Weekly threat bulletin: 5 to 12 October 2026, North America drives the rise as three new groups emerge
Ransomware groups published 239 victims worldwide between 5 and 12 October, barely changed from the 237 of the previous week, but with a marked shift towards North America. The week was defined by The Gentlemen's continued lead, the surge of Nightspire (24 claims) and N0n (18) after a week with no records, the arrival of the emerging group Umbra (10) and several press-confirmed cases in manufacturing, technology and legal services.
The week in numbers
Between 5 and 12 October 2026, ransomware and extortion groups claimed 239 organisations on their leak sites, compared with 237 the previous week: a stable global volume. Victims were spread across 40 different countries.
One caveat applies to the whole bulletin: these figures reflect only what the groups themselves choose to publish. Many organisations negotiate and pay without ever appearing on such listings, so the real number of incidents is higher than the recorded one.
Most active groups
The Gentlemen led the table again with 43 claimed victims (35 the previous week), consolidating the growth it has shown throughout 2026. Nightspire followed with 24 and Qilin with 23 (14 a week earlier).
The most striking development was the simultaneous appearance of several operations with no recorded activity the previous week: Nightspire, N0n (18), Umbra (10) and Byod (8). Safepay (12) and INC Ransom (10) kept exactly the same pace as seven days earlier.
Our analysis identifies three emerging brands with no documented history in public threat intelligence databases: Vypr, whose first post dates from 27 September; Byod, which debuted on 5 October; and Umbra, which published for the first time on 6 October. There is no evidence that any of them is a rebrand of a known group.
Most affected regions and countries
North America accounted for 91 claims (66 the previous week), followed by Europe with 38 (37), Asia-Pacific with 20 (27), Latin America and the Caribbean with 12 (18), the Middle East with 7 (1) and Africa with 6 (4). The modest global increase is explained almost entirely by the North American jump.
By country, the United States was the most affected with 82 victims (62 a week earlier). Canada and Germany followed with 9 each, France with 7, and Switzerland, Egypt, Australia, India, Brazil, Spain, Taiwan and Italy registered around four claims each. Egypt went from zero to four, in line with the rebound across the Middle East and North Africa.
Most affected sectors
Technology topped the week with 27 victims, ahead of manufacturing (24), professional services (23), construction (19), education (17) and healthcare (16). The profile matches that of the dominant groups: Qilin is particularly active in professional services, manufacturing and construction, while The Gentlemen and Nightspire concentrate on industry and technology.
The steady presence of education and healthcare deserves attention: both operate heterogeneous infrastructures, rely heavily on remote access and have little room to pause operations during a recovery.
Notable cases
Several incidents were covered by the media this week. US manufacturer H&L Manufacturing was attacked by Interlock; Germany's T-Systems received an ultimatum from Safepay, as reported by the German press; the law firms Nelson Mullins Riley & Scarborough and Sheppard, Mullin, Richter & Hampton were claimed by Leakeddata in the context of class actions over data breaches; the accountancy firm B-accountants was claimed by Everest; and Corby Rock Mill suffered a production disruption attributed to Qilin, according to the trade outlet that reported it.
Among better-known organisations, Black X claimed an attack on German pharmaceutical company Bayer and The Gentlemen one on Deloitte, both confirmed. Still unverified are the claims by The Gentlemen regarding KFC, by Leakeddata regarding Baker McKenzie, by Termite regarding Aon, by Byod regarding T-Mobile and by Redact regarding DexCom: these are assertions made by the groups themselves, not established facts.
What to do this week
The following measures derive directly from how the three most active groups operate. They share the same way in: the exposed perimeter and credentials without a second factor.
- Review and patch your perimeter devices. The Gentlemen, Nightspire and Qilin exploit known flaws in Fortinet FortiOS/FortiGate (including CVE-2024-55591), Cisco edge equipment via Erlang/OTP SSH (CVE-2025-32433), Check Point Security Gateway (CVE-2026-50751) and WatchGuard Firebox (CVE-2025-14733).
- Enforce resistant multi-factor authentication on VPN, RDP, webmail and Microsoft 365, and close or IP-restrict exposed management interfaces: RDP brute forcing and credentials bought from access brokers remain a routine entry point.
- Inventory and block unauthorised remote access software (AnyDesk, ScreenConnect, Splashtop, Atera, MeshAgent, Chrome Remote Desktop) using allow-lists; these groups abuse legitimate tools to persist without raising alarms.
- Harden Active Directory: strict user account and privileged account management, patching of older flaws still being exploited (Zerologon, MS17-010) and mitigation of NTLM relay (CVE-2025-33073). Watch for the use of Impacket, PsExec, NetExec or network scanners.
- Enable execution prevention and behaviour-based endpoint rules, including protection against vulnerable drivers (BYOVD): both GentleKiller and the utilities used by Qilin aim to disable EDR before encryption.
- Protect backups and the virtualisation estate: immutable and offline copies, separate credentials for Veeam and ESXi, and alerts on bulk transfers via Rclone, Restic, MEGAsync or FileZilla, which precede encryption in most of these attacks.
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.