Ransomware Attacks This Week: 252 Victims Across 44 Groups (November 02 to November 08 2026)

This is the Scrutex ransomware weekly for the November 2 to 8, 2026 window. Our CTI team tracked 252 unique ransomware and extortion victim postings across 44 active groups and 39 countries. That is down 23% from 327 for October 26 to November 1.

The fall is narrower than it looks. Last week two operators published backlogs: Qilin posted 107 victims and The Gentlemen 51. This week Qilin posted 16 and The Gentlemen 25. Take those two groups out of both weeks and the rest of the leak site ecosystem went from 169 postings to 211, a rise of 25%. The week was not quieter. It was flatter.

No crew carried it. The largest publisher, The Gentlemen, took 25 of 252, under 10%. The top five took 40% of the week against 59% a week earlier, and 19 separate groups posted one or two victims each. A week with no dominant operator is harder to monitor than a week with one, because there is no single site to watch.

Three things stand out below the volume. Akira posted 24 victims, its heaviest week in at least six and four times its last-week count, with 16 of them in the United States. A new leak site, PixelLeaks, opened on November 3 and ran 23 listings in six days without naming most of its victims: each entry carries a sector description and a countdown to identity exposure. And Silent Ransom Group listed US law firms for a third straight week, naming Wachtell, Lipton, Rosen & Katz, Smith, Gambrell & Russell, Tucker Ellis and Benesch beside five masked stubs. Thirteen law firms in all were named across the week.

The largest claims of the week came from the least reliable sources. WhiteArmor claims 79 GB and a $15 million demand from Unilever and 100 GB with a $5 million demand from a Maersk contract logistics platform. Global Secret Group claims 2.37 TB from Kontron North America. None has been confirmed by the named organisation.

The United States took 98 postings, 39% of the week, down from 141. Germany held at 19, which made it the second most listed country for a second week. Manufacturing led the labelled sectors with 42.

A note on how to read the numbers. Each count is a unique organisation named on a leak site during the window. We merge duplicate listings and mirrored sites, fold masked names into their later reveals, and leave out postings that do not name an organisation. Counts reflect leak site postings, not confirmed compromises, and by the time a victim is posted the intrusion is usually 30 to 90 days old.

The week ran 44, 25, 60, 18, 35, 44 and 26. There was no single day like last Monday's 142. The Wednesday peak of 60 is three batches landing together: MedusaLocker posted 14, Brain Cipher 11 and SafePay 8 that day.

The top five groups took 102 of 252 postings. Below them, 19 groups posted one or two victims each. That long tail is the part worth noting: the number of distinct brands publishing has held at 42 to 44 for three weeks while the volume has swung by a factor of two.

Last week's issue said that 158 of 328 postings came from two operators clearing their backlogs in a single day, and that the rest of the ecosystem was flat. This week tests that reading.

Qilin went from 107 to 16, its lowest weekly count since mid September. The Gentlemen went from 51 to 25, and 24 of those 25 arrived in one batch on Monday November 2. Both patterns are consistent with operators that publish in waves rather than daily, which is what last week's issue argued.

Everyone else rose. Akira went from 6 to 24, INC Ransom from 1 to 10 and N0n from 3 to 14, and three brands that posted nothing at all last week posted 12 or more this week: PixelLeaks 23, MedusaLocker 14 and Brain Cipher 12.

For a defender the practical difference is this. A week dominated by one group gives you one set of indicators, one access route to hunt, one site to watch. A week spread across 44 brands, where the largest holds under 10%, gives you 44. Monitoring that is filtering work, not reading work.

Orova, Payload, Rhysida, Aoqin, LockBit and Play posted five each. Nineteen further brands posted one or two.

Two runs are worth a second look. MetaEncryptor's seven listings on one day include three South Korean construction and engineering firms, one of them Hyundai E&C, a pattern that reads as one supplier or one contractor network rather than seven unrelated intrusions. Akira's 12 postings on November 6 are almost all US small manufacturers and trade businesses, which is the shape of an affiliate working a list of similar targets rather than a single large incident.

