As cited
Copy frozen at (site build).
ransomware
Ransomware and Cyber Extortion in Q3 2026
ReliaQuest's threat research team analyzed ransomware leak-site activity in Q3 2026 and found that 93% of the 30% growth in victim listings came from 43 newly observed groups with no prior history, making victim counts an unreliable measure of actual attacks. New groups showed inconsistent posting patterns mixing suspected rebrands, recycled data, and unsubstantiated claims, exemplified by ExfilSquad, which appears to scrape exposed credentials rather than conduct true network breaches. Most growth occurred outside the US (85% of new victims), and sector rankings shifted due to activity by a few established groups rather than representing lasting trends.
Why it matters: Security teams should stop relying on leak-site rankings and group names to assess ransomware risk, and instead build detections around shared attacker techniques like remote service abuse, identity compromise, lateral movement, and data exfiltration. Organizations named on new leak sites must verify claims against their own logs and telemetry before responding, as false claims waste resources and true claims dismissed leave data exposed to phishing and account takeover. Teams with global operations need regional threat intelligence beyond US-focused data, and should harden against techniques used by active groups in their sectors and countries rather than assuming lower rankings mean lower risk.
- Source published
- First seen by Cybersecurity Tracker