against known adversaries.

The Five Dominant Ransomware Groups Targeting Europe

1. Qilin: The Biggest Ransomware Threat in Europe

Attack Volume: 158 documented incidents (18.2% of regional total)

Qilin stands as the dominant ransomware threat actor targeting Europe, commanding operational superiority through sophisticated affiliate management, rapid exploit weaponization, and industry-specific targeting intelligence.

Geographic Concentration:

Germany: 32 attacks (highest single-country targeting)

France: 28 attacks

United Kingdom: 26 attacks

Spain: 20 attacks

Italy: 19 attacks

Worldwide Sectoral Targeting: Qilin demonstrates deliberate sectoral selection rather than opportunistic targeting:

Construction: 103 incidents (primary focus)

Professional Services: 90 incidents (legal, accounting, consulting firms)

Manufacturing: 67 incidents (industrial operations)

Government & Law Enforcement: 19 incidents

Technology: 22 incidents

Operational Characteristics:

Qilin's dominance stems from understanding European organizational economics. Construction projects operate under time-sensitive contracts with contractually-defined penalties for delay. A single day of downtime on a €50 million construction project can trigger cascading costs exceeding €100,000. This economic reality translates directly into ransom payment likelihood, making Qilin's targeting strategy rational and highly effective.

The group maintains an extensive affiliate network capable of concurrent operations across multiple European nations. Evidence suggests Qilin has compartmentalized its operations: initial access brokers handle reconnaissance and network compromise, mid-tier operators manage lateral movement and privilege escalation, and final-stage operators execute encryption and exfiltration. This division of labor enables rapid scaling and reduces attribution risk.

Why Qilin Dominates:

Industry Expertise: Deep understanding of construction project timelines and financial exposure

Affiliate Loyalty: Competitive payout structures (estimated 70-80% to affiliates) ensure consistent operator recruitment

Exploit Library: Rapid weaponization of both known and zero-day vulnerabilities

Data Monetization: Established data brokerage partnerships ensure exfiltrated data reaches buyers

European Security Implications: Organizations in construction, professional services, and manufacturing should treat Qilin as their primary threat actor concern. Defensive strategies must prioritize data exfiltration prevention, network segmentation, and immutable backup infrastructure.

2. The Gentlemen: The Rising European Threat

Attack Volume: 144 documented incidents (16.6% of regional total)

The Gentlemen represent an emerging threat actor that has achieved remarkable scale in a relatively short operational window. Unlike established groups that evolved from other cybercriminal operations, The Gentlemen appear purpose-built for ransomware-as-a-service operations.

Geographic Concentration:

Europe: 144 attacks (primary focus)

United States: 100 attacks (secondary focus)

Thailand: 35 attacks (supply-chain targeting)

South Asia: 40 attacks

Worldwide Sectoral Targeting:

Construction: 45 incidents

Manufacturing: 56 incidents

Healthcare: 37 incidents

IT & ITES: 36 incidents

Professional Services: 29 incidents

Operational Characteristics:

The Gentlemen's rapid emergence and sustained growth suggest significant operational funding and technical sophistication. The group's geographic diversification—maintaining European dominance while aggressively expanding into Asia-Pacific—indicates either organizational scale or partnerships with regional threat actors.

Notably, The Gentlemen's Thailand targeting (35 incidents) suggests supply-chain attack sophistication. By compromising manufacturing and logistics operations in Thailand, the group can leverage these beachheads for downstream attacks against Western European organizations. This cross-continental supply-chain targeting represents a significant evolution in ransomware operational sophistication.

Key Distinction: While Qilin focuses on maximizing ransom payments from individual targets, The Gentlemen appear to prioritize operational scale and geographic expansion. This suggests the group may be building toward either:

A mega-RaaS platform rivaling LockBit's historical dominance

Preparation for potential acquisition or partnership with state-sponsored actors

Geographic arbitrage—leveraging lower prosecution risk in developing nations while maintaining European operations

European Security Implications: The Gentlemen's emergence signals market competition is intensifying. Organizations should monitor this group's operational evolution closely, as aggressive growth often precedes operational mistakes that create defensive opportunities.

3. LockBit: The Persistent Legacy Threat

Attack Volume: 61 documented incidents (7.0% of regional total)

LockBit's presence in European targeting represents a significant finding given sustained law enforcement pressure and multiple platform disruption attempts. Despite being targeted by coordinated international takedown operations, LockBit maintained operational capability throughout H1 2026.

Geographic Concentration:

Europe: 61 attacks (Primary operations)

North America: 47 attacks (Secondary operations)

Distributed: Global presence indicating resilient infrastructure

Worldwide Sectoral Targeting:

Construction: 22 incidents

Manufacturing: 22 incidents

Government & LEA: 12 incidents

Healthcare: 19 incidents

Professional Services: 13 incidents

Operational Resilience:

LockBit's continued operations despite international enforcement actions demonstrate several critical lessons:

Affiliate Compartmentalization: By maintaining separate operational cells, LockBit can continue operations even when core infrastructure is disrupted

Rapid Rebranding: The group has adopted multiple identities and platform variants, complicating attribution

Infrastructure Redundancy: Multiple command-and-control server locations across jurisdictions with varying law enforcement cooperation levels

Operator Recruitment: Continuous recruitment of new affiliates from emerging cybercriminal talent pools

The group's continued viability suggests that law enforcement actions, while disruptive, are insufficient to eliminate established RaaS operations. Organizations cannot rely on law enforcement intervention as a defensive strategy; they must assume LockBit and similar groups will remain operational threats indefinitely.

European Security Implications: LockBit should remain on European security teams' active threat monitoring lists. The group maintains technical sophistication, access to critical zero-day exploits, and demonstrated willingness to target European critical infrastructure.

4. Akira: The Opportunistic European Operator

Attack Volume: 59 documented incidents (6.8% of regional total)

Akira represents a secondary-tier ransomware group with focused European operations. The group demonstrates strong preference for Manufacturing and Construction sectors, suggesting industry-specific expertise or targeted affiliate recruitment.

Geographic Concentration:

Europe & UK: 59 attacks (Secondary focus)

North America: 268 attacks (Primary focus)

Secondary: Limited operations in other regions

Worldwide Sectoral Targeting:

Manufacturing: 54 incidents

Construction: 57 incidents

Professional Services: 47 incidents

Consumer Goods: 34 incidents

Healthcare: 13 incidents

Operational Profile:

Akira's disproportionate North American presence (268 attacks) with lower European activity (59 attacks) suggests the group may have established affiliate networks in North America with secondary capacity for European operations. The strong manufacturing and construction focus mirrors Qilin's strategy, indicating these sectors offer superior ransom payment likelihood across multiple geographic markets.

European Security Implications: While not as immediately threatening as Qilin or The Gentlemen, Akira's persistent operations warrant inclusion in threat modeling exercises. European manufacturing and construction organizations should monitor Akira's affiliate recruitment channels and tactical innovations.

5. Dragonforce: The Supply-Chain Specialist

Attack Volume: 54 documented incidents (6.2% of regional total)

Dragonforce rounds out the top-five European threat actors with apparent specialization in Manufacturing and Technology sectors, suggesting possible supply-chain attack capabilities.

Geographic Concentration:

North America: 135 attacks (Primary focus)

Europe & UK: 54 attacks (Secondary focus)

Secondary: Limited global operations

Worldwide Sectoral Targeting:

Manufacturing: 31 incidents

Construction: 48 incidents

Professional Services: 28 incidents

Food & Beverages: 9 incidents

Healthcare: 9 incidents

Operational Pattern:

Dragonforce's heavy US focus with secondary European operations suggests the group may be leveraging North American-based supply chains to gain access to European targets. Manufacturing supply chains are deeply interconnected across transatlantic partners; compromising US manufacturers could provide lateral access into European operations.

European Security Implications: European manufacturing organizations should implement aggressive third-party risk management programs, particularly for US-based suppliers. Dragonforce's supply-chain sophistication suggests the group may bypass direct targeting in favor of compromising upstream vendors.

The Five Most Targeted European Nations

Top five European Nations Attacked by Ransomware Actors in 2026 H1 (Source: Cyble Research)

Germany: The Manufacturing Battleground

Attack Volume: 155 ransomware attacks (17.9% of regional total)

Germany's position as Europe's manufacturing powerhouse places it at the center of ransomware targeting campaigns. The nation's industrial sector—encompassing automotive, machinery, chemicals, and precision manufacturing—represents the most valuable ransomware target set in Europe.

Threat Actor Concentration:

Qilin: 32 attacks (20.6% of German total)

The Gentlemen: 32 attacks

LockBit: 18 attacks

Akira: 32 attacks

Dragonforce: 9 attacks

Sectoral Breakdown:

Manufacturing: 67 incidents (significant concentration)

Construction: 38 incidents

Professional Services: 28 incidents

Technology: 15 incidents

Healthcare: 12 incidents

Why Germany Faces Maximum Pressure

German organizations represent an optimal target combination: high asset value, supply-chain criticality, strong operational technology integration, and proven willingness to pay ransoms to maintain production schedules. Additionally, Germany's federal structure creates jurisdictional complexity that may slow law enforcement response.

The nation's Mittelstand (mid-market manufacturing firms) are particularly vulnerable—large enough to justify ransom payments, but sometimes lacking enterprise-grade security infrastructure.

Defensive Priority: German manufacturing organizations should assume Qilin, The Gentlemen, Akira, and Dragonforce all maintain active operations targeting their sector. Network segmentation between IT and operational technology (OT) environments should be elevated to critical priority.

United Kingdom: The Financial Services Crosshairs

Attack Volume: 138 ransomware attacks (15.9% of regional total)

The UK faces a different threat profile than Germany, driven primarily by London's position as a global financial services hub. While manufacturing is targeted, Banking, Financial Services, and Insurance (BFSI) organizations command disproportionate attention.

Threat Actor Concentration:

Qilin: 26 attacks

The Gentlemen: 26 attacks

LockBit: 18 attacks

Akira: 13 attacks

Dragonforce: 11 attacks

Sectoral Breakdown:

BFSI: 38 incidents (concentrated targeting)

Technology: 32 incidents

Retail: 26 incidents

Professional Services: 24 incidents

Government & LEA: 16 incidents

Why the UK Is Targeted

London's financial services ecosystem manages trillions in assets, making it extraordinarily valuable to data-exfiltrating threat actors. BFSI organizations hold customer financial data, internal financial records, and strategic information that commands premium prices on dark web marketplaces.

