Forty-three percent. That is ransomware’s share of every attack incident we tracked at DefendEdge this past week — 457 ransomware events out of 1,068 total, spread across government portals, hospital networks, wealth managers, city infrastructure, and schools on four continents. For a single technique to account for nearly half of all observed activity in a seven-day window tells you something: the ransomware economy is not cooling off heading into the final quarter of 2026. It is running hot, it is industrialized, and this week it even picked up an AI-powered side hustle.
The Week in Numbers
Our analysts reviewed 1,068 tracked attack events from the past seven days, drawn from our monitoring of ransomware leak sites, security research feeds, and incident reporting. The breakdown is stark. Beyond the 457 ransomware incidents, command injection attacks accounted for another 103 events, malware campaigns for 75, and zero-day exploitation for 50 — meaning one in twenty incidents this week involved a vulnerability with no vendor patch available at the time of the attack. Data breaches (24), phishing (22), and supply chain intrusions (21) round out the list. The United States absorbed 101 victim-side events, more than the next four countries combined, with Italy (20), France (17), Australia (11), and Germany (10) following.
Who Is Getting Hit — and How It Plays Out in the Real World
Government entities were the most-targeted sector this week with 84 tracked incidents, followed by financial services (65), manufacturing (43), and healthcare (42). Agriculture (36), retail (29), and media organizations (28) were not far behind. These are not abstractions. This week alone, the ransomware trail led to some sobering doorsteps:
- Healthcare: The Fe del Mundo Children’s hospital system in the Philippines — an institution founded in 1957 by pioneering pediatrician Dr. Fe del Mundo — appeared on a leak site alongside Colombia’s Coosalud EPS, one of that country’s largest subsidized healthcare providers. When ransomware crews target children’s hospitals and public health insurers, the “we’re too small or too ethical to be a target” assumption dies on contact.
- Finance: LFG Holding, a partner-owned wealth management group, was listed by ransomware operators — a reminder that client portfolios, identity documents, and transaction histories make financial firms a premium target for data extortion.
- Government: The official city portal of Šumperk, Czech Republic — the primary digital services gateway for residents and businesses — was hit, echoing a growing pattern of municipal and local government victimization across Europe.
- Hospitality and education: A Holiday Inn property in Vilnius operating under the IHG brand, and St James’ Anglican School in Western Australia, both appeared on leak sites this week, underscoring that franchise operations and K-12 schools remain firmly inside the blast radius.
The Crews Behind the Surge
Volume was not evenly distributed. Our threat intelligence correlated this week’s activity against our extensive database of verified threat actors, and a handful of crews are doing most of the damage. The Akira ransomware operation more than doubled its weekly posting cadence, jumping from 15 claimed victims last week to 36 this week — a 140% increase — with financial services firms alone accounting for nine of its claims. ShinyHunters surged 178% week-over-week, resurfacing with a mix of ransomware postings, undisclosed breaches, and even zero-day exploit claims. Inc Ransom continued its steady healthcare and energy-sector campaign, while UNKK, a crew with no activity in the prior week, appeared out of nowhere with 66 tracked incidents — 38 of them ransomware claims.
That last data point deserves attention. Ransomware groups routinely fragment, rebrand, and spin up new identities to shake tracking efforts. When a previously quiet or unknown crew suddenly produces dozens of victims in seven days, it usually means one of two things: an established operation has rotated its brand, or a genuinely new affiliate program has come online with leaked tooling. Either way, the practical consequence for defenders is the same — the threat surface of “who might hit us” is wider than last quarter’s watchlist suggests.
The AI Wrinkle: Botnets Are Now Deploying AI Agents on Your Infrastructure
The most consequential disclosure this week had nothing to do with a leak site. Researchers detailed a new botnet, dubbed Carbonato, that compromises exposed Docker daemons and then does something we have not seen at scale before: it installs an open-source AI agent framework on the compromised host, configured to accept instructions over Telegram. The implant overwrites the agent’s own configuration files, effectively weaponizing a legitimate automation tool as a persistent, conversational backdoor. The attacker does not need to hand-craft follow-up payloads — they simply chat with the AI agent living inside your container infrastructure and direct it to act.
This is the logical endpoint of two trends colliding: exposed container orchestration surfaces that organizations still fail to lock down, and off-the-shelf AI agent frameworks that turn a single foothold into an interactive, scriptable operations channel. It also landed the same week as a report warning that a quarter of organizations hit by deepfake-enabled attacks have lost more than $1 million — and a disclosure of TrustSink, an identity attack that inserts a convincing password prompt inside a legitimate Microsoft Entra sign-in flow. The common thread across all three: attackers are increasingly abusing trust and legitimate tooling rather than breaking cryptography. Your perimeter is not where you think it is.
