Image courtesy by QUE.com
Ransomware gangs had their busiest month of the fall in October 2026. Criminal groups named 1,127 organizations on their leak sites during the month, up 25.8% from 896 in September, according to a monthly tally from HackerFeeds based on Ransomware.live data. Three crews, N0n, The Gentlemen and Qilin, accounted for almost four in ten of those claims, and manufacturers were hit more than any other sector.
The pace has not slowed as November begins. By mid-morning on November 1, another 18 organizations had been listed in the previous 24 hours, half of them by Qilin, and the running total for 2026 stood at 9,163 claims, according to Ransomnews.
One caution applies to every number in this story: a leak-site post is a claim made by criminals to pressure a victim into paying. It is not a confirmed breach. Some claims are inflated or recycled, and many victims who quietly pay are never posted at all. Even so, the trend line is the clearest public signal of how hard extortion crews are working.
Three Groups Drove the October Surge
HackerFeeds counted 79 groups that posted at least one victim in October, including seven it had never seen before. But the month was dominated by three names:
- N0n posted 154 victims, up from just 18 in September, making it the most active group of the month.
- The Gentlemen posted 143, up from 107.
- Qilin posted 140, nearly double its 76 in September.
Together they made up 38.8% of all claims. Further down the table, Akira held steady at 35 victims, while Silent Ransom Group rose to 33 and the Booba Project jumped from 8 to 31. The busiest single day was October 26, with 73 new names posted.
N0n’s sudden rise deserves a closer look. According to an analysis by Cyfenced, much of its count came in one burst: on October 12 the group posted 38 port, terminal, shipping and logistics companies across 18 countries within 23 minutes, all with the same payment deadline. Maritime security firm Cydome assessed that the data likely came from CyberLogitec, a Korean maker of port and shipping software, and other analysts suggested it may be a single support archive rather than 38 separate break-ins. In other words, one supplier compromise may have produced dozens of “victims” overnight. Que.com recently reported on an exposed N0n workspace showing the operator leaning on AI tools while still relying on stolen passwords to get in.
Manufacturers and U.S. Companies Took the Most Hits
By sector, manufacturing led with 162 claimed victims, or 14.4% of the month’s total, followed by professional services (129), technology (119) and healthcare (114), HackerFeeds reported. Transportation saw 76 claims, a figure Cyfenced linked largely to N0n’s single batch of logistics firms.
Geographically, organizations in the United States accounted for 379 victims, about a third of the total, far ahead of Germany (52) and the United Kingdom (36). Nearly 16% of listings gave no location at all.
Professional-services firms were a recurring target late in the month. Threat-tracking site Rosetta Intel noted that the Genesis group posted nine accounting, engineering and consulting firms within hours on October 31, while Silent Ransom Group kept adding U.S. law firms to its list.
How the Attackers Are Getting In
The break-in methods behind October’s wave are not exotic. Cyfenced cited updates from Palo Alto Networks’ Unit 42 saying Qilin and INC Ransom have been exploiting CVE-2026-0257, a flaw in GlobalProtect VPN gateways that, in certain configurations, lets an attacker open a VPN session without logging in, sidestepping multi-factor authentication. Palo Alto patched it in May and it sits on CISA’s list of known exploited vulnerabilities, yet unpatched gateways are still being found. The Settra group has been tied to the same flaw.
Stolen credentials are the other common thread. Several recent Qilin claims tracked by QPulse were paired with exposure reports showing employee passwords harvested by infostealer malware, often for Microsoft 365 accounts.
The aftermath can drag on for months. In one confirmed case summarized by Cyware, medical equipment maker Pedigo Products said attackers entered its network in July and launched the attack on September 15. The Interlock gang later claimed to have stolen 1.3 terabytes of data, ranging from contracts and CAD files to payroll records and Social Security numbers, and the company is now offering affected people 24 months of identity monitoring.
Why It Matters for Business Leaders
Three lessons stand out for executives, especially at mid-sized firms that make up most leak-site listings.
Your suppliers are part of your attack surface. If the CyberLogitec assessment holds, a single software vendor’s data may have put dozens of port and shipping companies on an extortion list at once. Companies should know which vendors hold their data, what access those vendors have, and how quickly they would be told about a breach.
Old, patched flaws are still the front door. A VPN bug fixed in May is still letting crews in this fall. Remote-access gear such as VPNs and firewalls should be patched first and checked for signs of past compromise, because a patch applied after an intrusion does not evict an attacker who is already inside.
Plan for extortion, not just encryption. Many groups now steal data and threaten to leak it whether or not files are locked. Backups help with recovery, as they did for a Nepal brokerage data center hit in September, but they do nothing about leaked customer or employee records. Incident plans need legal, communications and customer-notification steps ready before a crew posts the company’s name.
Manufacturers in particular should take note. They topped the sector list because downtime on a production line is expensive, which gives attackers leverage at the negotiating table.
The Bottom Line
October’s 1,127 leak-site claims show ransomware is accelerating into the end of 2026, powered by a handful of prolific crews, supply-chain shortcuts and unpatched remote-access systems. The numbers are criminal claims, not verified breaches, but the direction is hard to ignore. Companies that patch their edge devices, lock down credentials with phishing-resistant MFA and vet their suppliers’ security will be far harder targets when November’s list starts filling up.
Keep Your Business Running When Systems Go Down
When a cyberattack knocks out your phones or staff are tied up in recovery, customers still need someone to answer. MAJ.COM Voice AI gives you 24/7 AI voice agents that answer every inbound call and handle outbound sales and customer support, so your business never misses a lead.
Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous
Articles published by QUE.COM Intelligence via Yehey.com website.
0 Comments