Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
121 articles
Settra ransomware targeted a consumer services and retail organization and a manufacturing firm in 2026, encrypting files and disabling recovery. Attackers gained access via compromised VPN credentials and used RMM tools for persistence.
Japanese small- and medium-sized enterprises faced a surge in ransomware incidents in early 2026, attributed to The Gentlemen and Qilin groups. Attackers leveraged double-extortion and AI-driven tactics to compromise sensitive data and disrupt operations.
CARIDRO VAL DE LOIRE, a French agriculture and food production company, suffered a ransomware attack by Qilin. The incident disrupted system availability and business operations, with potential data encryption.
Cerámicas Kantu S.A.C., a Peruvian ceramic tile manufacturer, was targeted in a ransomware attack attributed to the Panzer group. The incident may have caused operational disruption and data compromise, though the company has not confirmed the breach.
Watchops.com, a US-based technology company, suffered a ransomware attack attributed to the threat actor unsafe, resulting in operational disruption and $1.3 million in claimed losses.
BOK Financial was targeted by the ShinyHunters group in a high-severity ransomware attack, with threats of data leakage and operational disruption. The attackers issued a final payment demand, warning of consequences if unmet.
Gigabud banking trojan leverages hidden work profiles on Android devices to run cloned banking apps, enabling undetected fraudulent transactions. Victims face credential theft and financial loss due to sophisticated evasion of standard malware detection.
Mogren, Glessner & Ahrens, P.S., a US-based family law firm, was targeted by the Pear ransomware group. The attack may have disrupted legal operations, though the firm has not confirmed the breach.
Meridian Logistics Group suffered a ransomware attack by thegentlemen, resulting in the exfiltration of ERP exports, dispatch database, and payroll archives. Sensitive corporate and employee data is pending inventory before potential publication.
Ernst & Young suffered a ransomware attack in July 2026, resulting in the exposure of sensitive client information and tax records. The ShinyHunters group claimed responsibility, while Fairlife, a Coca-Cola subsidiary, was also impacted by a separate Anubis group attack.
Integrated Health Systems in the US suffered a ransomware attack attributed to coinbasecartel, resulting in operational disruption and potential data compromise. The incident was publicly claimed by the threat actor, though not officially confirmed by the organization.
PavinLoader was leveraged in ransomware campaigns targeting global organizations, enabling the deployment of Amatera Stealer and other payloads. Attackers used obfuscated .NET DLLs and legitimate Windows tools to evade detection.