Ransomware Attacks This Week: 302 Victims Across 50 Groups (October 12 to 18 2026)
By ScruteXPublished
Summary
This is the Scrutex ransomware weekly for the October 12 to 18, 2026 window. Our CTI team tracked 302 unique ransomware and extortion victim postings across 50 active groups and 51 countries. That is up 57% from 192 for October 5 to 11 on the same counting rules, and the highest weekly total we have published this year. The United States took 110 postings, 36% of the week. Transportation and logistics led the sectors with 44, the first time it has led any week in this series.
One batch explains most of the rise. On Monday October 12 a crew calling itself N0n listed 38 maritime and logistics organisations at once: container shipping lines, terminal operators, port community IT platforms and ship managers across 18 countries. Ocean Network Express, ZPMC, Pusan Newport, Santos Brasil, Eurogate Tanger, NEOM Ports and T.S. Lines all appear on the same page, with a publication deadline of October 19. N0n finished the week on 55 listings and first place. A week earlier it had one.
Below that, the shape of the week is ordinary. The Gentlemen posted 37, 31 of them in a single mid week batch, the way it has published since early September. Qilin posted 29, at least one on every day, across 17 countries. Then a set of crews that posted nothing at all last week: WallStreet with 15, Orova with 11, Play with 9, IAH647 with 8, Settra with 8 and The Seven Deadly Sins with 7. Twenty four brands in this week's figures were absent from last week's.
The movement is not all upward. SafePay fell from 13 to 1, Umbra from 10 to nothing, Silent Ransom Group from 7 to nothing and Rhysida from 5 to nothing. Twenty two brands that posted last week posted nothing this week. Both halves of that churn are normal. A leak site publishes when an affiliate finishes a negotiation, not when an intrusion happens.
Four claims this week name organisations large enough to matter beyond their own customers: Canva, listed with a claim of more than 200 million database rows; Eversource Energy, ONEOK and Parker-Hannifin, listed inside five days by the same crew; MyMichigan Health, a 15 hospital system; and Telecom Egypt. None of the four has confirmed anything.
302 posts, 50 groups, 51 countries in a single week. Reading every one to find the three that touch your own organisation or your suppliers is most of a working day.
A note on how to read the numbers. Each count is a unique organisation named on a leak site during the window. We merge duplicate listings, count a relisted incident once, in the week it first appeared, and leave out postings that do not name an organisation. Counts reflect leak site postings, not confirmed compromises, and by the time a victim is posted the intrusion is usually 30 to 90 days old.
In This Post
| Section | What it covers |
|---|---|
| This Week at a Glance | Headline numbers and a week built on one Monday batch |
| The Maritime Batch | 38 shipping and port firms, one likely shared system |
| Group Activity Breakdown | Who posted most, and what sits behind each run |
| New and Emerging Groups | WallStreet, Orova, The Seven Deadly Sins, Helix, Redact |
| Sector Targeting Analysis | Logistics takes first place for once |
| Country Distribution | Where the 51 countries fall |
| Notable Claims and Incidents | Five named claims and how far each can be trusted |
| Top CVEs These Groups Are Exploiting | The flaws in play, and a bad week for remote access |
| Infrastructure and Operational Shifts | One vendor, many victims, and two crews on one target |
| Key Takeaways for Defenders | The short action list |
This Week at a Glance
| Metric | Value |
|---|---|
| Total unique victims posted | 302 |
| Change on prior week | Up 57% (from 192) |
| Active groups | 50 |
| Countries hit | 51 |
| Heaviest single day | Monday October 12 (75 posts, 25% of the week) |
| Quietest day | Saturday October 17 (14 posts) |
| Most targeted country | United States (110 victims, 36% of postings) |
| Most targeted sector | Transportation and Logistics (44), then Business Services (42) |
| Top group by volume | N0n (55, 38 of them on October 12) |
| Notable claims | 38 maritime firms, Canva, Eversource Energy, ONEOK, Parker-Hannifin, MyMichigan Health, Telecom Egypt, Taiwan Otsuka Pharmaceutical, Personify Health, Southwire |
The week front loaded. Monday took 75 postings, Tuesday 51, Wednesday 53 and Thursday 56, which is 235 of 302 in four days. Friday fell to 32, Saturday to 14 and Sunday closed on 21.