PixelLeaks opened on November 3. The site publishes in three stages: upcoming disclosures, disclosures, then leaks. Each entry carries a countdown to identity exposure and a separate countdown to full publication, with a negotiation room per victim. The effect is that most listings never name the organisation while the clock runs. Of 23 entries in six days, four carry a name and the remaining 19 carry only a sector description and a country, for example a hospital IT outsourcing provider in China, a welding trade school in the United States, an oncology genomics laboratory. We count these as listings, because each has its own entry and its own countdown, but they are listings you cannot act on until the countdown expires. If your organisation is behind one of them, the first signal you get will be your own.

Soul is Insomnia's back catalogue. A brand called Soul appeared on November 4 with 25 listings. Eighteen of them are organisations Insomnia listed between April and September 2026, among them NorthShore Health Centers (September 7), Massey Stotser & Nichols and Metropolitan Community Health Services (September 14) and Wiggins Childs Pantazis (September 15). Insomnia has posted nothing new since mid September. We count each organisation once, in the week it was first posted, so these 25 do not appear in this week's total. Whether Soul is a rename, a successor or a reseller of the same data, it is not 25 new victims.

MedusaLocker returned with a batch and a mirror. Fourteen listings on November 4, every one of them mirrored the same day on the Bavacai site, which republishes the crew's postings under its own brand. Counted naively the mirror alone would add 12 to the week. Several of MedusaLocker's labels are truncated to a few letters, which makes attribution to a specific organisation unsafe, and we leave those as posted rather than guess.

Brain Cipher, Aoqin, Orova, Destello and Falcon all published. Brain Cipher's 12, Aoqin's five and Orova's five are corroborated publishing runs rather than a site's back catalogue being read in bulk for the first time, which is how Soul and the LockBit index below arrived.

LockBit's file share index resurfaced. Five entries appeared on November 8 under a LockBit label, including continental.com. All five are 2021 and 2022 listings from LockBit 2.0 and 3.0: Continental was listed in November 2022. They are excluded. If you see Continental in a feed dated this week, it is the 2022 incident.

Manufacturing was the only major sector to hold its level while the total fell 23%. Business services fell in absolute terms but held its share, and the law firm share of it did not move: thirteen firms were named this week, the same number as in each of the two previous weeks. Four of this week's thirteen came from Silent Ransom Group, and the rest are spread across Qilin, Rhysida, INC Ransom, The Gentlemen, Falcon, MedusaLocker and Redact.

Seventy five of 252 postings carry no usable sector label, higher than last week's 56. That is a direct consequence of PixelLeaks and Brain Cipher publishing descriptions and bare domains rather than company names.

The US share fell from 43% to 39% and the absolute count fell by 43, almost exactly the amount Qilin's retreat removed. Germany held at 19 on the back of two clusters: SafePay posted four German healthcare, education and care domains on November 4, and Payload posted three more on November 7, a car dealership, a haulier and an engineering consultancy, after a steel fabricator on November 3. Both crews are working the German Mittelstand, and both post domains rather than company names.

South Korea's five come from a single day and a single group, MetaEncryptor. Twenty three postings carry no country at all, most of them PixelLeaks entries that have not reached their identity countdown.

Every entry below is a claim the actor posted. We say where the organisation or an authority has said something, and rate how far the claim itself can be trusted.

WhiteArmor claims Unilever, then Maersk. Unilever on November 4, with a claim of about 79 GB across roughly 1.8 million files and a $15 million bitcoin demand. Maersk on November 7, with a claim of about 100 GB from a contract logistics platform, including driver records, staff accounts and delivery recipient data, a $5 million demand and a 30 day deadline. Neither company has acknowledged an incident, and we found no independent reporting of either. Confidence: Low on both. WhiteArmor opened in late October with a run of very large consumer and logistics brands, listed its own Telegram channel and a "Verification" tile as victims last week, and has a short record of claims that nobody has substantiated. Note also that Unilever was listed by Warlock in June 2025: do not read the older incident as evidence for this one.