Additionally, regulatory requirements (FCA, PRA, etc.) create pressure for rapid ransom payment to avoid breach notification delays that could trigger regulatory sanctions.

Data Exfiltration Risk: The UK's status as a financial services hub makes it particularly vulnerable to data-centric attack strategies. Organizations should assume that successful breach attempts will include aggressive data exfiltration alongside encryption deployment.

Defensive Priority: UK BFSI organizations must implement robust data loss prevention (DLP), encryption for data in transit and at rest, and aggressive monitoring for unauthorized data access or exfiltration attempts.

France: The Balanced Threat

Attack Volume: 119 ransomware attacks (13.7% of regional total)

France experiences balanced threat distribution across multiple sectors, reflecting both its manufacturing capacity and significant professional services sector.

Threat Actor Concentration:

Qilin: 28 attacks

The Gentlemen: 28 attacks

LockBit: 15 attacks

Akira: 14 attacks

Dragonforce: 8 attacks

Sectoral Breakdown:

Professional Services: 26 incidents

Manufacturing: 24 incidents

Construction: 19 incidents

Technology: 14 incidents

Healthcare: 10 incidents

Why France Faces Distributed Threat

As Europe's second-largest economy, France is attractive to ransomware operators across multiple sectors. The nation's professional services sector (legal, accounting, consulting) is particularly valuable for data exfiltration, while manufacturing remains a consistent target.

Defensive Priority: French organizations should implement sector-specific defensive strategies: professional services firms should prioritize client data protection and DLP, while manufacturing organizations should focus on OT segmentation and operational resilience.

Italy: The Construction and Manufacturing Hub

Attack Volume: 115 ransomware attacks (13.3% of regional total)

Italy faces concentrated targeting in construction and manufacturing sectors, with particular pressure on small-to-medium enterprises in industrial regions.

Threat Actor Concentration:

Qilin: 19 attacks

The Gentlemen: 18 attacks

LockBit: 12 attacks

Akira: 16 attacks

Dragonforce: 8 attacks

Sectoral Breakdown:

Construction: 48 incidents (concentrated)

Manufacturing: 38 incidents

Professional Services: 18 incidents

Retail: 14 incidents

Why Italy Faces Sector-Specific Pressure

Italy's construction industry is particularly vulnerable to ransom attacks due to tight project timelines and significant financial exposure. The nation's manufacturing sector, while sophisticated, sometimes operates with legacy infrastructure that creates exploitation opportunities.

Defensive Priority: Italian construction and manufacturing organizations should prioritize incident response readiness, backup infrastructure resilience, and supply-chain risk management.

Spain: The Emerging Risk

Attack Volume: 87 ransomware attacks (10.0% of regional total)

Spain experiences lower absolute attack volume than Germany, UK, France, or Italy, but faces concentrated pressure in manufacturing and professional services sectors.

Threat Actor Concentration:

Qilin: 20 attacks

The Gentlemen: 18 attacks

LockBit: 8 attacks

Akira: 12 attacks

Dragonforce: 7 attacks

Sectoral Breakdown:

Manufacturing: 28 incidents

Professional Services: 19 incidents

Construction: 16 incidents

Technology: 10 incidents

Regional Observation: Spain's lower attack volume may reflect either lower overall ransomware targeting or more effective defensive implementations. Spanish security teams should not interpret lower numbers as reduced threat but rather as a baseline for future comparison.

Where European Organizations Face Maximum Risk: A Sectoral Analysis

Construction: The Ransomware Goldmine

Attack Volume: 107 documented incidents (58% of all sector targeting across regions – not just in Europe – analyzed)

Construction organizations face disproportionate ransomware targeting across the entire European region. This concentration reflects understood economic vulnerabilities that threat actors exploit with precision.

Why Construction Is Targeted

Time-Sensitive Financial Exposure: Construction projects operate under contractually-defined timelines. Each day of delay triggers cascading costs, financial penalties, and potential contract termination. Organizations facing potential loss of €50-100 million contracts will prioritize rapid recovery over law enforcement involvement.

Operational Technology Integration: Modern construction increasingly relies on Building Information Modeling (BIM), cloud-based project management, and real-time equipment tracking. This IT/OT convergence creates exploitation pathways unavailable in purely IT-based industries.

Supply-Chain Complexity: Construction projects depend on dozens of subcontractors and suppliers. Compromising a single upstream supplier can provide lateral access into prime contractors.

Financial Pressure: Construction firms often operate with tight cash flow, making ransom negotiation essential to preserve solvency.

Accessibility: Many construction firms, particularly smaller regional players, operate with basic security infrastructure, creating easy exploitation opportunities.

European Construction Risk Mapping:

Germany (14 attacks): Heavy machinery and precision manufacturing integration

Switzerland (10 attacks): Legacy infrastructure vulnerabilities

Spain (13 attacks): Emerging targeting activity

France (10 attacks): Balanced threat across major metropolitan areas

UK (21 attacks): Infrastructure project concentration (rail, utilities, etc.)

Defensive Recommendations for Construction:

Network Segmentation: Isolate operational technology (project equipment, heavy machinery) from corporate IT networks

Access Control: Implement strict authentication for remote project management tools (Autodesk Forge, Procore, etc.)

Immutable Backups: Maintain offline, immutable backups of critical BIM files and project documentation

Incident Response Readiness: Develop construction-specific response playbooks addressing project continuity

Supply-Chain Due Diligence: Implement security requirements for subcontractors and equipment suppliers

Professional Services: The Data Exfiltration Target

Attack Volume: 86 documented incidents

Professional services firms (law, accounting, consulting) face sophisticated targeting driven by data exfiltration opportunities rather than operational disruption pressure.

Why Professional Services Are Targeted

Client Confidentiality Risk: Legal privilege and client confidentiality create existential regulatory and reputational exposure. Threat actors leverage this to demand premium ransoms.

Sensitive Data Concentration: Professional services firms accumulate client financial records, litigation strategies, tax information, and corporate secrets—all commanding premium dark web prices.

Regulatory Exposure: GDPR breach notification requirements create pressure for rapid response and ransom payment to avoid regulatory sanctions.

Supply-Chain Position: Professional services firms advise major corporations; compromising advisors provides indirect access to clients.

Trust-Based Business Model: Client relationships depend on confidentiality. A single breach can destroy long-term client relationships and firm reputation.

European Professional Services Risk:

France (16 attacks): Concentrated targeting of Paris-based firms

Germany (16 attacks): Heavy focus on Frankfurt financial advisory firms

UK (17 attacks): London-based legal and accounting partnerships

Italy (6 attacks): Milan and Rome-based advisory firms

Spain (7 attacks): Barcelona and Madrid professional services sector

Key Finding: Professional services firms experience disproportionate data breach incidents (exfiltration with confirmed leak activity) compared to other sectors. Of the 51 total data breach incidents across Europe and UK, professional services represents a concentrated target.

Defensive Recommendations:

Client Data Segregation: Isolate client data on separate network segments with distinct access controls

Data Loss Prevention (DLP): Deploy DLP solutions with aggressive egress controls monitoring client data exfiltration

Encryption Standards: Implement client-facing encryption for all sensitive communications

Access Auditing: Maintain comprehensive logs of all access to sensitive client data

Ransomware-Specific Insurance: Consider cyber insurance with specific ransomware coverage addressing confidentiality exposure

Manufacturing: The Supply-Chain Critical Target

Attack Volume: 123 documented incidents

European manufacturing organizations face sophisticated, supply-chain-aware threat actors who understand production dependencies and downtime economics.

Why Manufacturing Is Targeted

Operational Technology Integration: Modern factories integrate IT and OT systems. Ransomware deployment can halt production lines, creating catastrophic financial exposure.

Supply-Chain Criticality: Manufacturing downtime cascades through dependent enterprises. A single organization's compromise can impact dozens of downstream customers.

Export Dependency: European manufacturers serve global markets. Production delays translate directly into lost revenue and market share.

Legacy Infrastructure: Many manufacturing facilities operate aging, unpatched systems integrated with newer IT infrastructure, creating exploitation bridges.

Financial Pressure: Manufacturing organizations face razor-thin margins; production downtime can drive solvency crises.

Geographic Manufacturing Risk Concentration:

Germany (27 attacks): Automotive, machinery, precision manufacturing

Italy (21 attacks): Fashion, machinery, chemical manufacturing

France (15 attacks): Automotive, aerospace, industrial manufacturing

Spain (10 attacks): Automotive, machinery, manufacturing

UK (14attacks): Aerospace, automotive, precision manufacturing

Critical Vulnerability Pattern: Manufacturing organizations are disproportionately targeting known, exploitable vulnerabilities in critical infrastructure appliances (network appliances, security tools, identity systems). Rather than deploying zero-days, threat actors exploit patched vulnerabilities that organizations have not implemented.

Defensive Recommendations:

OT/IT Segmentation: Implement airgapped network separation between operational technology and corporate IT

Vulnerability Management Prioritization: Focus patching efforts on network appliances, security tools, and identity systems

Industrial Control System (ICS) Monitoring: Deploy behavioral monitoring for unusual activity on manufacturing control systems

Immutable Backup Strategy: Maintain completely offline backups of critical manufacturing configurations

Supply-Chain Security Program: Implement tier-1 and tier-2 supplier security assessments and vulnerability scanning

Incident Response Scenario Planning: Develop detailed playbooks for production-line ransomware scenarios

Healthcare: The Critical Infrastructure Threat

Attack Volume: 35 documented incidents

Healthcare organizations face a unique threat dynamic where ransomware directly endangers patient safety, creating existential operational pressure distinct from financial threats.

Why Healthcare Is Targeted

Patient Safety Risk: Ransomware disables critical medical systems (diagnostic equipment, pharmaceutical dispensing, patient records). Unlike other industries, downtime directly threatens life.

Regulatory Pressure: GDPR, HIPAA-equivalent regulations, and national privacy laws create breach notification requirements that incentivize ransom payment.

Data Value: Patient medical records, pharmaceutical research data, and clinical trial information command premium dark web prices.

Continuous Operation Requirement: Unlike manufacturing or services, healthcare cannot delay critical procedures. The operational pressure to pay ransoms is existential.

System Complexity: Healthcare IT environments integrate numerous legacy systems (PACS, EHR, medical devices) with varying security architectures.

European Healthcare Risk Distribution:

Germany (14 attacks): Concentrated in Berlin, Munich, and Frankfurt urban medical centers

Austria (2 attacks): private healthcare sector

France (5 attacks): Concentrated in Paris and Lyon region hospitals

Switzerland (3 attacks): medical centers

Spain (3 attacks): Barcelona and Madrid hospital networks

Critical Finding: Healthcare organizations experience disproportionately high data breach incident rates, suggesting organized threat actors specifically target health information exfiltration.