Two of those days had a single driver. Monday belonged to N0n, whose 38 firm maritime batch accounted for half the day on its own, with six from Interlock and four from Orova behind it. Wednesday was The Gentlemen's batch of 31, with 12 from Qilin spread across the same day. Thursday had no batch: 56 postings from 18 different crews, the broadest day of the week. A batch tells you when a crew published, not when it broke in, so read Monday as a publishing decision and not as 38 simultaneous intrusions.
The rise from 192 to 302 is concentrated. Strip out N0n's 55 and the week reads 247, still up 29% on last week's 192. Strip out the whole of the top five and the remaining 45 groups produced 155 postings against 97 last week. The breadth is real, not only the batch. The top five groups took 147 of 302 postings, 49%, almost exactly last week's 49%, which is unusual given that one of them posted 55.
The Maritime Batch
This is the largest single sector campaign we have recorded in this series, and it deserves its own section.
On October 12 N0n published 38 listings in one run. The victims are not a random spread of mid market firms. They are the working parts of container logistics:
- Shipping lines and operators: Ocean Network Express, CULines, T.S. Lines, Samudera, Premier Alliance, Polaris Shipping, Camellia Line, Korea Ferry, Dong-A Tanker
- Terminals and ports: Pusan Newport Company, BNCT Busan New Container Terminal, Santos Brasil, Superterminais, Portonave, TTI Algeciras, Asyaport, Eurogate Tanger, Nam Dinh Vu Port, NCT Kandla, NEOM Ports, MGNP
- Port and terminal IT: GNCNet and DGT Busan, T2S, GCS Kuwait, ILCS Pelindo, HPC Hamburg Port Consulting
- Supporting services: Yusen Logistics Hong Kong, EUSU Logistics, Apical Group, April Asia, GlobalNet LCL, BKH ICD, BMT IQ, Saehan Marine, Samjoo Maritime
- Industrial: ZPMC, Dongkuk Steel, Tsuneishi and Kambara Kisen
South Korea carries 12 of the 55 N0n listings and the United States 12, with the rest running through Japan, China, Indonesia, Brazil, Vietnam, India, Turkey, Morocco, Kuwait, Saudi Arabia, Spain, Hong Kong, Singapore, Taiwan, the Netherlands, Germany, Egypt, Australia and the United Kingdom.
The claimed data is operational, not corporate. Reporting on the listings describes EDI messages, container manifests, vessel schedules, gate movement records and terminal configuration detail. That is the paperwork of moving boxes, not HR files. Industrial Cyber's analysis notes no sign of disruption to vessels or port equipment.
Nobody has confirmed. As of October 14 none of the named organisations had publicly acknowledged a compromise. The deadline on the listings is October 19 at 13:27 UTC, which is the day this report publishes.
What to do if you move freight. Three questions, in this order. Which of your logistics providers, terminal operators or customs brokers appears on that list. Which maritime software platforms hold your shipment data, and whether your contracts require that vendor to tell you about an incident. And whether manifest or EDI data describing your cargo, consignees and schedules would matter in the wrong hands, because that is the material being claimed. If the shared vendor theory holds, the number of organisations whose data sits in the archive is larger than 38.
Group Activity Breakdown
The top five groups produced 147 of 302 postings, 49% of the week. Below them, 28 groups posted three or fewer victims each, together accounting for 47.
