Cyber Threat Intelligence

Story of the Month: Ransomware on the Dark Web (Sep 2026)

2026.11.11

✅ Report Title: Story of the Month: Ransomware on the Dark Web (Sep 2026)

During the month of September 2026 (2026-09-01 00:00:00 ~ 2026-09-30 23:59:59 UTC), 869 companies were affected by ransomware attacks, with their infection details posted on leak sites operated by ransomware gangs.
During the month of September, 26 newly discovered or address-changed leak sites were identified.
There were 83 ransomware attack gangs active during the month of September.
The total number of affected organizations decreased by 256 compared to the previous month.

The total number of affected organizations in September was 869, with the TOP 5 ransomware gangs accounting for approximately 33% of the total impact.
Top 5 Ransomware Gangs: The Gentlemen 105 (12.08%), Qilin 71 (8.17%), Settra 41 (4.72%), Inc 37 (4.26%), AKIRA 36 (4.14%)

When affected organizations were categorized by country (based on HQ), the TOP 5 countries accounted for approximately 53% of the total impact.
- United States(348) > Canada(30) > Germany(28) > India(26) > Brazil(25)
When affected organizations were categorized by industry, the TOP 5 industries accounted for approximately 47% of the total impact.
- Business Services(104) > Healthcare(102) > Manufacturing(85) > Technology(62) > Finance(56)

The total number of affected organizations decreased by 256 compared to the previous month. However, the increase/decrease patterns vary by ransomware gang.
- Top 5 ransomware by increase in attack volume: Settra(+35), Safepay(+20), n0n(+18), VEXY(+18), Metaencryptor(+15)
- Top 5 ransomware by decrease in attack volume: Qilin(-94), TA505(-66), OROVA(-29), Coinbase Cartel(-24), Dire Wolf(-24)

Date	Campaign	TA & Malware	Category	Issue
2026-09-30	KillSec DLS Seized	Killsec	Arrest & Seized & Sanctioned	International Joint Investigation into KillSec, Believed to Be Led by a 16-Year-Old, Results in Arrest of Three Suspects and Seizure of Servers and Leak Site.
2026-09-26	Ukrainian ransomware developer jailed for nearly 13 years	Volodymyr Tymoshchuk	Arrest & Seized & Sanctioned	A Ukrainian developer who created the LockerGoga, MegaCortex, and Nefilim ransomware strains, causing damage to companies worldwide, was sentenced by a Swiss court to 12 years and 9 months in prison and a 10-year entry ban.
2026-09-23	Sale of Chaos, LockBit, SquadLocker, Babuk, and Yashma Ransomware Builders	Chaos, LockBit, SquadLocker, Babuk, Yashma	DDW & Telegram	Multiple ransomware builder sales posts were uploaded on BreachForums, soliciting Bitcoin payments.
2026-09-19	Ransomware Gang Warfare: ShinyHunters Breaches Clop's Infrastructure in Escalating Cyber Feud	CLOP, ShinyHunters	Leaked & Exposed	ShinyHunters exploited a Grav CMS vulnerability to compromise and deface Clop's dark web data leak site, stealing Tor private keys and server data and, in turn, attempting to extort Clop.
2026-09-14	RDP-Based Beast (GodDamn) Ransomware Attack Targeting South Korean Medical Institutions	Beast	Profile (TA & Single Actor)	Sharing of a Case in Which Beast (GodDamn) Ransomware Was Distributed to a South Korean Medical Institution by Exploiting RDP.

There are ransomware gangs that upload the same victim companies, and this phenomenon is presumed to occur because IAB providing the initial intrusion vector collaborates with multiple ransomware gangs or tends to prioritize companies whose victimization has already been disclosed.
Among the victim cases confirmed in September, 26 companies were identified with duplicated disclosures of their victimization.

🧑‍💻 Author: S2W TALON