Defensive Recommendations:

Clinical System Isolation: Implement complete network separation between clinical systems and corporate IT

Redundant Critical Systems: Deploy redundant diagnostic and pharmaceutical systems capable of manual operation

Patient Data Encryption: Implement end-to-end encryption for all patient medical records

Breach Response Planning: Develop healthcare-specific incident response plans addressing patient notification and continuity of care

Medical Device Security: Implement inventory and monitoring for all connected medical devices

Supply-Chain Assessment: Assess security of medical device manufacturers and pharmaceutical distributors

The Data Exfiltration Reality: Beyond Encryption

Confirmed Data Breaches: 51 Incidents Across Europe and UK

While ransomware attacks total 866, only 51 incidents resulted in confirmed data breaches and leaks (5.9% confirmation rate). This apparent low percentage masks a critical operational truth: organizations cannot distinguish between encryption-only attacks and data exfiltration scenarios until exfiltration attempts or threats emerge.

Data Breach Distribution by Sector:

Sector	Confirmed Breaches	Percentage
BFSI	9	17.6%
Telecom	9	17.6%
Retail	8	15.7%
Government & LEA	6	11.8%
Media & Entertainment	5	9.8%
Technology	4	7.8%
Healthcare	4	7.8%
Automotive	3	5.9%
Construction	2	3.9%
Education	1	2.0%
Others	6	11.8%

Critical Observation: BFSI and Telecom sectors experience disproportionate data breach incidents, suggesting these industries are specifically targeted for data exfiltration rather than operational disruption. The strategic implication is clear: threat actors targeting financial and telecommunications organizations prioritize data monetization over ransom payment.

Most Active Threat Actors in Data Exfiltration: The Leak Economy

Primary Exfiltration Actors:

Actor	Confirmed Leak Posts	Targeting Pattern
tanaka	6	Industry-agnostic, global operations
kazutlg	4	BFSI and Professional Services focus
aslan1	2	Government and Technology sectors
darkcybervault	2	Retail and Professional Services
breach3d	2	Technology focus
frog	2	Diverse sector targeting
ken6k	2	BFSI concentration
max9898	2	Retail and Technology
worldrdp	2	Technology sector
zyad2drkwb	2	Government targeting
zoozkooz	2	Diverse sector
mr_x1	1	Retail focus
ventuuas	1	Professional Services
Others	18	Distributed diverse targeting

Strategic Finding: While Qilin, The Gentlemen, and LockBit dominate ransomware attack volume, data exfiltration is fragmented across numerous smaller actors, including tanaka (6 posts), kazutlg (4 posts), and dozens of single-incident operators. This suggests a mature data brokerage ecosystem where extracted data is resold to specialized exfiltration actors.

Dark Web Data Marketplace Activity:

916 unique domains impacted by data leaks

Approximately 86 distinct leak posts across dark web channels

Data types: Financial records, customer PII, medical records, intellectual property, trade secrets

Implication: Organizations can no longer assume encrypted data is "lost forever" if backups are restored. Exfiltrated data will be monetized regardless of whether organizations pay ransoms. Data loss prevention becomes as critical as ransomware detection.

Geopolitical and Ideological Dimensions: The Activism-Cybercrime Convergence

Pro-Russian Hacktivism: Blurred Lines Between Ideology and Profit

H1 2026 witnessed increasing overlap between geopolitically motivated hacktivism and financially motivated cybercrime, particularly among pro-Russian collectives targeting NATO-aligned European nations.

Key Threat Actors to Monitor

NoName057(16) - The Pro-Russian DDoS Coalition

Primary Activity: Large-scale DDoS attacks against NATO-aligned governments and Ukrainian supporters

Secondary Activity: Data exfiltration for monetization

Geographic Targets: Estonia, UK, Ukraine, Italy, Spain, France, Poland, Norway, Denmark, Lithuania, Latvia, Czech Republic, Germany, Moldova

Operational Pattern: Coordinated DDoS campaigns often accompanied by data theft and subsequent leak activity

Operational Evolution: NoName057(16) began as a purely activist collective claiming ideological motivation (anti-NATO, pro-Russia). By H1 2026, the group had evolved to include data exfiltration and monetization—suggesting either organizational evolution or infiltration by financially motivated threat actors.

Strategic Implication: European organizations cannot compartmentalize threat modeling. A geopolitically motivated attack that begins as a DDoS campaign can transition into ransomware deployment when exfiltration opportunities present themselves.

Strategic Defense Recommendations for European Organizations

Prioritized Defensive Roadmap

Based on CRIL's H1 2026 regional data, European security leaders should prioritize defensive investments in the following sequence:

Phase 1: Critical Infrastructure Protection (30 days)

Inventory Network Appliances: Document all network appliances (firewalls, SD-WAN platforms, security gateways, VPNs)

Patch Critical CVEs: Prioritize patches for Cisco, Ivanti, Palo Alto, Fortinet, and Microsoft appliances

Access Control Hardening: Implement MFA for all remote administrative access to network infrastructure

Monitoring Deployment: Deploy behavioral monitoring on network appliances for anomalous activity

Phase 2: Data Protection (60 days)

Data Inventory: Identify and catalog sensitive data holdings (customer data, financial records, intellectual property)

DLP Implementation: Deploy data loss prevention solutions with egress monitoring

Encryption Standards: Implement encryption for data in transit (TLS 1.3+) and at rest (AES-256)

Access Logging: Enable comprehensive audit logging for all sensitive data access

Phase 3: Operational Resilience (90 days)

Immutable Backups: Establish offline, immutable backup infrastructure isolated from network access

Incident Response Planning: Develop organization-specific incident response playbooks addressing ransomware scenarios

Business Continuity: Identify critical business functions and develop continuity strategies

Disaster Recovery Testing: Conduct quarterly backup restoration testing to verify recovery capabilities

Phase 4: Threat Hunting and Detection (Ongoing)

Threat Intelligence Integration: Subscribe to European threat intelligence feeds focusing on Qilin, The Gentlemen, LockBit, Akira, and Dragonforce

Behavioral Detection: Deploy endpoint detection and response (EDR) solutions with behavioral analytics

Supply-Chain Monitoring: Implement continuous monitoring of vendor and supplier security posture

Insider Threat Program: Develop insider threat detection capabilities focusing on data exfiltration attempts

Regional Threat Actor Summary: Who Targets Your European Organization

Sector-Specific Threat Actor Mapping

If You're in Construction:

Primary Threat: Qilin, The Gentlemen

Secondary Threat: Akira, Dragonforce

Vulnerability: Network segmentation gaps, supply-chain vulnerabilities, legacy OT systems

Defensive Focus: OT/IT segmentation, immutable backups, supplier security assessment

If You're in Professional Services:

Primary Threat: Qilin, The Gentlemen

Secondary Threat: LockBit, Akira

Vulnerability: Client data exfiltration, regulatory exposure, ransomware payment pressure

Defensive Focus: DLP, client data encryption, ransomware-specific insurance

If You're in Manufacturing:

Primary Threat: Qilin, The Gentlemen

Secondary Threat: Akira, Dragonforce

Vulnerability: OT/IT integration, supply-chain exploitation, operational downtime pressure

Defensive Focus: OT segmentation, vulnerability prioritization, continuity planning

If You're in BFSI:

Primary Threat: Qilin, The Gentlemen, LockBit

Secondary Threat: Data exfiltration actors (tanaka, kazutlg)

Vulnerability: Financial data value, regulatory breach notification pressure, customer trust exposure

Defensive Focus: Data encryption, DLP with aggressive egress controls, cyber insurance

If You're in Healthcare:

Primary Threat: Qilin, The Gentlemen, LockBit

Secondary Threat: Data exfiltration operators

Vulnerability: Patient safety risk, critical operational pressure, medical device security

Defensive Focus: Clinical system isolation, redundant critical systems, incident response for operational continuity

Conclusion: The European Ransomware Reality

Europe and the UK face a mature, organized ransomware ecosystem dominated by five sophisticated threat actors who have developed deep understanding of regional economic vulnerabilities. The threat is not random or opportunistic—it is strategic, targeted, and evolved.

Key Takeaways:

Five groups dominate: Qilin (158 attacks), The Gentlemen (144), LockBit (61), Akira (59), and Dragonforce (54) collectively account for 476 of 866 documented attacks (55%). European security leaders can build specific defensive strategies against known adversaries.

Geography matters: Germany, UK, France, Italy, and Spain face distinct threat profiles. Security strategies must be regionally and sector-specific, not generic.

Sectors are targeted deliberately: Construction, Professional Services, and Manufacturing are not randomly selected—they face extraordinary pressure due to economic vulnerabilities that threat actors systematically exploit.

Data exfiltration is the primary leverage: Of 866 attacks, only 51 resulted in confirmed breaches—but this understates the risk. Organizations must assume all breaches involve data exfiltration and cannot rely on backup restoration alone.

Patch management is the primary defense: Nearly 90% of exploited vulnerabilities had patches available. Disciplined patch management, particularly for network appliances, would prevent the vast majority of successful attacks.

Known vulnerabilities are the current threat: Despite awareness of zero-day sophistication, threat actors continue exploiting known vulnerabilities because patches lag adoption. This creates a predictable exploitation window that defensive teams can close.

For European security leaders, the path forward is to understand your regional threat actors, prioritize critical infrastructure protection, implement robust data protection measures, and establish resilient backup and recovery infrastructure. The threat is severe, but it is also understood and defensible. The question is not whether European organizations will face ransomware attacks in the remainder of 2026 and beyond—the data confirms they will. The question is whether they will be prepared.

The post Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors appeared first on Cyble.

The Cyber Express Weekly Roundup: Ransomware Surge, Government Data Breaches, Logistics Disruptions, and Third-Party Security Risks

7 de Agosto de 2026, 09:31

The Cyber Express weekly roundup H1

This weekly roundup highlights the growing cybersecurity risks affecting businesses, government agencies, and critical service providers. From the continued dominance of ransomware operations to government database breaches and third-party supply chain incidents, recent events demonstrate how attackers are increasingly targeting trusted systems and external service providers to maximize disruption and data exposure. The latest developments reinforce that cyber threats are no longer limited to direct attacks on organizations. Threat actors are exploiting ransomware-as-a-service ecosystems, compromising government registries, targeting law enforcement databases, and abusing third-party platforms that support retail and healthcare operations. Organizations must strengthen third-party risk management, improve data protection measures, and enhance incident response capabilities to reduce the impact of evolving cyber threats.