| Rank | Group | Victims | Share | Notable Activity |
|---|---|---|---|---|
| 1 | N0n | 55 | 18% | The 38 firm maritime batch on October 12, then Telecom Egypt, SMIC's US arm, Amagi Media Labs and 14 more named listings through the week |
| 2 | The Gentlemen | 37 | 12% | 31 in one batch on October 14 across 18 countries. Taiwan Otsuka Pharmaceutical, Ecuador's National Police, Engineers Ireland |
| 3 | Qilin | 29 | 10% | Every day of the week, 17 countries. Keio Corporation, Belcorp, Joliet Public Schools, a Mexican municipal water utility |
| 4 | WallStreet | 15 | 5% | 11 on October 13, ten of them Swedish. Six architecture and consulting practices, two Swedish and German care homes |
| 5 | Orova | 11 | 4% | Three days, all in Asia. Indian and Taiwanese wireless technology firms, a Hong Kong hotel, a Singapore engineering firm |
| 6 | Akira | 9 | 3% | Seven in the US on three days. An architectural hardware maker, a dairy, a law firm, an energy services group |
| 7 | Everest | 9 | 3% | Seven countries, no US concentration. Laerdal, Topcon Healthcare, Al-Futtaim, the Brenner Base Tunnel project |
| 8 | LockBit | 9 | 3% | Six on October 15. Bare domains across Thailand, Greece, Mexico, Egypt, India and Malaysia |
| 9 | Play | 9 | 3% | Two days. A US imaging reseller, a German accountancy, WSBI-ESBG in Brussels |
| 10 | IAH647 | 8 | 3% | Seven on October 15 as bare slugs. Middleby, Hilmar Cheese, The Buckle, Alera Group, McKenney's |
Also active: Settra (8, all eight on October 16 as bare domains), INC Ransom (7), The Seven Deadly Sins (7), HYFLOCK (6), Interlock (6, all six on October 12), Helix (6), and a long tail of Aurora, MajinaHanashi, Audit Team, Emperador, NightSpire, Vexy, Dark Project, Redact, Eclipse, Pear, ShadowByt3$, Space Bears, DragonForce, DeadLock, Panzer, Storm, RansomHouse, SafePay, BYOD, Bravox, Cloak, DireWolf, Doommageddon, GammaX, Gunra, Kairos, Kazu, Lapsus$, MetaEncryptor, Morpheus, PayoutsKing, Scarlett Group, SecP0 and 0X00, each with one to four listings.
Four observations:
N0n has changed tactics twice in a month. Three weeks ago it was publishing anonymous numbered slots, "Company #21" with a sector and a countdown and no name, which we do not count because they identify nobody. It is still doing that: 29 numbered slots ran from Company #63 to Company #92 inside this window and none of them is in our figures. What changed is that it now also publishes named victims in volume, and it has moved from mid market US firms to a coordinated sector campaign. A crew that can list 38 firms in one sector on one day is working from a single data source, not from 38 intrusions. The numbered slots and the maritime batch are two halves of the same pressure strategy: anonymity for the ones still negotiating, maximum publicity for the ones that are not.
The Gentlemen are running the same week again. 31 listings dated Wednesday October 14, two on Monday and four on Friday. That is the same single mid week batch pattern it has run since early September, and the victim profile has not moved: mid sized firms across manufacturing, business services, healthcare and logistics, eight of the batch in the United States and the rest spread from a Thai industrial firm to an Irish professional body, a Canadian paper mill and Ecuador's National Police. The one entry worth separating is Taiwan Otsuka Pharmaceutical, which a second crew claimed the same day. More on that below.
Qilin remains the steadiest operation on this page. 29 listings, at least one on every day of the week, across 17 countries with 12 in the United States. There is no batch in that pattern, which is what a large affiliate programme looks like when independent operators finish on their own schedules. The victims are mostly industrial and public: a Japanese railway and property group, a Peruvian cosmetics multinational, two US school districts, a Mexican municipal water authority, a Malaysian water asset manager, a Nigerian gas distributor, a French overseas commune. Qilin has gone from 14 to 23 to 29 over the last three weeks.
WallStreet ran a national campaign. Fifteen listings, eleven of them on October 13, and ten of the fifteen are Swedish. Six are architecture or technical consulting practices (Ahlqvist & Almqvist, Brunnberg & Forshed, Spectrum Arkitekter, Byrån för Arkitektur och Urbanism, Englunds Konsultbyrå, Briab Group), and two are elderly care operators, one Swedish and one German. A crew that lists six firms from one profession in one country on one day is either working through a shared supplier or through a professional association's membership list. If you run a Swedish architecture or engineering practice, assume your sector is on a list and check which CAD, project management or document platforms you share with your peers.
New and Emerging Groups
Twenty four brands appear in this week's figures that were absent from last week's. Most posted once or twice. Five are worth naming.
WallStreet. Not new, but new at this scale. The brand has been posting since June 2026, reaching 17 listings in September, and this is its largest week. Covered above: a Swedish professional services campaign. No research team has published how it gets in.
Orova. Eleven listings over three days, every one in Asia, and the sector profile is tight: wireless and embedded technology firms in India and Taiwan (Amantya Technologies, Libre Wireless Technologies, Gatetech Technology), a Singapore engineering consultancy, a Malaysian group, a Hong Kong watch retailer and a Hong Kong hotel. Three listings name nobody we can identify. A brand working one region and one technology niche is usually working from one access broker's inventory.