Global Secret Group claims 2.37 TB from Kontron North America. Posted November 4. The claim is roughly 912,000 files across about 156,000 folders, taken from the US arm of the German embedded computing and IoT manufacturer. Kontron has not commented. Confidence: Low on the claim, but the target profile is worth attention: embedded computing vendors sit inside industrial and medical products, and a design and support archive is more useful to a competitor or a follow-on attacker than to the victim's customers.

N0n marks Delta Dental of Missouri as exposed. Posted November 5 and flagged not paid. The listing describes member records and a customer database. The same crew posted The Container Store the same day, then Staples and Hallmark Cards on November 6 and 7. Confidence: Medium that a dental benefits dataset is in play, given the detail in the listing. Low on the Staples claim, which describes a daily margin file of roughly 382,000 records and reads like one export rather than an enterprise compromise. None of the four companies has commented. If you are a Delta Dental of Missouri member, expect phishing that quotes real plan and treatment details.

Silent Ransom Group names four more law firms. Wachtell, Lipton, Rosen & Katz, Smith, Gambrell & Russell, Tucker Ellis and Benesch, between November 2 and 7, with five masked stubs beside them and the list mirrored on LeakedData. Confidence: Medium that the group has active access into the US legal sector, which the FBI has warned about and which independent research supports: one vendor count puts 42 law firms among the group's 50 most recent victims, and a leaked ledger reportedly shows about $207 million paid by 27 firms between April and September 2026. Low on each individual firm. None has commented.

BYOD lists IHG Hotels & Resorts. Posted November 3 and reposted November 5 as a "first and final warning", with claimed access to reservation ledgers and financial records. The listing has since been taken down from the site, which usually means payment, a retraction or a claim that did not survive scrutiny. IHG has not commented. Confidence: Low. The same crew listed Texas HHSC on November 8 with no detail and no response from the agency.

Scarlett Group lists SIG Sauer. Posted November 4 as a bare domain. The firearms manufacturer has not commented, and the listing carries no volume or sample. Confidence: Low.

Two crews now claim Holland & Knight. Silent Ransom Group listed the firm on September 1. Redact listed it on November 2. Either two crews reached the same firm, or the second is recycling the first one's data. For the firm's clients the question is the same either way: whether matter files held by outside counsel are in circulation.

Redact lists Omni Hotels & Resorts. Posted November 5. Omni was listed by Daixin in April 2024 in a well documented incident involving several million guest records. Confidence: Low that this is a new intrusion. Do not cite the 2024 incident as support for the 2026 listing.

RansomHouse published nothing new. All three of its entries this week, the Namibian Defence Force, Pertamina and Phillips Nizer, are status changes on listings from September 16, September 17 and October 11. Namibia's national cybersecurity team confirmed an intrusion at the Ministry of Defence and Veterans Affairs in September. The status flip is not a new incident, and we count the original week.

Low signal claims this week. 42 postings are a bare domain and 11 are masked to a few characters, so 199 of 252, 79%, name an organisation in words, down from 86% last week. Brain Cipher, SafePay and LockBit account for most of the bare domains, Silent Ransom Group and Everstake for most of the masked entries.

Updates on last week's claims. Nothing further has been published that we have found on SAP, SoftwareOne, FPT Software, Ryder, KuCoin, Holcim or the six law firms listed in the October 26 to November 1 window. The City of Columbia and UNM Health incidents remain as last reported.

The table covers this week's active groups where a named source supports the attribution. Scores are the published base scores.

This week's KEV additions. CISA added three vulnerabilities between November 2 and 8. None is flagged for known ransomware campaign use, so none belongs in the table above. They belong on the patch list anyway.

