Executive Summary
Between October 11, 2026 and October 18, 2026, the CTI.FYI intelligence pipeline intercepted a total of 243 ransomware victim disclosures across monitored Tor leak portals and clearnet extortion mirrors.
Attack tempo remained aggressive throughout the week, characterized by rapid multi-extortion releases and high-volume disclosures in critical industrial sectors. N0n accounted for the single largest share of victim claims, operating with notable velocity across international supply chains.
Syndicate Activity & Attack Velocity
The extortion landscape over the past seven days was concentrated among a core echelon of syndicates:
| Syndicate | Victim Claims | Share of Total |
|---|---|---|
| N0n | 88 | 36.2% |
| qilin | 36 | 14.8% |
| Wallstreet | 15 | 6.2% |
| Orova | 11 | 4.5% |
| iah6477 | 11 | 4.5% |
| incransom | 9 | 3.7% |
| play | 9 | 3.7% |
| interlock | 6 | 2.5% |
While established syndicates maintained predictable publishing rhythms, fluctuations in victim pacing suggest targeted burst campaigns following initial access broker (IAB) credential flushes.
Targeting Dynamics: Industries & Geographies
Disclosures spanned diverse global enterprises, with pronounced targeting observed across critical infrastructure and operations-sensitive sectors:
Top Targeted Sectors
- Logistics & Transportation: 34 disclosures
- Professional Services: 29 disclosures
- Manufacturing: 29 disclosures
- Technology: 19 disclosures
- Healthcare: 18 disclosures
- Other: 10 disclosures
Geographic Exposure
- 🇺🇸 US: 66 victim organizations
- 🇰🇷 KR: 12 victim organizations
- 🇸🇪 SE: 10 victim organizations
- 🇧🇷 BR: 8 victim organizations
- 🇩🇪 DE: 7 victim organizations
- 🇮🇳 IN: 6 victim organizations
Emerging Groups & Syndicate Lineage
The following threat syndicates were observed for the first time during this period: 0x00.
Notable Victim Disclosures
- Praveg Caves Jawai (🇮🇳 IN) — Targeted by Bavacai: A luxury safari resort near the Jawai leopard reserve in Rajasthan, India.
- Eversource Energy (🇺🇸 US) — Targeted by Redact: An electric utility in the United States generating $14B in revenue, delivering energy distribution services.
- Canadian Mennonite University (Global) — Targeted by dragonforce: A Canadian university based in Winnipeg that offers undergraduate and graduate programs.
- Prodiel (Global) — Targeted by qilin: A civil engineering construction company.
- ConAuto (Global) — Targeted by qilin: ConAuto is an automotive parts manufacturer.
- Nam Dinh Vu Port (🇻🇳 VN) — Targeted by N0n: Deep-sea container port and logistics terminal operator in Hai Phong, Vietnam.
- Pusan Newport Company (🇰🇷 KR) — Targeted by N0n: Major container terminal operator at Busan New Port, South Korea.
- ILCS Pelindo (🇮🇩 ID) — Targeted by N0n: Port logistics and digital terminal operating system provider in Indonesia.
- Eurogate Tanger (🇲🇦 MA) — Targeted by N0n: Container terminal operator at Tanger Med port complex in Morocco.
- Camellia Line (🇯🇵 JP) — Targeted by N0n: International ferry and RoRo shipping operator connecting Busan and Fukuoka.
- Samjoo Maritime (🇰🇷 KR) — Targeted by N0n: Ship management and maritime operations agency based in South Korea.
- T2S (🇧🇷 BR) — Targeted by N0n: Terminal operating systems and port automation software provider in Brazil.
Strategic Defense Priorities
In light of this week's observed TTPs and targeting velocity, SOC and security engineering teams should prioritize the following defensive postures:
- External Perimeter Hygiene: Audit exposed edge devices, VPN concentrators, and remote desktop services for unpatched CVEs and missing MFA.
- Identity & Privilege Controls: Restrict service account privileges and enforce credential rotation to impede rapid post-compromise privilege escalation.
- Offline Backup Resilience: Validate immutable, out-of-band backup restoration workflows to mitigate data withholding leverage.