The Cyber Express Weekly Roundup

Qilin Dominated Ransomware Attacks in H1 2026

Qilin emerged as the most active ransomware group during the first half of 2026, targeting organizations worldwide through its ransomware-as-a-service (RaaS) operation. Manufacturing, healthcare, construction, and professional services were among the sectors most affected as the group continued expanding its global reach. Read more…

Hackers Breach Beneficial Owners Registry, Expose Data of 31,000 Firms

Hackers breached the Register of Beneficial Owners (VwbP), gaining unauthorized access to data associated with approximately 31,000 legal entities. Authorities temporarily took the registry offline, launched an investigation, and established a crisis response team, stating there is currently no evidence that records were altered or deleted. Read more…

PNLD Data Breach Leaks Police and Government Contact Details

A data breach involving the Police National Legal Database (PNLD) exposed names, organizations, and work email addresses belonging to police officers, government partners, criminal justice professionals, and some Ask the Police users after the information appeared on the dark web. Authorities are investigating the incident and assessing its potential impact. Read more…

De Bijenkorf Logistics Cyberattack Delays Orders and Raises Data Exposure Concerns

A cyberattack targeting a third-party logistics provider disrupted deliveries, returns, and refunds for Dutch retailer De Bijenkorf. While the retailer confirmed its internal systems were not compromised, investigators are assessing whether customer contact details and order information were exposed. Payment information, passwords, and financial data were not affected, and customers have been advised to remain vigilant against phishing attempts. Read more…

Updoc Data Breach Exposes Customer Contact Information

Australian telehealth provider Updoc disclosed a data breach after unauthorized access to a third-party operational platform exposed some customers' names, email addresses, and postal addresses. The company confirmed that its internal systems remained secure and that no medical records, payment information, or financial data were compromised. Read more…

Weekly Cybersecurity Takeaway

This week's incidents highlight the continued evolution of cyber threats across ransomware operations, government data breaches, and third-party supply chain compromises. A common theme across these events is the growing risk posed by trusted third-party platforms and shared digital ecosystems. Attackers are targeting external service providers, government databases, and ransomware affiliate networks to expand their reach and maximize operational disruption. Organizations should prioritize stronger third-party risk management, continuous monitoring, robust access controls, and timely incident response to reduce the impact of supply chain attacks and data breaches. As businesses become more interconnected, strengthening the security of partner ecosystems is becoming just as important as protecting internal infrastructure.

The Cyber Express Weekly Roundup: AI Fraud, Data Leaks, Malware Campaigns, and Critical Infrastructure Threats

31 de Julho de 2026, 09:02

The Cyber Express weekly Roundup July 2026 new

This weekly roundup highlights the growing complexity of digital threats affecting governments, businesses, developers, and consumers. From artificial intelligence being misused for financial fraud to large-scale customer data exposures, malicious software targeting developer ecosystems, and cyberattacks against critical infrastructure, recent incidents demonstrate how attackers are exploiting both emerging technologies and existing security weaknesses. The latest developments show that cyber risks are expanding beyond traditional network attacks. Threat actors are targeting identities, trusted platforms, software supply chains, and operational technology environments. Organizations must strengthen security controls, improve monitoring capabilities, and adopt proactive measures to protect sensitive data and critical services.

The Cyber Express Weekly Roundup

Four Men Admit to $2.2 Million Medicaid Fraud Scheme Using AI

Four Minnesota men have pleaded guilty in connection with a Medicaid fraud scheme that allegedly generated approximately $2.2 million through fraudulent claims for housing-related services. Prosecutors stated that artificial intelligence tools, including ChatGPT, were used to create false documentation supporting fraudulent billing activity. Read more...

Tribeca Data Leak Exposes Celebrity-Linked Information

A reported data leak connected to the Tribeca Film Festival exposed nearly 666,000 records containing personal information associated with attendees, contacts, and individuals linked to the entertainment industry. The exposed data reportedly included names, email addresses, phone numbers, and limited device-related information. Read more...

Origin Energy Data Breach Impacts Around 900,000 Customers

Australian energy company Origin Energy confirmed a data breach affecting approximately 900,000 current and former customers. The exposed information may include customer names, contact details, dates of birth, and partial account information. The company is investigating the incident and has advised customers to remain alert for possible scams or suspicious communications. Read more...

Joyfill npm Packages Found Distributing DEV#POPPER Malware

Security researchers discovered that two beta versions of Joyfill npm packages were distributing DEV#POPPER, a remote access trojan (RAT) capable of stealing information, executing commands, and compromising developer environments. Read more...

Student Accused of IIT Website Breaches Offered Technical Assessment

A student accused of breaching parts of the IIT Kanpur and IIT Madras websites after being rejected from IIT Kanpur’s cybersecurity program will undergo a technical skills assessment rather than facing immediate legal action. The institute stated that admissions for the current session are closed but indicated that future opportunities may be considered if the student demonstrates strong cybersecurity abilities. Read more...

FBI Warns of PLC Cyberattacks Targeting U.S. Water Utilities

The FBI and the U.S. Environmental Protection Agency warned that cyberattacks targeting internet-connected programmable logic controllers (PLCs) have disrupted water utilities across multiple U.S. states. Attackers reportedly manipulated PLC settings, affecting monitoring and operational processes. Read more...

Weekly Cybersecurity Takeaway

This week’s incidents demonstrate how cyber threats continue to evolve across multiple domains, including artificial intelligence abuse, personal data exposure, software supply chain attacks, and critical infrastructure targeting. A common theme across these events is the exploitation of trust. Attackers are abusing trusted technologies, legitimate software ecosystems, customer databases, and connected infrastructure to achieve their objectives. Organizations must focus on building cyber resilience through stronger identity protection, secure development practices, continuous monitoring, and effective incident response planning. As emerging technologies such as artificial intelligence and connected industrial systems become more widespread, cybersecurity strategies must evolve alongside them. Protecting digital assets requires not only stronger technical defenses but also responsible for technology use, awareness, and proactive risk management.

One Country Absorbed Nearly Half of the World’s Ransomware Attacks in Just Six Months – The United States

24 de Julho de 2026, 02:09

Ransomware Attacks, Qilin, US, Ransomware Attacks on US

Strip away the geopolitics, the hacktivist noise, and the espionage headlines, and one number from the first half of 2026 stands out above everything else: 1,721. That's how many ransomware attacks hit organizations in the United States between January and June, according to new research from Cyble Research and Intelligence Labs (CRIL). It's not just the highest total of any country tracked in the report — it's more than the next nine most-targeted countries combined.

Canada, in second place worldwide, recorded 179 attacks. Germany logged 155. The United Kingdom, 138. Add up the rest of the global top 10 — France, Italy, Spain, Thailand, India and Brazil — and the total still falls more than 600 attacks short of the U.S. figure alone. Out of 3,836 ransomware attacks CRIL tracked worldwide this half, roughly 45% landed on American soil.

Also read: Fairlife Ransomware Attack Hits Production Systems, U.S. Operations Suspended

A Single Region, an Outsized Share

Widen the lens slightly and the picture holds. North America as a whole recorded 1,981 ransomware attacks in H1 2026 — more than half of every ransomware incident Cyble observed globally — alongside 35 data breach and leak incidents and 9 initial access sale listings. The report describes the region as home to "a mature, persistently active RaaS ecosystem operating at high volume across a wide range of industries and geographies."

Two ransomware-as-a-service operators did much of the damage. Qilin, the single most prolific gang worldwide, claimed 370 of those North American attacks on its own — nearly 19% of the regional total. Akira followed with 268, and INC Ransom added another 164. Together, Qilin and Akira alone accounted for more than half of all recorded ransomware activity across the region, a level of concentration that points to a small number of highly organized affiliate networks doing the bulk of the damage rather than a diffuse swarm of opportunists.

Also read: Qilin Ransomware Group’s TTPs Examined by Researchers

Where the Pressure Lands

Professional Services bore the brunt of North American ransomware activity, with INC Ransom showing a marked preference for law firms and other high-value services with sensitive client data. Construction, Manufacturing and Healthcare followed close behind.

One operator, AiLock, stood out for a coordinated wave of victim disclosures that all landed on the same day — March 3 — a pattern consistent with a mass-exploitation campaign rather than isolated intrusions. LockBit, despite years of law enforcement pressure and takedown attempts, kept up a steady tempo against public-sector and educational targets throughout the period, showcasing how difficult the group has been to fully dismantle.

On the data breach side, Technology and financial services (BFSI) were the most frequently targeted sectors in North America, together accounting for roughly 43% of incidents — a reflection of how much intellectual property and monetizable personal data those industries hold.

Notably, Agriculture & Livestock emerged as a significant target for initial access brokers, accounting for a third of all access listings tied to the region. Cyble flags this as a sign of "growing risk in the food supply chain," an area that has historically drawn less attention from ransomware operators than finance or healthcare.

The initial access market itself was strikingly concentrated: two sellers, tracked under the handles "redpin" and "xpl0itrs," accounted for nearly all listings targeting North American organizations. Threat actors also continued to lean on known and zero-day vulnerabilities in widely deployed enterprise platforms — including products from Ivanti and Palo Alto Networks — as their preferred way into corporate networks.

Hacktivism Blurs into Cybercrime

North America wasn't spared the hacktivism wave sweeping the rest of the world either. Collectives including SOLDADOS DIGITALES – UNIÓN AMERICANA and LYSTIC TEAM #ID drove roughly 56 data leak or dump posts and touched about 360 unique domains across the region, with Government, Technology, financial services and telecommunications entities most frequently in the crosshairs.

Cyble's broader findings suggest many groups marketing themselves as ideologically driven hacktivists are, in practice, running side businesses in stolen data brokerage and DDoS-for-hire services — a blurring of motive that complicates how defenders triage the threat.

The scale of the U.S. numbers doesn't necessarily mean American companies have weaker defenses than their global peers — the concentration also reflects the sheer size and digital density of the U.S. economy, and its outsized share of the high-value targets ransomware affiliates chase. But the data does argue for a shift in posture.

Cyble's broader recommendations — treating data exfiltration, not just encryption, as the primary risk; prioritizing patches for the recurring vendor list; and monitoring initial access markets as a leading indicator rather than an afterthought — apply nowhere more urgently than in a country absorbing this much of the world's ransomware volume on its own.