The Seven Deadly Sins. Seven listings, all dated October 15, and the names are larger than the volume suggests: Canva, Harness, Cradlewise, Globeia, iHeartJane, Verano Holdings and Hospital Sírio-Libanês in São Paulo. WatchGuard's tracker describes the brand as emerging and active with seven known victims, which is this week's set. Five of the seven are technology or healthcare technology companies, which fits a crew working through SaaS and CRM data rather than encrypting networks. Its Canva listing says the data has already been sold to a private buyer, which is a claim that cannot be checked and conveniently excuses the absence of a sample.
Helix. Six listings on October 17 and 18, all in the United States, and all six are substantial firms: Southwire, Quikrete, Rheem Global, Smith Douglas Homes, Bay Alarm and Personify Health. Four are building products and construction, which is a narrower pattern than six listings normally shows. None has commented and no research has been published on the brand's access route. Treat a run of six large US manufacturers in two days as a signal that something shared is in play, most likely a supplier or a managed service, and watch for a seventh.
Two brands that arrived complete deserve a word of caution rather than a count. Both Alpha Locker, whose leak site is titled MYDATA, and MedusaLocker under a second brand spelling published their full victim lists in one day this week. Alpha Locker has operated since 2023 and MedusaLocker far longer, and one of the MedusaLocker entries is a Manitoba school division the crew listed in 2025. Those are back catalogues republished, not a week of new activity, and they are excluded. Termite, Pear, LeakNet and BlackNevas reposted their own victim lists the same way this week, and those are excluded on the same basis. Without that filtering the week would have read 390 instead of 302.
Sector Targeting Analysis
| Rank | Sector | Victims | Share of labelled | Last week |
|---|---|---|---|---|
| 1 | Transportation and Logistics | 44 | 16% | 12 |
| 2 | Business Services | 42 | 16% | 26 |
| 3 | Manufacturing | 41 | 15% | 27 |
| 4 | Technology | 36 | 13% | 19 |
| 5 | Healthcare | 30 | 11% | 17 |
| 6 | Financial Services | 14 | 5% | 6 |
| 7 | Consumer Services | 13 | 5% | 10 |
| 8 | Education | 12 | 4% | 17 |
| 9 | Energy | 11 | 4% | 6 |
| 10 | Agriculture and Food | 9 | 3% | 6 |
| 11 | Public Sector | 6 | 2% | 5 |
| 12 | Construction and Real Estate | 5 | 2% | 2 |
| 13 | Hospitality and Tourism | 5 | 2% | 4 |
33 of 302 postings carried no sector label and are excluded from the share column.
Transportation and logistics leads a week for the first time. 44 postings against 12 last week, and 35 of the 44 are N0n's maritime campaign. Remove that campaign and the sector reads nine, which is below its usual level. This is one event, not a trend, and we would not tell a logistics operator that its sector risk tripled in a week. What did change is the demonstrated appetite: a crew chose freight infrastructure as a target set and found a way to reach 38 organisations in it at once.
Healthcare rose from 17 to 30 across 15 different crews. No single batch drives it. Eleven are dental, ophthalmology or specialist clinics, which is the small practice pattern we see most weeks. Six are larger: MyMichigan Health, Personify Health, Hospital Sírio-Libanês, Topcon Healthcare, Laerdal and Taiwan Otsuka Pharmaceutical. Two Scandinavian and German elderly care operators appear in WallStreet's Swedish run. A specialist clinic with a dozen staff and a hospital group with 15 sites are the same target to a crew working through an exposed remote access appliance.
Technology nearly doubled to 36. Five are The Seven Deadly Sins' batch, three are Orova's wireless firms, and the rest spread across 16 crews. Several are platforms rather than products: a messaging gateway, a media technology firm, a health benefits platform, a cannabis retail software provider. When a platform is listed, every customer whose data sits in it has a question to ask, and most will not hear about the listing from the platform.
Education fell from 17 to 12. Last week's rise was a single new crew listing five universities in Egypt and India; that crew posted nothing this week. What remains is the ordinary pattern: two US school districts, a Polish school, an Indian management institute, two education technology platforms.
