Executive Summary
Between October 18, 2026 and October 25, 2026, the CTI.FYI intelligence pipeline intercepted a total of 275 ransomware victim disclosures across monitored Tor leak portals and clearnet extortion mirrors.
Attack tempo remained aggressive throughout the week, characterized by rapid multi-extortion releases and high-volume disclosures in critical industrial sectors. N0n accounted for the single largest share of victim claims, operating with notable velocity across international supply chains.
Syndicate Activity & Attack Velocity
The extortion landscape over the past seven days was concentrated among a core echelon of syndicates:
| Syndicate | Victim Claims | Share of Total |
|---|---|---|
| N0n | 92 | 33.5% |
| qilin | 34 | 12.4% |
| BrainCipher | 26 | 9.5% |
| krybit | 13 | 4.7% |
| SilentRansomGroup | 12 | 4.4% |
| Emperador | 9 | 3.3% |
| Helix | 9 | 3.3% |
| Whitearmor | 7 | 2.5% |
While established syndicates maintained predictable publishing rhythms, fluctuations in victim pacing suggest targeted burst campaigns following initial access broker (IAB) credential flushes.
Targeting Dynamics: Industries & Geographies
Disclosures spanned diverse global enterprises, with pronounced targeting observed across critical infrastructure and operations-sensitive sectors:
Top Targeted Sectors
- Logistics & Transportation: 34 disclosures
- Professional Services: 33 disclosures
- Manufacturing: 29 disclosures
- Technology: 25 disclosures
- Healthcare: 17 disclosures
- Other: 16 disclosures
Geographic Exposure
- 🇺🇸 US: 92 victim organizations
- 🇩🇪 DE: 15 victim organizations
- 🇰🇷 KR: 13 victim organizations
- 🇧🇷 BR: 7 victim organizations
- 🇪🇸 ES: 5 victim organizations
- 🇮🇩 ID: 4 victim organizations
Emerging Groups & Syndicate Lineage
The following threat syndicates were observed for the first time during this period: Mimori.
Notable Victim Disclosures
- Nam Dinh Vu Port (🇻🇳 VN) — Targeted by N0n: Deep-sea container port and logistics terminal operator in Hai Phong, Vietnam.
- Pusan Newport Company (🇰🇷 KR) — Targeted by N0n: Major container terminal operator at Busan New Port, South Korea.
- ILCS Pelindo (🇮🇩 ID) — Targeted by N0n: Port logistics and digital terminal operating system provider in Indonesia.
- Eurogate Tanger (🇲🇦 MA) — Targeted by N0n: Container terminal operator at Tanger Med port complex in Morocco.
- Camellia Line (🇯🇵 JP) — Targeted by N0n: International ferry and RoRo shipping operator connecting Busan and Fukuoka.
- Samjoo Maritime (🇰🇷 KR) — Targeted by N0n: Ship management and maritime operations agency based in South Korea.
- T2S (🇧🇷 BR) — Targeted by N0n: Terminal operating systems and port automation software provider in Brazil.
- Korea Ferry (🇰🇷 KR) — Targeted by N0n: South Korean maritime passenger and cargo ferry operator.
- BKH ICD (🇰🇷 KR) — Targeted by N0n: Inland container depot and intermodal logistics operator in South Korea.
- BMT International (🇬🇧 GB) — Targeted by N0n: Marine surveying, technical inspection, and risk consulting firm.
- EUSU Logistics (🇰🇷 KR) — Targeted by N0n: Global freight forwarding and third-party logistics company based in South Korea.
- Dong-A Tanker (🇰🇷 KR) — Targeted by N0n: Oil tanker and maritime chemical transport shipping operator in South Korea.
Strategic Defense Priorities
In light of this week's observed TTPs and targeting velocity, SOC and security engineering teams should prioritize the following defensive postures:
- External Perimeter Hygiene: Audit exposed edge devices, VPN concentrators, and remote desktop services for unpatched CVEs and missing MFA.
- Identity & Privilege Controls: Restrict service account privileges and enforce credential rotation to impede rapid post-compromise privilege escalation.
- Offline Backup Resilience: Validate immutable, out-of-band backup restoration workflows to mitigate data withholding leverage.