Vishing Call Becomes Key Lead in Massive Odido Cyberattack

Por:Samiksha Jain

13 de Julho de 2026, 03:32

Odido cyberattack

The investigation into the Odido cyberattack has uncovered possible involvement of Dutch nationals, according to Dutch police, as authorities continue to investigate the ShinyHunters ransomware-linked attack that exposed the personal data of approximately 6.39 million customers. Law enforcement has urged the public to come forward with information as investigators work to identify those responsible for one of the country's largest telecom data breaches.

The cyberattack took place on February 5 and 6 after attackers allegedly used voice phishing (vishing) to deceive Odido's customer service team.

According to the company, the attackers posed as members of its internal IT staff, gaining unauthorized access before exfiltrating customer data. Odido said its teams detected the unauthorized access immediately on both occasions and revoked the attackers' access, but the incident still resulted in a large-scale data breach.

Odido Cyberattack Investigation Finds Possible Dutch Link

Under the direction of the National Public Prosecution Service, the High Tech Crime Team (THTC) of the National Investigation and Intervention Unit launched an extensive investigation into the breach.

Authorities said investigators have found strong indications that Dutch criminals may have been involved. One key lead centers on a phone call made shortly before the breach in which a Dutch-speaking man allegedly impersonated an Odido IT employee while speaking with customer service representatives. Police are continuing efforts to identify the caller and have indicated that his voice could be made public if necessary.

Investigators believe people within cybercrime circles may have information about those responsible and are encouraging anyone with relevant details to contact law enforcement.

ShinyHunters Named as Threat Actor

Odido attributed the attack to the cybercriminal group ShinyHunters, which the company said carried out the social engineering campaign.

Chief Executive Officer Søren Abildgaard acknowledged the incident in a public statement, apologizing to customers and outlining the company's commitment to strengthening its cybersecurity capabilities. He said Odido would continue investing in security, improve data protection practices, expand customer support, and share lessons learned from the incident.

The CEO also explained why the company refused to pay the ransom demand. According to Odido, paying cybercriminals would reward illegal activity and could encourage future attacks against other Dutch organizations. The company said the decision was made following guidance from authorities, despite knowing that stolen data could eventually be published.

Millions of Customers Impacted

Odido confirmed that approximately 6.39 million active and former customers of Odido and its Ben brand were affected by the breach. Customers of Simpel were not impacted.

The exposed information varied by individual and included names, addresses, mobile phone numbers, customer numbers, email addresses, IBAN numbers, dates of birth, identification details, nationality, and gender.

The company clarified that My Odido account passwords, call records, location data, billing information, and scans of identity documents were not compromised.

Odido also addressed reports claiming customer passwords had been leaked, stating that login passwords remain securely encrypted and were never accessible during the attack. Instead, a separate telephone verification field known as "password_c," used as a customer challenge code, was included for a limited number of customers. The company has since discontinued using that verification method.

Customer Support and Security Measures Expanded

Following the breach, Odido increased customer support by adding more than 140 service agents and introduced additional security measures. These include its "Check je Gesprek" verification service, allowing customers to confirm whether communications claiming to be from Odido are legitimate, along with access to the F-Secure digital security service.

The telecom provider said all customers identified as affected have been notified by email or SMS, while customer service teams continue assisting users with questions related to their specific data exposure.

Meanwhile, Dutch authorities expect investigations into the Odido cyberattack to continue for several months. Police have also warned that cyberattacks targeting businesses and institutions are becoming increasingly common, urging organizations to strengthen cybersecurity defenses and encouraging citizens to remain vigilant against follow-on fraud and phishing attempts.

Hacker Claims Accenture Breach Exposed Source Code, SSH Keys, and Azure Tokens

Security | TechRepublic

Por:Liz Ticong

8 de Julho de 2026, 12:52

Accenture confirmed a breach after a hacker claimed 35GB of source code and cloud keys were stolen, raising questions for cloud and security teams.

The post Hacker Claims Accenture Breach Exposed Source Code, SSH Keys, and Azure Tokens appeared first on TechRepublic.

ShinyHunters Claims Council of Europe HR Data, Threatens Leak

Security | TechRepublic

Por:Joseph Ofonagoro

16 de Junho de 2026, 11:18

ShinyHunters claims it stole 297GB of data from the Council of Europe, including payroll and medical records, but the organization has not confirmed a breach.

The post ShinyHunters Claims Council of Europe HR Data, Threatens Leak appeared first on TechRepublic.

Belarus-Linked UNC1151 Launches Gmail Phishing Campaign to Steal 2FA Codes

Por:Samiksha Jain

16 de Junho de 2026, 04:38

UNC1151 Gmail Phishing Campaign

The UNC1151 Gmail phishing campaign has emerged as a cyber threat targeting Polish internet users, with attackers now focusing on Gmail accounts and deploying phishing pages capable of stealing both passwords and two-factor authentication (2FA) credentials. According to researchers at CERT Polska, the campaign marks a notable evolution in the tactics of the Ghostwriter-linked threat group, which has spent years targeting email users across Poland. Also tracked as Ghostwriter and Storm-0257, UNC1151 has been linked by cybersecurity researchers to Belarusian state intelligence services and has remained active against Polish targets since Russia's full-scale invasion of Ukraine.

UNC1151 Gmail Phishing Campaign Expands Target Scope

For years, UNC1151 primarily targeted users of popular Polish email providers including Onetpasswords, Wirtualna Polska, and Interia. Since March 2026, however, the group has shifted its attention to Gmail users, launching high-volume phishing operations that run almost daily during weekdays. CERT Polska researchers said the attackers target a wide range of individuals, including politicians, public officials, researchers, journalists, law enforcement personnel, government employees, and people connected to them through professional, family, or social relationships. [caption id="attachment_112742" align="aligncenter" width="600"] UNC1151 Gmail Phishing Campaign

Image Source: CERT Polska[/caption] The group also conducts campaigns against specific professional sectors and geographic regions. In some cases, phishing emails are sent to unintended recipients because attackers attempt to guess email addresses based on names and affiliations.

How the UNC1151 Gmail Phishing Campaign Works

The UNC1151 Gmail phishing campaign relies on fraudulent emails designed to resemble official Gmail security notifications. The messages often warn recipients about suspicious account activity, unauthorized login attempts, or alleged violations of service policies. Victims are urged to act quickly to avoid account suspension or permanent deletion. The emails are typically sent from Gmail accounts created specifically for phishing operations, although attackers occasionally use compromised accounts to increase credibility. Common subject lines include warnings about security alerts, suspicious activity, and account verification requirements. Embedded links direct recipients to fake Gmail login pages that closely imitate Google's legitimate authentication portal. Once users enter their credentials, attackers capture both usernames and passwords.

2FA Credential Theft Marks Key Evolution

One of the most concerning developments in the campaign is its ability to harvest two-factor authentication theft credentials. Unlike earlier phishing campaigns targeting Polish email services, the latest operation includes additional prompts requesting verification codes after login credentials have been entered. If a victim's account is protected by 2FA, the phishing page automatically displays a form requesting the authentication code. This enables attackers to steal both SMS-based verification codes and codes generated through applications such as Google Authenticator. Researchers noted that attackers frequently continue targeting the same victims even after unsuccessful login attempts. Multiple phishing emails may be delivered within days to increase pressure and improve the chances of credential theft. [caption id="attachment_112735" align="aligncenter" width="600"] UNC1151 Gmail Phishing Campaign

Source: CERT Polska[/caption]

Ghostwriter Phishing Infrastructure Continues to Evolve

The campaign relies on a constantly changing phishing infrastructure. According to CERT Polska, operators use domains registered specifically for phishing activities, often leveraging top-level domains such as .icu, .digital, and .top. The group also abuses hosting platforms such as Netlify by creating deceptive subdomains that imitate account verification services. Examples of domains observed in the campaign include mailverify.digital, verify-check.digital, monitoring-google-konta.netlify.app, and service-auth.netlify.app. In addition, attackers host fake login panels on compromised websites belonging to legitimate organizations. Rather than replacing the main website, the phishing content is hidden within the compromised infrastructure, allowing attacks to remain undetected for extended periods.

Gmail Phishing Attacks Signal Broader Threat

Security researchers warn that the increase in Gmail phishing attacks demonstrates UNC1151's continued ability to adapt its tactics while maintaining its long-standing objective of gaining access to email accounts. Once access is obtained, attackers search for sensitive documents, contact lists, and linked services, including social media accounts that can be further compromised. Stolen contacts may also be used to identify additional targets for future phishing campaigns. Although the group's recent focus has shifted toward Gmail, researchers caution that attacks against users of Polish email providers have not disappeared entirely. The findings highlight the growing sophistication of state-linked phishing operations and reinforce the importance of scrutinizing login requests, verifying website domains, and protecting accounts with strong authentication practices. As the UNC1151 Gmail phishing campaign continues to evolve, cybersecurity experts expect further adaptations designed to bypass defenses and increase the success rate of credential theft operations.

ServiceNow Flaw Prompted Security Update After Researcher-Observed Activity, Not Active Attacker Exploitation

11 de Junho de 2026, 03:53

ServiceNow flaw

A recently disclosed ServiceNow flaw led to an emergency security update after unusual activity was identified in customer environments. While early reports suggested that unknown threat actors had exploited the vulnerability, ServiceNow has clarified that the observed activity originated from security researchers and customer security teams, not malicious actors. The issue, first widely discussed on Reddit, triggered concern across the cybersecurity community after evidence emerged showing that certain queries against ServiceNow instance data were possible under specific conditions. However, ServiceNow has now confirmed that no data was used or retained in a malicious manner. The company stated that the vulnerability affected certain customer configurations and could, in limited scenarios, allow an unauthenticated user to gain elevated access beyond intended permissions.

ServiceNow Flaw and Security Update Deployment

ServiceNow released a security update on June 5, 2026, addressing the issue across hosted customer environments.

“On June 5, 2026, ServiceNow applied a security update to hosted customer instances. The update concerned a security issue that could allow an unauthenticated user, in certain circumstances, to gain greater access to ServiceNow instances than intended.”

To reduce the risk associated with the ServiceNow flaw, the company modified endpoint configurations to ensure access is restricted to authenticated users only. At the time of disclosure, the issue had not yet been assigned a CVE identifier.

The vulnerability initially surfaced through Reddit discussions, where users raised concerns about potential exposure and questioned the internal response timeline.

No Evidence of Attacker Exploitation, Says ServiceNow

ServiceNow has clarified that there is no evidence of active exploitation by threat actors. Instead, the company said it identified unusual activity linked to research testing and customer-led investigations. According to ServiceNow, a subset of customer instances was queried during this activity, but the activity was not malicious in nature. The company also emphasized that affected customers were directly notified and provided with remediation guidance.