Mid market firms remain the centre of gravity. Setting aside the maritime batch and the handful of household names, the typical victim this week is a 200 to 2,000 employee firm with $50 million to $1 billion in revenue, one IT team, and an internet facing VPN or remote support appliance. Treat an entry in this bracket as a 30 to 90 day risk window that opened before the listing appeared.
Country Distribution
| Rank | Country | Victims | Share |
|---|---|---|---|
| 1 | United States | 110 | 36% |
| 2 | Brazil | 16 | 5% |
| 3 | South Korea | 15 | 5% |
| 4 | United Kingdom | 10 | 3% |
| 5 | India | 10 | 3% |
| 6 | Sweden | 10 | 3% |
| 7 | Germany | 9 | 3% |
| 8 | Japan | 9 | 3% |
| 9 | Spain | 6 | 2% |
| 10 | Canada | 5 | 2% |
| 11 | Italy | 5 | 2% |
| 12 | Thailand | 5 | 2% |
A further 36 countries carried one to four postings each: Hong Kong, Singapore, Indonesia, Taiwan, Australia, Ecuador, Switzerland, Turkey, Netherlands, Peru, Malaysia, France, Mexico, South Africa, Norway, China, Saudi Arabia, Greece, Ireland, Egypt, Bangladesh, Chile, Morocco, Kuwait, Vietnam, Argentina, Philippines, Vanuatu, Pakistan, Czech Republic, Kazakhstan, UAE, Poland, Costa Rica, Nigeria, Belgium, Estonia, Andorra and Austria. 15 postings carried no country.
The US share fell to 36% from 40%. That is not a US improvement. It is arithmetic: the maritime batch put 26 of its 38 listings outside the United States, which pulled the share down while the absolute US count rose from 76 to 110.
South Korea's appearance at third is one campaign. Twelve of its 15 postings are N0n maritime listings: Pusan Newport, BNCT, Dong-A Tanker, EUSU Logistics, GNCNet, Korea Ferry, Samjoo Maritime, Saehan Marine, BKH ICD, Dongkuk Steel and others. South Korea does not usually reach this list. Read it as a vendor concentration, not a shift in national risk.
Sweden at sixth is also one campaign. Ten of its ten postings belong to WallStreet's October 13 run of architecture and consulting practices.
Brazil's 16 are spread across eight crews and include Hospital Sírio-Libanês, Santos Brasil and Superterminais, a telecom operator and several manufacturers. Brazil has now been in the top five for three consecutive weeks on genuinely distributed activity, which is a more meaningful signal than either of the two above.
Notable Claims and Incidents
Every entry below is a claim the actor posted. None is a confirmed breach unless the named organisation or an authority has said so.
N0n lists 38 maritime and logistics organisations in one batch. Posted October 12 with a deadline of October 19 at 13:27 UTC. The section above covers the detail. Confidence: Medium that a compromise of some shared system occurred, because 38 organisations with a documented common vendor do not appear on one page by coincidence, and the claimed data types are specific and operationally consistent. Low on any individual company's exposure, because no victim has confirmed, no product or flaw has been named, and the per company split appears to be the actor's own slicing of one archive. Low on every ransom figure in circulation. If you are named, the useful question is not whether N0n has your data but which of your vendors does.
The Seven Deadly Sins lists Canva. Posted October 15 alongside six other organisations. The listing claims more than 200 million database rows including about two million CRM records, business licence information, order PDFs and a corporate data warehouse, and states that the data has already been sold to a private buyer. Confidence: Low. Three cautions. The claim is carried by a single outlet and no sample has been published. A buyer who already has the data removes the actor's reason to prove anything. And Canva has an adjacent history that is easy to misread: in August a third party tool provider notified Canva that it was investigating unauthorised access, and Canva stated at the time that its own platform was not compromised and that user accounts, passwords and designs were not accessed. That is a different event. Do not treat it as corroboration of this one.
Redact lists Eversource Energy, ONEOK and Parker-Hannifin. Eversource on October 12, the other two on October 16. Redact emerged in May 2026 and steals data without encrypting, using voice phishing to reach a help desk or a user. Confidence: Low for each claim. None of the three has published a statement. One trap to avoid: Parker-Hannifin was breached by the Conti ransomware group in 2022, and that incident still ranks highly in search results. It is not this. Treat any 2022 reporting you find as unrelated, and if you are an Eversource, ONEOK or Parker supplier or customer, ask the company directly rather than inferring from the older story.