What BlackBeam Is Seeing
Correlating this week’s incident feed against our own Internet Intelligence Platform produced one standout signal. BlackBeam tracked 529 attacks tied to the actor cluster ACEH this week — a 77.5% surge over the prior week’s 298 — with the activity heavily concentrated against government, manufacturing, and transportation targets. Of those, 112 were ransomware claims in the seven-day window, making ACEH one of the single most active crews we are currently monitoring. Our platform holds 18 tracked indicators of compromise attributed to this cluster, the majority of them domains, and we are watching the wildcard-domain landscape for lookalike registrations that could extend their phishing and payload distribution infrastructure.
That last part matters. Across the full platform, BlackBeam correlated more than 103,000 wildcard-domain and IOC matches in the last seven days alone — automated lookalike and infrastructure detections running against our threat intel inventory. High-volume actor surges like ACEH’s are precisely when lookalike-domain campaigns spike, because extortion crews need fresh delivery infrastructure as victim notifications go out. If your organization operates in government, manufacturing, or transportation, treat any unsolicited domain or vendor communication referencing a recent breach headline with elevated suspicion this week.
Practical Steps Before the Next Wave
Ransomware resilience is less about exotic tooling and more about boring fundamentals executed relentlessly. Six actions from our US-based Security Operations Center that blunt the majority of crews currently posting victims:
1. Close your exposed container and orchestration surfaces. The Carbonato botnet does not need a zero-day — it needs an exposed Docker daemon. Audit every internet-reachable management port (Docker API, Kubernetes dashboards, Redis, database consoles), bind them to localhost or a management network, and enforce mutual TLS where remote management is genuinely required.
2. Treat identity as the new perimeter. TrustSink demonstrates that attackers now plant credential prompts inside legitimate sign-in flows. Enforce phishing-resistant MFA (FIDO2 passkeys or certificates) for all privileged accounts, disable legacy authentication protocols, and require step-up verification for any MFA re-registration — the moment an attacker registers their own authenticator is the moment you lose.
3. Operate with a zero-day mindset. Fifty of this week’s incidents involved zero-day exploitation — vulnerabilities with no patch when the attack occurred. Assume unknown flaws are in play: segment internal networks so an edge-device foothold cannot pivot to domain controllers, and prioritize virtual patching (WAF rules, IPS signatures) for CVEs under active exploitation on your exposed stack.
4. Rehearse your ransomware playbook before you need it. The victim list this week included hospitals, schools, and city governments — organizations that cannot tolerate multi-day outages. Verify offline, immutable backups weekly, document the decision tree for extortion demands in advance, and run tabletop exercises that include legal, communications, and executive leadership, not just IT.
5. Monitor your external attack surface like an attacker would. Wildcard and lookalike domain registrations surge when extortion crews launch follow-on phishing. Continuous external attack surface monitoring — new subdomains, lookalike registrations, expiring certificates — gives you hours or days of warning instead of learning about infrastructure aimed at your users from a victimized customer.
6. Hunt for the reconnaissance artifacts, not just the malware. The crews surging this week post victims publicly, but the intrusion that precedes a leak-site posting involves credential harvesting, network scanning tools, and staging activity that is visible in logs. Flag scanner utilities appearing on workstations, anomalous VPN logins, and large-volume egress from document repositories — the week before ransomware deploys is your last, best chance.
The Bottom Line
A 43% weekly ransomware share, doubled posting cadence from crews like Akira, a brand-new actor cluster producing 66 incidents in seven days, and botnets now installing AI agents on compromised hosts — this week’s data describes an adversary ecosystem that is more automated, more industrialized, and more willing to abuse legitimate tooling than at any point we have tracked. The organizations that weather this environment are the ones treating threat intelligence not as a news feed, but as operational radar.
If you want to see how these actor-level correlations work in practice — the surge detection, the tracked IOC infrastructure, the wildcard-domain monitoring mentioned above — see the correlations yourself in BlackBeam, our Internet Intelligence Platform. BlackBeam is powered by iDNA, our threat intelligence engine, which continuously fuses incident reporting, actor attribution, and infrastructure monitoring into a single operational picture.
And if you would rather have a US-based Security Operations Center watching your environment around the clock — staffed entirely by US citizens, with the ransomware playbooks already rehearsed — contact DefendEdge today for a consultation. The crews posted 457 victims this week. Make sure your organization is not on next week’s list.
Leave a Reply