Scope of the ServiceNow Flaw and Affected Customers

The issue primarily impacted customers using the Australia platform release and some instances running pre-Australia configurations with specific changes.

“The security issue pertains to customers who are on the Australia platform release or made certain configuration changes to instances on releases prior to Australia.”

ServiceNow stressed that the incident was limited in scope and not a systemic issue affecting its entire customer base.

A company spokesperson reiterated that communication efforts focused on a small subset of impacted customers rather than a broad population.

Community Discussion and Reddit Timeline Questions

The ServiceNow flaw also sparked debate on Reddit regarding disclosure timelines and internal awareness.

One user, “d3s7iny,” claimed their security team had previously reported the vulnerability and alleged that ServiceNow had known about the issue since April 7, 2026. The post suggested the issue had been treated as non-urgent and scheduled for a later fix.

While these claims circulated widely online, they remain unverified and have not been confirmed by ServiceNow.

Bug Bounty Reports and Early Disclosure Signals

ServiceNow’s advisory confirmed that multiple bug bounty submissions were received shortly before the patch was released.

Between June 3 and June 4, 2026, customers reported a potential security issue through bug bounty channels that aligned with earlier internal findings.

The company also referenced a confidential report submitted on April 22, 2026, which described similar behavior affecting instance data access under specific conditions.

These overlapping reports contributed to the eventual identification and remediation of the ServiceNow flaw.

Clarification on Researcher Activity and Final Response

ServiceNow has since issued a public clarification, stating that the observed activity came from security researchers and customer investigation teams, not from malicious exploitation.

An official notification is available on the company’s trust portal: https://trust.servicenow.com/notifications/1205429e-fea3-4cbf-b37b-8cd3a4e07aef

The company emphasized that no customer data was retained or misused during the process and that the vulnerability was addressed through a targeted security update.

Miasma Malware Targets Red Hat npm Packages in New Supply Chain Attack

2 de Junho de 2026, 05:14

Miasma

A newly discovered software supply chain campaign, dubbed Miasma, has emerged as the latest evolution of the Shai-Hulud supply chain attack, compromising several redhat-cloud-services npm packages to steal credentials, harvest secrets from developer systems, and spread through development environments using worm-like behavior. Security researchers at Socket described the operation as a smaller but highly capable successor to earlier Shai-Hulud campaigns, noting that it employs many of the same techniques that made previous attacks effective against software development ecosystems.

"This is effectively a Mini Shai-Hulud campaign: it uses the same core tactics of install-time execution, credential harvesting, CI/CD targeting, encrypted exfiltration, and potential downstream propagation," Socket said.

Attribution Remains Unclear as TeamPCP Tools Continue to Circulate

The identity of the threat actor behind the latest Shai-Hulud supply chain attack remains uncertain. One major reason is the role of TeamPCP, a well-known cybercrime group that previously open-sourced tools associated with the original Shai-Hulud worm. By publicly releasing those resources, TeamPCP lowered the barrier for other attackers to launch similar operations, making attribution significantly more difficult. Researchers have not yet linked the Miasma campaign to any specific actor with confidence.

Affected redhat-cloud-services Packages

The attack targeted multiple packages published under the redhat-cloud-services namespace. The known compromised packages include:

@redhat-cloud-services/vulnerabilities-client
@redhat-cloud-services/tsc-transform-imports
@redhat-cloud-services/topological-inventory-client
@redhat-cloud-services/sources-client
@redhat-cloud-services/rule-components
@redhat-cloud-services/remediations-client
@redhat-cloud-services/rbac-client

The malicious code embedded within these packages was designed to execute during installation, allowing attackers to collect sensitive information from infected developer environments.

Encrypted Data Theft and GitHub-Based Propagation

Similar to earlier waves of the Shai-Hulud supply chain attack, the malware incorporates encrypted exfiltration capabilities. Stolen information is transmitted to the endpoint "api.anthropic[.]com:443/v1/api," while GitHub serves as a secondary communication and propagation channel. According to Socket, the malware can commit encrypted data packages directly through GitHub's API.

"It commits the encrypted result envelope through the GitHub API," Socket said. "The commit message can include: IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner:."

Researchers from OX Security identified the first commit containing the phrase "Miasma: The Spreading Blight" on May 29, 2026. This suggests either that the malware variant had already been active by that date or that attackers began testing the campaign around that time.

GitHub Abuse Enables Verified Malicious Commits

The Miasma malware actively searches for repositories where stolen GitHub tokens possess write permissions. It then inspects action.yml and action.yaml files using GraphQL queries before injecting malicious workflows through GitHub's createCommitOnBranch mutation. This technique allows the resulting commits to appear as legitimate, verified, and signed changes, increasing the likelihood that malicious modifications will evade scrutiny. The malware is also capable of performing several additional actions, including:

Attempting privilege escalation by launching containers that bind-mount the host's /etc/sudoers.d directory and grant passwordless sudo access to CI runners.
Detecting endpoint protection products such as CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner before executing malicious activities.
Establishing persistence by modifying Anthropic Claude Code through a SessionStart hook.
Creating Visual Studio Code tasks.json files configured with "runOn": "folderOpen" to ensure automatic execution whenever a project is opened.

Red Hat GitHub Account Believed to Be Initial Entry Point

Investigators believe the campaign originated from the compromise of a Red Hat employee's GitHub account. Evidence indicates that the account served as the patient zero event used to inject malicious code into the affected redhat-cloud-services packages. The compromised account reportedly pushed malicious orphan commits into two RedHatInsights repositories, allowing the attacker to bypass normal code review procedures and introduce the malicious payload.

Recommended Response and Remediation Steps

Security experts advise organizations that installed affected redhat-cloud-services package versions to immediately isolate impacted systems and remove compromised releases. Additional recommendations include:

Rotating all potentially exposed credentials.
Reviewing GitHub and npm activity for suspicious behavior.
Auditing environments for persistence mechanisms.
Investigating modifications to configuration files such as:
- ~/.claude/settings.json
- .vscode/tasks.json
- .github/workflows/codeql.yml
- .github/setup.js
Enforcing stronger access controls across development environments.

Socket warned that removing the malicious package alone is not sufficient.

"Because the malware includes background execution and potential developer-tool persistence mechanisms, uninstalling the npm package or deleting node_modules should not be considered sufficient cleanup," Socket explained.

The company also urged organizations operating CI/CD pipelines to suspend affected workflows, invalidate any build artifacts created during the exposure period, and review whether software releases, container images, npm packages, or deployment artifacts were generated after installation of the malicious package.

Threat Actors Target Critical Windows Netlogon Flaw CVE-2026-41089

2 de Junho de 2026, 04:26

CVE-2026-41089

A critical Windows Netlogon vulnerability, tracked as CVE-2026-41089, has emerged as a significant security concern after authorities warned that threat actors are actively attempting to exploit the flaw to gain remote code execution capabilities on vulnerable systems. The security issue, which carries a CVSS severity score of 9.8, was publicly disclosed on May 12, 2026, when Microsoft addressed it alongside 136 other vulnerabilities as part of its monthly Patch Tuesday security updates. While several of the bugs fixed during that release were identified as likely candidates for exploitation, CVE-2026-41089 was not initially included among those expected to be targeted by attackers.

Threat Actors Reportedly Exploiting CVE-2026-41089

The Centre for Cybersecurity Belgium (CCB) issued a warning on Friday, stating that threat actors have begun exploiting the critical Windows Netlogon vulnerability in real-world attacks. The agency urged organizations to deploy available security updates immediately to reduce the risk of compromise. According to the CCB, the flaw is “now actively exploited in the wild,” raising concerns that attackers may already be targeting unpatched systems. The organization noted that successful exploitation could allow remote attackers to execute arbitrary code with System-level privileges, providing extensive control over affected environments. Despite the warning, no additional public reports have surfaced confirming exploitation attempts involving CVE-2026-41089. Furthermore, Microsoft has not updated its advisory to indicate that active attacks have been verified.

How the Windows Netlogon Vulnerability Works

Microsoft’s advisory describes CVE-2026-41089 as a stack-based buffer overflow vulnerability affecting the Netlogon service. The flaw can be triggered through specially crafted network requests sent to a Windows server operating as a domain controller. Importantly, the vulnerability can be exploited by unauthenticated attackers, meaning no valid credentials or prior access to the targeted environment are required. Microsoft explained the risk in its advisory, stating: “If successful, this could cause the Netlogon service to improperly handle the request, potentially allowing the attacker to run code on the affected system without needing to sign in or have prior access.” Because the flaw enables remote code execution and does not require authentication, security experts consider CVE-2026-41089 one of the more dangerous vulnerabilities addressed during the May 2026 Patch Tuesday release.

Why the Netlogon Service Remains a High-Value Target

The Netlogon service plays a critical role in Windows domain-based environments by handling authentication processes between users, computers, and domain controllers. As a core background service, it is essential to maintain secure communication and identity verification across enterprise networks. Historically, weaknesses in Netlogon have attracted the attention of threat actors because successful exploitation can provide access to highly privileged systems. Critical flaws affecting the service can potentially allow attackers to gain control over a domain controller and, by extension, influence or compromise connected machines throughout the network. Given the importance of the service, security professionals have long viewed any severe Windows Netlogon vulnerability as a high-priority issue requiring rapid remediation. Regardless of the differing assessments, security experts recommend that organizations prioritize patching CVE-2026-41089 as soon as possible. The combination of its critical severity rating, the potential for unauthenticated remote code execution, and reports of activity by threat actors makes the vulnerability a significant risk for organizations operating Windows domain environments.

Megalodon Supply Chain Attack Hits 5,500+ GitHub Repositories in Six Hours

26 de Maio de 2026, 03:27

Megalodon

A large-scale software supply chain attack dubbed “Megalodon” has compromised more than 5,500 repositories on GitHub, raising fresh concerns about the growing abuse of automated development pipelines and GitHub Actions workflows. The incident, uncovered by SafeDep, involved thousands of malicious commits that injected credential-stealing payloads into repositories over a short period of time. According to researchers, the Megalodon campaign targeted repositories through automated commits that inserted malicious GitHub Actions workflows capable of harvesting sensitive credentials, cloud access keys, API tokens, and other secrets stored within continuous integration and continuous delivery (CI/CD) environments.