The SonicWall entry deserves a sentence of care. CISA records the ransomware campaign use of CVE-2026-19868 as unknown, and no published research ties it to a named crew. We are not attributing Akira's week to it. What is true is narrower and still useful: Akira has a documented history of SonicWall SSL VPN access through CVE-2024-40766, Akira had its heaviest week in six, and a second SonicWall SSL VPN flaw that defeats MFA is now confirmed as exploited. If you run SonicWall SSL VPN with SAML, patch it this week and review logins for accounts that should only ever authenticate through SAML.

Attribution accuracy note. We list a group against a CVE only where a named source supports it. The Gentlemen's Fortinet and Veeam links, Akira's SonicWall link and Qilin's PAN-OS link are carried forward from published research and were not re-observed this week.

Anonymity is becoming a pressure tactic. PixelLeaks publishes a sector description, a country and a countdown, and reveals the name only when the clock runs out. The crew gets the deterrent value of a public listing while keeping the victim deniable, and the victim loses the one thing that usually forces a decision: other people knowing. Nineteen of 23 PixelLeaks entries were still anonymous at the end of the week. OBSOFT ran the same play with numbered slots and partially masked Korean hospital domains, and Everstake masked three domains to their first and last characters.

Status flips are being re-dated as new activity. RansomHouse moved three old listings to a disclosed state this week and they surfaced carrying this week's date. Pear did the same in October with a "LEAKED" relabel. A status change on a September listing is not a November incident, and a weekly count that does not check for it will read a quiet week as a busy one.

Back catalogues keep re-entering. Soul arrived with 25 listings, 18 of them Insomnia's earlier work. A one day re-read of Redact's victim list put eight firms back in circulation, among them FCCI Insurance Group and Hologic, first listed in June. A LockBit file share index put 2021 and 2022 victims back in, Continental among them. Together with three RansomHouse status flips and two earlier MedusaLocker victims, that is 42 postings this week that are not this week's activity.

Batch publishing, now at smaller scale. Four crews put their entire week into a single day: The Gentlemen 24 of 25 on November 2, MedusaLocker all 14 on November 4, MetaEncryptor all seven on November 7, DeadLock all six on November 8. The pattern that produced last week's 142 post Monday is still there. It is just distributed across more, smaller operators.

Patch SonicWall SSL VPN this week if you use SAML. CVE-2026-19868 lets a user with credentials for another method bypass SAML and the MFA behind it, exploitation is confirmed and there is no workaround. Then review SSL VPN logins for accounts that should only authenticate through SAML, which is the only detection available while the vendor publishes no indicators.

If you run SonicWall at the edge and are a US SME, treat Akira as current. Twenty four victims in a week, 16 in the United States, mostly small manufacturers, logistics firms and trade businesses. Check for VPN sessions you cannot account for, newly created local accounts on the firewall and any credential that was valid during an unpatched window.

Ask your law firms the help desk question for the third week running. Thirteen firms this week, after thirteen in each of the two previous weeks. These crews get in by telephone, not by exploit. Ask outside counsel in writing how they verify IT support calls and whether anyone has contacted them claiming to hold your matter files.

Do not clear a claim because nobody is named. Nineteen listings this week carry only a sector description and a countdown. If you are behind one, there is no name to search for and no press report to react to. The window between posting and identity exposure is the window in which to find out, and it is measured in days.

Check whether a dated listing is actually new. Forty two postings this week were old listings in new clothes: a back catalogue republished under a new brand (25), a one day re-read of a victim list (8), a file share index from 2021 and 2022 (4), three status flips and two earlier victims reposted. Before you escalate a supplier listing, check whether that supplier was listed by the same crew months ago.

Manufacturers: the pattern this week is the supplier, not the brand. MetaEncryptor's seven listings include three Korean construction and engineering firms on the same day. Akira and The Gentlemen between them posted 13 manufacturers. Know which of your suppliers hold your drawings, bills of material and production schedules, and what access they have back into your environment.

