In late September 2026, SOCRadar found an exposed C2 server laying bare the AI-driven intrusion ecosystem of INC Ransomware and The Gentlemen affiliates: 8,257 agent messages, 62 named organizations, and the source code of an autonomous kill-chain framework called Phantom. For defenders, the lesson is not “AI attacks” — it is that AI session logs are now exploitable forensic evidence.
On October 20, 2026, Unit 42 confirmed that the Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) ransomware groups are still exploiting CVE-2026-0257, the GlobalProtect authentication bypass that has been patched since May. If you run an exposed PAN-OS gateway, check your version and disable authentication override now.
Between October 6 and 7, 2026, the ransomware group The Gentlemen published 34 victims in barely 21 hours — 20 of them in 80 minutes — and listed Deloitte two days later. That cadence is the signature of an automated exfiltration pipeline: security teams must now respond in hours, not days.
On October 7, 2026, ransomware hit IDCF Cloud, the infrastructure of SoftBank subsidiary IDC Frontier, causing a regional outage that cut 495 companies and local governments off from their data. The attacker claims 3.6 PB encrypted and 16,000 VM disks sealed — a reminder that your cloud provider is a single point of failure.
A year after the ToolShell SharePoint zero-days, the China-linked Warlock group — tracked as Longlegs by Symantec — hit a water utility, a telecom operator, a regional government, and a university, disabling protection on 40 machines in two hours. Patch your on-prem SharePoint, monitor BYOVD driver loads, and hunt the indicators published by Symantec and Carbon Black.
On 10 September 2026, CISA updated the KEV entry for CVE-2025-14733 to confirm ransomware gangs are exploiting this unauthenticated RCE in the Firebox IKEv2 handler, 265 days after its first listing. Update Fireware OS and, if compromised, rotate every secret stored locally.
On September 25, 2026, BleepingComputer confirmed that the ShinyHunters gang compromised the Clop ransomware leak site by exploiting CVE-2026-42608, an unauthenticated path traversal in Grav fixed in April but never backported to the 1.7 branch. If you still run Grav 1.7, upgrade to 1.7.53.4 without delay.
CISA updated its KEV entry on September 10, 2026 to confirm that CVE-2025-14733, an unauthenticated RCE in the WatchGuard Firebox iked process patched back in December 2025, is now used in ransomware attacks. With nearly 9,000 Fireboxes still exposed online, check your Fireware OS version and hunt for the indicators of compromise before the encryption starts.
On August 29, 2026, LockBit 5.0 listed the healthcare administrator American Plan Administrators on its leak site, three weeks after targeting US Bank with a September 3 deadline. A claim is not a confirmed breach, but it is already real pressure: here is how to handle it.
A path-traversal flaw in VMware vCenter, rated CVSS 9.8, allows unauthenticated code execution and is already being exploited across 47 countries to drop Babuk-derived ransomware. The fix is two moves: patch without waiting for a maintenance window, and cut the management interface off from the rest of the network.
On August 26, 2026, the AiLock ransomware group added Hamilton Company, a US laboratory-robotics specialist, to its leak site, threatening to publish the data unless negotiations begin. The detail that sets AiLock apart: its double extortion threatens to report the breach to regulators and share stolen data with competitors — pressure that changes the victim’s calculus.
On August 18, 2026, the FBI, CISA and HHS updated their joint advisory on the Medusa ransomware: more than 500 critical infrastructure victims since 2021, up from 300 in March 2025. Defenders need to patch the exploited flaws and segment networks before the gang does it for them.
CISA updated its KEV catalog to flag the Windows Task Host privilege-escalation flaw CVE-2025-60710, patched in November 2025, as now being exploited by ransomware gangs. Organizations must treat privilege-escalation patches with the same urgency as RCEs: this is the link that turns limited access into full control.
An Akira ransomware affiliate got initial access through a SonicWall VPN with no MFA, then rebooted the box into Safe Mode to neutralize EDR while exfiltrating. Huntress’s account shows an EDR is no safety net once an attacker holds valid credentials.
An automated ransomware campaign dubbed RedLocker exploits passwordless Redis instances exposed to the internet. By August 4, 2026, 3,200 servers had already been compromised. Close port 6379 or enable Redis authentication now.
Microsoft shipped its largest-ever Patch Tuesday, 24 billion stolen credentials surfaced on an exposed Elasticsearch cluster, and ransomware gangs claimed 721 new victims. Three records, one month — and none of them are a coincidence.
Mediaworks lost 8.5 TB of internal data to a ransomware group. Instructure paid ShinyHunters to keep 3.65 TB of Canvas data off the dark web. Across two weeks in May 2026, a cascade of breaches hit education, manufacturing, media, and retail — and barely anyone noticed. When breaches become background noise, the threat isn’t technical anymore. It’s apathy.
Check Point Research records 698 ransomware attacks worldwide in May 2026, a 48% year-over-year jump, even as overall attack volumes drop 7%. Fewer attacks, more impact — threat actors are getting better at doing more with less.
The group systematically exploited CVE-2024-50623 and CVE-2024-55956 in Cleo MFT products between October and December 2024, affecting over 180 organizations. The October patch failed; a second CVE had to be issued six weeks later.
The SafePay ransomware group exfiltrated 8.5 terabytes of data from BPO giant Conduent between October 2024 and January 2025, exposing over 25 million individuals. It's the costliest supply chain breach of the year for US governments — and a wake-up call for any CISO who depends on a critical third party.