Thousands of Malicious GitHub Actions Commits Detected Within Hours

The attack unfolded on May 18, 2026, when attackers pushed more than 5,700 malicious commits across thousands of repositories within six hours. SafeDep’s investigation found that a total of 5,718 commits were deployed between approximately 11:36 UTC and 17:48 UTC, affecting 5,561 distinct GitHub repositories. Researchers said the Megalodon operation relied heavily on GitHub Actions to establish persistence and silently collect sensitive information from infected development environments. The attackers deployed two separate payloads as part of the campaign. One payload introduced a new GitHub Actions workflow configured to run on every push and pull request. The second payload replaced existing workflows tied to specific triggers, effectively creating dormant backdoors that could later be activated remotely. The malicious commit associated with the infection was reportedly authored by a user identified as “build-bot” and pushed on May 18. During its investigation into the linked email address, the researchers uncovered 2,878 commits made on the same day. Researchers also identified another 2,841 commits tied to a second email address connected to the operation. Researchers noted that all 5,718 commits tied to the Megalodon campaign landed within the same six-hour timeframe, indicating a highly coordinated and automated attack strategy. The scale and speed of the operation highlighted how threat actors are weaponizing GitHub Actions and software development workflows to distribute malicious code at scale.

Megalodon Malware Targeted CI/CD Secrets and Cloud Credentials

On compromised systems, the malware attempted to exfiltrate a broad range of sensitive data. According to researchers, the stolen information included CI environment variables, AWS credentials, Google Cloud Platform access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configuration files, database connection strings, GitHub Actions tokens, GitLab CI/CD tokens, API keys, and numerous other secrets commonly stored in development pipelines. Another significant concern raised by researchers involved the attackers’ use of the “workflow_dispatch” feature within GitHub Actions. According to researchers, the malicious workflow leveraged this trigger mechanism to establish dormant backdoors that could later be activated through the GitHub API using stolen GitHub tokens. Researchers explained that the “workflow_dispatch” mechanism is exempt from GitHub’s anti-recursion protections, which normally prevent workflows from spawning additional workflow runs through GitHub token-triggered events. This loophole potentially allowed attackers to reactivate compromised workflows even after the initial breach.

Searchers Links Megalodon Campaign to Compromised Open-Source Packages

The researchers discovered the Megalodon campaign after identifying malicious versions of the Tiledesk package, an open-source live chat and chatbot platform. The infected packages were reportedly published between May 19 and May 21, shortly after the malicious commits were introduced into the source repositories. In its analysis, SafeDep stated that the same NPM account, “eljohnny” using the email address giovanni@tiledesk.com, had published both the legitimate version 2.18.5 and the compromised versions of the package. Researchers emphasized that the attacker did not directly compromise the NPM account itself. “The attacker never touched the NPM account. They compromised the GitHub repository, and the maintainer published from the poisoned source without realizing it,” SafeDep explained. The Megalodon incident emerged shortly after NPM announced new security measures aimed at limiting similar supply chain attacks. Last week, NPM invalidated all granular access tokens with write permissions that bypassed two-factor authentication protections. The move was intended to reduce the risk of attacks resembling the earlier Mini Shai-Hulud campaign. However, cybersecurity researchers warned that token protection alone may not fully address the broader issue of repository compromise and malicious code propagation. Security company Ox Security stated that while stricter token controls may reduce account hijacking risks, they do not solve the underlying problem of compromised repositories distributing malicious code through trusted development ecosystems. “If platforms continue allowing any type of code to be uploaded without serious vetting, the number of attacks will only increase,” Ox Security noted. The company also warned that the Megalodon campaign could represent the beginning of a larger wave of attacks targeting developers and open-source ecosystems globally. “We’ve entered a new supply chain attack era, and TeamPCP compromising GitHub was only the beginning. What’s coming next is an endless wave, a tsunami of cyber attacks on developers worldwide,” the firm said.

GitHub Confirms Cyberattack Targeting Thousands of Internal Repositories

21 de Maio de 2026, 03:01

GitHub cyberattack

GitHub confirmed that attackers associated with TeamPCP gained unauthorized access to thousands of the company’s internal code repositories after compromising an employee’s device through a malicious VS Code extension. Despite the scale of the GitHub cyberattack, the Microsoft-owned platform said there is currently no evidence that customer repositories or enterprise data were affected. The cyberattack on GitHub marks the latest operation linked to TeamPCP, a cybercriminal group that has rapidly expanded its activity through coordinated attacks on developer-focused platforms and cloud infrastructure.

Decoding the GitHub Cyberattack

GitHub publicly acknowledged the incident on Wednesday after TeamPCP allegedly advertised stolen source code on a cybercrime forum. According to the company, the attackers attempted to extort the platform by offering the stolen code for sale at $50,000 and threatening to leak it publicly if no buyer emerged. [caption id="attachment_112192" align="alignnone" width="717"] GitHub Cyberattack Details

Image Source: X[/caption] In a statement shared on X, formerly Twitter, GitHub said: “We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.” The company further stated: “If any impact is discovered, we will notify customers via established incident response and notification channels.” GitHub said the breach originated after an employee’s system was infected through a poisoned VS Code extension. The company described the incident as “detected and contained,” emphasizing that the compromise was restricted to internal repositories and did not extend to customer-owned data. As part of its response to the GitHub cyberattack, the company rotated critical credentials on the same day the breach was discovered, prioritizing the most sensitive secrets first. GitHub also acknowledged that TeamPCP’s claim of stealing around 3,800 repositories was “directionally consistent” with the company’s own internal assessment regarding the scope of the intrusion. The platform hosts code for more than 100 million developers globally, making the cyberattack on GitHub particularly significant within the software development and cybersecurity communities. GitHub said it plans to release a more detailed report once the investigation is complete.

TeamPCP’s Growing Role in Cloud-Focused Cybercrime

Cybersecurity researchers at Cyble have identified TeamPCP as a cloud-focused cybercriminal operation that emerged as a large-scale exploitation platform in late 2025. The group is also tracked under several aliases, including DeadCatx3, PCPcat, PersyPCP, and ShellForce. [caption id="" align="alignnone" width="936"] TeamPCP

Image Source: X[/caption] Unlike threat actors that depend heavily on zero-day vulnerabilities, TeamPCP has reportedly built its operations around automation and the exploitation of known weaknesses and cloud misconfigurations. Researchers say the group combines these methods into a scalable and largely self-propagating attack framework. Beginning in late 2025, TeamPCP launched extensive scanning campaigns targeting exposed Docker APIs, Kubernetes control planes, Ray dashboards, and Redis services. Once access is achieved, compromised systems are integrated into a distributed infrastructure used for proxying internet traffic, performing additional scans, hosting command-and-control infrastructure, deploying ransomware, and conducting unauthorized cryptomining operations.

Operational Structure Behind the Cyberattack on GitHub

The operational model used by TeamPCP differs from many conventional cybercriminal campaigns because it prioritizes cloud-native environments over traditional end-user devices. Instead of relying primarily on phishing campaigns against individual users, the group focuses on exposed administrative services and container orchestration platforms. Researchers observed that TeamPCP attack chains commonly begin with automated internet-wide scanning for externally accessible services that either lack authentication or are improperly secured. This allows the group to scale attacks rapidly across large numbers of organizations without relying on highly customized exploitation techniques. The GitHub cyberattack appears consistent with the group’s broader strategy of targeting software development environments and cloud infrastructure that can provide access to sensitive operational resources.

Countries and Industries Impacted by TeamPCP

Security researchers said TeamPCP activity has been observed across multiple countries, including the United Arab Emirates, Canada, South Korea, Serbia, the United States, and Vietnam. Researchers noted that the group’s targeting pattern appears opportunistic rather than politically motivated, with attacks primarily focused on exposed infrastructure. Industries affected by TeamPCP operations include Banking, Financial Services, and Insurance (BFSI), consumer goods, and professional services organizations. These sectors often depend heavily on scalable cloud-based systems and internet-facing services, making them vulnerable to automated scanning campaigns, cloud misconfiguration abuse, ransomware deployment, and cryptomining activities.

eBay Struggles with Widespread Outage, Disrupting Transactions and API Access

27 de Abril de 2026, 07:04

eBay Outage

The e-commerce platform eBay, a giant in online auctions and fixed-price listings, faced widespread disruptions beginning late Sunday, April 26, 2026, extending into Monday, as users across the globe reported severe technical issues. The eBay outage, which has crippled essential features of the site, particularly the API, has left many buyers and sellers frustrated, struggling to access critical functions, including search features, listings, and checkout processes. As users faced slow page loads, failed transactions, and difficulty completing sales, a series of unverified reports surfaced suggesting that the hacktivist group 313 Team was behind the massive denial-of-service (DDoS) attack, claiming responsibility for the outage. While the true cause remains unconfirmed by eBay, the timing and scale of the disruption have fueled speculation that a cyberattack was involved.

The Scope of the eBay Outage

The eBay outage first began to affect eBay users on the afternoon of April 26, when they began reporting issues with the platform’s functionality. According to Downdetector, a popular service that tracks online outages, the spike in complaints reached around 3:30 PM ET, with the situation worsening the evening. As of 10:30 PM ET, more than 1,300 outage reports were logged, although the number eventually decreased to about 600 by 11:50 PM ET. Users complained that essential functions like search were malfunctioning, and pages were loading extremely slowly. "I can't even search for anything or complete a purchase," one frustrated user posted on social media. Others echoed similar concerns, noting that critical transactions were unable to be completed, with error messages preventing them from checking out. Sellers also voiced their frustrations, noting that they could not access the API, which is crucial for the functioning of third-party tools used to manage listings, inventory, and sales. "It’s been nearly 6 hours since the API went down, and we have no word from support," one seller wrote, emphasizing the financial impact of the outage.

Social Media Users Complain About the Outage

While eBay has not officially confirmed the cause of the outage, rumors quickly began circulating on social media that the hacktivist group 313 Team was responsible for a DDoS attack targeting the platform. DDoS attacks, which flood a website with traffic to overwhelm its servers and take it offline, have become a frequent tactic for hacktivist groups in recent years. The group, which has previously targeted high-profile organizations, allegedly posted a claim on various forums, taking credit for the disruption. However, this attribution has not been independently verified, and eBay has not provided details about the nature of the attack. The company’s official status page displayed no alerts of a cyberattack, showing only minor updates on the system’s functionality. Despite these official updates, the community’s response has been vocal, with many users continuing to report issues well into the night. One individual posted, "It’s not just down for me, it’s down for everyone. Is this part of a bigger attack targeting e-commerce sites?" With eBay’s customer support channels largely silent or offering only generic responses, users took to social media to express their frustration. The company’s Instagram account, where many users had previously reached out for help, quickly became a forum for complaints. One commenter wrote, “Brooo you’re down—come on, get up! I need to pay for an auction.” Others left similar messages, questioning the reliability of the platform and demanding answers.