Most of that is triage before it is defence. Somebody has to read 252 postings, set aside the mirrors, the relabels and the back catalogues, and work out which of the rest touch your organisation or your suppliers.

Scrutex Threat Insights monitors ransomware leak sites and dark web sources continuously and matches what it finds against your own domains and your named suppliers, so a listing that names your organisation, your outside counsel or a component supplier reaches you as an alert and not as a line in a weekly roundup. Data Exposure Insights watches for employee credentials in infostealer logs and breach corpora, the raw material behind most help desk impersonation calls. Vulnerability Insights prioritises flaws like CVE-2026-19868 and CVE-2024-40766 by real-world exploitation against your exposed assets, not by raw CVSS. None of them can tell you whether a claim is true. All of them can tell you, quickly, whether it is about you.

Start at scrutex.ai/signup or read more at scrutex.ai/solution/threat.

How many ransomware attacks were there in the week of November 2 to 8, 2026? Scrutex tracked 252 unique victim postings across 44 active groups and 39 countries, down 23% from 327 the week before. The fall is almost entirely Qilin and The Gentlemen returning to normal after publishing backlogs: excluding those two groups, postings rose 25%, from 169 to 211. These are leak site postings, not confirmed compromises, and the intrusion is usually 30 to 90 days older than the posting.

Which ransomware group was most active? The Gentlemen, with 25 listings, but it held under 10% of the week. Akira was second with 24 and PixelLeaks third with 23. No group dominated, and the top five took 40% of postings against 59% a week earlier.

Why did Akira post so many victims this week? Akira posted 24 victims, four times its previous week and its heaviest run in at least six weeks, with 16 in the United States and 12 posted on November 6. Akira has a documented history of access through SonicWall SSL VPN, and most of this week's victims are the size of business that runs SonicWall at the edge. We have no evidence tying the run to a specific vulnerability.

What is PixelLeaks? A leak site that went live on November 3 and posted 23 listings in six days. It names very few victims. Each entry carries a sector description, a country, a countdown to identity exposure and a separate countdown to full publication, with a negotiation room per victim. Four of its 23 entries carry a company name. The group's claims are unverified.

Was Unilever hit by ransomware? WhiteArmor listed Unilever on November 4 claiming about 79 GB and demanding $15 million. Unilever has not acknowledged an incident and we found no independent reporting. We rate the claim low confidence. A separate crew listed Unilever in June 2025, which is a different matter and is not evidence for this claim.

Did Maersk suffer a data breach? WhiteArmor claimed about 100 GB from a Maersk contract logistics platform on November 7, with a $5 million demand and a 30 day deadline. Maersk has not commented. We rate the claim low confidence, from a group with no substantiated listings so far.

Why are law firms being targeted again? Thirteen law firms were named this week, the same number as in each of the two previous weeks. Silent Ransom Group, tracked as UNC3753 and also known as Luna Moth, gets in by calling staff while posing as IT support rather than by exploiting software, and the FBI has warned US firms about it. Law firms hold their clients' most sensitive documents, which gives an extortion crew a hold over the firm and its clients at once.

Which CVEs should I patch this week? SonicWall SonicOS SSLVPN CVE-2026-19868, added to CISA's KEV catalogue on November 6 with a November 20 deadline and confirmed exploitation. WordPress Core CVE-2026-119977, added November 3, where the federal deadline was three days. Apple CVE-2024-27834, added November 4. Carry forward PAN-OS CVE-2026-0257, Fortinet CVE-2024-55591, SonicWall CVE-2024-40766 and Veeam CVE-2023-27532, all of which name this week's active groups.

Where can I get this in real time instead of weekly? Scrutex Threat Insights monitors leak sites and dark web sources continuously and matches findings against your own domains and your named suppliers, so a relevant listing reaches you when it is posted, not in the following Monday's roundup.

Related reading: Weekly Ransomware Intelligence Report, November 1, 2026 · Threat Insights · Vulnerability Insights