The Cyber Express Weekly Roundup: Data Breaches, Malware Campaigns, and Cyber Fraud Investigations

24 de Abril de 2026, 08:57

weekly roundup TCE cybersecurity news

In this week’s edition of The Cyber Express weekly roundup, we explore the latest developments in the world of cybersecurity, focusing on high-profile data breaches, growing malware campaigns, and law enforcement actions against cybercriminals. As the digital threat landscape continues to evolve, attackers are targeting sensitive personal and organizational data, from health records to financial credentials. Meanwhile, government regulators are ramping efforts to protect minors and combat harmful content on social platforms, while cybercriminals continue to exploit vulnerabilities in both public and private sectors. This weekly roundup highlights how various industries, from healthcare and social media to finance and government, are grappling with rising threats, making it clear that the intersection of data security, regulation, and cybercrime is more critical than ever.

The Cyber Express Weekly Roundup

UK Biobank Data Breach Triggers Urgent Review of Data Security Measures

A significant data breach at the UK Biobank has raised major concerns over the security of health-related data used in scientific research. In April 2026, de-identified participant information was discovered being sold on a Chinese consumer platform, sparking widespread alarm among the research community. Read more...

Vercel CEO Reveals Expansion of Malware Campaign Affecting Multiple Targets

Vercel's CEO, Guillermo Rauch, confirmed that the recent breach involving Context.ai was part of a much larger malware campaign affecting multiple targets. Following a review of network logs, Vercel’s security team uncovered evidence of malware distribution that compromised several customer accounts, including access to valuable Vercel account keys. Read more...

Ofcom Investigates Telegram and Teen Platforms

In the UK, Ofcom has launched an investigation into Telegram and several popular teen chat platforms, such as Teen Chat and Chat Avenue, after reports surfaced of online grooming and child sexual abuse material (CSAM) on these services. Under the Online Safety Act, platforms are required to take proactive steps to prevent harmful content and protect minors from exploitation. Read more...

Personal Data Exposed in Breach of France’s ANTS Portal

A recent breach of France’s ANTS (Agence Nationale des Titres Sécurisés) portal has compromised personal data, including names, email addresses, and birthdates, although no documents or sensitive attachments were affected. The breach, which occurred on April 15, 2026, raises significant concerns about identity theft and phishing risks, as the exposed data could be used to target individuals. Read more...

Bluesky Faces Coordinated DDoS Attack

Bluesky, the rapidly expanding social media platform, suffered a major disruption on April 15, 2026, when it was targeted by a sophisticated distributed denial-of-service (DDoS) attack. The attack caused widespread outages, impacting core platform functions such as user feeds, notifications, and search capabilities. Read more...

Indian Authorities Arrest Key SIM Card Supplier in Cyber Fraud Crackdown

India’s Central Bureau of Investigation (CBI) has arrested a key conspirator in a major cyber fraud operation as part of Operation Chakra-V. The suspect, arrested in Guwahati, is accused of supplying fraudulent SIM cards used in various cybercrime schemes, including extortion and fake loan scams. The SIM cards were acquired using fake identities and distributed to cybercriminal networks. Read more...

Weekly Takeaway

This week’s roundup highlights the diverse and evolving nature of cyber threats. From the exposure of sensitive health data and sophisticated malware campaigns to DDoS attacks and SIM card fraud schemes, the cybersecurity landscape remains fraught with challenges. Regulatory bodies and companies alike continue to grapple with emerging risks, particularly in sectors like public health data, social media platforms, and digital content safety. As these incidents unfold, it’s clear that both technical vulnerabilities and human factors, such as social engineering, continue to be central targets for attackers. With regulatory frameworks like the Online Safety Act and increased investigative efforts in places like India and France, the pressure on platforms and authorities to act quickly and decisively is higher than ever. As the cyber threat landscape becomes more interconnected, the need for enhanced security protocols, improved monitoring, and greater accountability in digital spaces remains critical.

China-Linked Cyber Actors Turn to Massive Covert Botnets to Evade Detection

24 de Abril de 2026, 05:02

China-Nexus

A newly issued cybersecurity advisory highlights an evolution in the tactics, techniques and procedures (TTPs) employed by China-Nexus threat actors. The report, released with support from the UK Cyber League and coordinated by the National Cyber Security Centre (NCSC-UK) alongside international partners, sheds light on how Chinese threat actors are relying on large-scale covert networks of compromised devices to conduct malicious cyber operations.

A Strategic Shift in China-Nexus TTPs

In recent years, cybersecurity experts have observed a clear transition in China-Nexus TTPs. Rather than relying on dedicated, individually controlled infrastructure, Chinese threat actors are now leveraging expansive networks of compromised devices, commonly referred to as covert networks or botnets. These networks are primarily composed of Small Office/Home Office (SOHO) routers, Internet of Things (IoT) devices, and other internet-connected hardware. According to the advisory, the majority of China-Nexus actors are believed to be using such covert networks, with multiple networks operating simultaneously and often shared among different groups. These networks are continuously updated, making them highly adaptable and difficult to track. Any organization targeted by Chinese threat actors could be affected. For example, the group known as Volt Typhoon has used these covert networks to pre-position cyber capabilities within critical infrastructure, while Flax Typhoon leveraged similar methods for espionage operations.

How Covert Networks Operate

Although botnets are not new, China-Nexus actors are now deploying them at an unprecedented scale and with strategic intent. These covert networks allow attackers to mask their identity, route malicious traffic through multiple nodes, and reduce the risk of attribution. Typically, an attacker accesses the network via an entry point, or “on-ramp,” and routes activity through numerous compromised devices—called traversal nodes—before exiting near the target. This multi-hop approach obscures the origin of the attack. These networks support every stage of a cyber operation, from reconnaissance and scanning to malware delivery, command-and-control communication, and data exfiltration. They are also used for general browsing, enabling threat actors to research vulnerabilities and refine TTPs without revealing their identity. The presence of legitimate users on some networks further complicates attribution.

Real-World Examples and Scale

Evidence suggests that some covert networks used by China-Nexus actors are developed and maintained by Chinese cybersecurity firms. One notable example is the “Raptor Train” network, which infected over 200,000 devices globally in 2024. It was reportedly managed by Integrity Technology Group, a company also linked by the FBI to activities associated with Flax Typhoon. Another example includes the KV Botnet used by Volt Typhoon, which primarily exploited outdated Cisco and NetGear routers. These devices were particularly vulnerable because they had reached “end-of-life” status, meaning they no longer received security updates. The scale and adaptability of these networks present a major challenge. As Paul Chichester, NCSC Director of Operations, stated: “Botnet operations represent a significant hreat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyberattacks.”

Challenges for Network Defenders

Cybersecurity researchers have long been aware of such threats, but the evolving nature of China-Nexus TTPs introduces new difficulties. A key issue identified by Mandiant Intelligence in May 2024 is “indicator of compromise (IOC) extinction.” Traditional defenses, such as static IP blocklists, are becoming less effective because attackers can operate from vast, constantly changing pools of devices. As compromised nodes are patched or removed, new ones are quickly added, making these networks highly dynamic. This fluidity undermines conventional detection and mitigation strategies.

Defensive Measures and Best Practices

The advisory outlines several steps organizations can take to defend against China-Nexus covert networks:

For all organizations:

Maintain a clear inventory of network edge devices.

Establish baselines for normal network activity, particularly VPN access.

Monitor for unusual connections, including those from consumer broadband ranges.

Use dynamic threat intelligence feeds.

Implement multi-factor authentication for remote access.

For higher-risk organizations:

Use IP allow lists instead of blocklists for VPN access.

Apply geographic and behavioral profiling of incoming connections.

Adopt zero-trust security models.

Enforce SSL machine certificates.

Reduce exposure of internet-facing systems.

Explore machine learning tools to detect anomalies.

For the most at-risk entities:

Treat China-Nexus covert networks as advanced persistent threats (APTs).

Conduct active threat hunting for suspicious IP activity.

Map and monitor known covert networks using threat intelligence.

Hacker Active Well Beyond Context.ai Compromise, Says Vercel CEO

23 de Abril de 2026, 05:35

Vercel, Vercel Breach, APIs, npm Packages

Vercel CEO Guillermo Rauch, in an update today said that after scanning through petabytes of logs of the company's networks and APIs, his security team concluded that the threat actor behind the Vercel breach had been active well beyond Context.ai's compromise. Rauch said that the "threat intel points to the distribution of malware to computers in search of valuable tokens like keys to Vercel accounts and other providers. Once the attacker gets ahold of those keys, our logs show a repeated pattern: rapid and comprehensive API usage, with a focus on enumeration of non-sensitive environment variables." Researchers at Hudson Rock had earlier confirmed that the attack actually initiated in February itself when a Context.ai employee’s computer was infected with Lumma Stealer malware after they searched for Roblox game exploits, a common vector for infostealer deployments. What the latest findings mean is that there could be a wider net of victims that the threat actor may have phished for and what we know is just the tip of the iceberg - or not.

Also read: Vercel Incident Linked to AI Tool Hack, Internal Access Gained

Vercel Finds Customers Breached in Separate Malware, Social Engineering Attacks

In an official update, the company also stated that initially it identified a limited subset of customers whose non-sensitive environment variables stored on Vercel were compromised. However, a deeper assessment of the their network, as well as environment variable read events in the company's logs uncovered two additional findings.

"First, we have identified a small number of additional accounts that were compromised as part of this incident," the company noted.

But the main concern is the next finding: "Second, we have uncovered a small number of customer accounts with evidence of prior compromise that is independent of and predates this incident, potentially as a result of social engineering, malware, or other methods."

The company did not disclose who were the attackers, what was the motive, or the impact on customers, and is yet to respond to these queries from The Cyber Express. It only stated: "In both cases, we have notified the affected customers."

Meanwhile, Rauch said, Vercel had notified other suspected victims and encouraged them to rotate credentials and adopt best practices.

No Compromise of npm Packages

The news of npm packages being compromised has surfaced a lot in recent times. To cover that front, Vercel's security team in collaboration with GitHub, Microsoft, npm, and Socket, confirmed that no npm packages published by Vercel had been compromised. "There is no evidence of tampering, and we believe the supply chain remains safe," the company said.

March 2026 Cyber Threat Landscape Fueled by Ransomware, Breaches, and Access Markets