The Gentlemen and Eclipse both list Taiwan Otsuka Pharmaceutical. Both on October 14, each posted on its own leak site. Confidence: Medium that the company suffered an intrusion, because two unconnected crews named it on the same day and neither has been contradicted. Low on either crew's authorship. Two brands naming one victim usually means access or data was shared or resold, not two separate intrusions. The same thing happened to Ecuador's national police this week: HYFLOCK listed its headquarters on October 12 and The Gentlemen listed the force on October 14. When you see your own organisation claimed twice, the second listing is usually not a second breach.
MetaEncryptor lists MyMichigan Health. Posted October 12. MetaEncryptor is a double extortion crew with 17 claimed victims since October 2025. The listing carries no volume and no sample, and the health system has not published a statement. Confidence: Low. Older MyMichigan breach material from 2017 circulates in search results and concerns a different affiliate and a different event. Patients should wait for the system's own notification rather than the aggregator pages.
Low signal claims this week. 28 postings are a bare domain and eight are redacted to a few characters, so 266 of 302, 88%, name an organisation. That is a better ratio than last week's 84%. Among the named, several need a flag. ShadowByt3$ listed Nintendo with no data description and nothing else behind it, and we rate it very low. Helix's six large US names carry no volumes. IAH647's seven entries are bare slugs (middleby, buckle, alera, hilmar-cheese, sunshine-mills, mckenneys, camden-living) and resolve to substantial US firms, but a slug is not a description of anything taken. Settra's eight October 16 entries are bare domains. N0n's Telecom Egypt entry names a state telecommunications operator with no claimed volume.
Updates on last week's claims. Deloitte, KFC, MoneyGram, Confluent, BigID and Placer AI, all listed by The Gentlemen on October 9 and 10, have published nothing in the intervening week, and the listings have not been substantiated. Emperador's stated October 13 release date for its Receita Federal claim passed without Brazil's tax authority confirming a breach. Rhysida's Anne Arundel County claim remains uncommented. T-Systems stands where it did: Deutsche Telekom said the data was project slides and test environment logs, and nothing since has contradicted that.
Top CVEs These Groups Are Exploiting
The table covers this week's active groups where a named source supports the attribution. CVSS is the NVD v3.1 base score unless marked otherwise.
| CVE | Product | CVSS | Who is using it | Why it matters |
|---|---|---|---|---|
| CVE-2026-0257 | Palo Alto Networks PAN-OS GlobalProtect and Prisma Access, authentication bypass | 9.1 | Qilin, Settra | ReliaQuest reported both groups actively exploiting it on October 9 and rates continued exploitation over three months as highly likely. Arctic Wolf traced June intrusions to Qilin. On the CISA KEV catalogue since May 29. Both groups posted again this week, Qilin 29 and Settra 8 |
| CVE-2024-55591 | Fortinet FortiOS and FortiProxy, authentication bypass | 9.8 | The Gentlemen | Group-IB names it the group's primary access route. Sophos saw stolen credentials used against a Fortinet SSL VPN with no MFA instead. Assume both routes |
| CVE-2023-27532 | Veeam Backup and Replication, credential exposure | 7.5 | The Gentlemen | Group-IB documents its use after access, to pull stored credentials. The backup server holds the keys to the rest of the estate |
| CVE-2024-40766 | SonicWall SonicOS SSLVPN, improper access control | 9.8 | Akira | Arctic Wolf and Rapid7 tie sustained Akira activity to it and CISA's Akira advisory lists it as a likely access route. Akira posted nine this week, seven in the US |
| CVE-2026-50751 | Check Point Remote Access VPN and Mobile Access, IKEv1 authentication bypass | 9.3 (vendor, CVSS v4) | Qilin affiliate | Check Point confirmed Qilin affiliate activity after compromise in one case. On the CISA KEV catalogue since June 8 |
| CVE-2025-5777 | Citrix NetScaler ADC and Gateway, memory disclosure ("CitrixBleed 2") | 9.3 (vendor, CVSS v4) | DragonForce | Huntress followed one access broker through at least six intrusions in the first half of 2026 that ended in DragonForce. Stolen session tokens survive the patch |
| CVE-2023-3519 | Citrix NetScaler ADC and Gateway, unauthenticated RCE | 9.8 | INC Ransom | Trend Micro's INC profile documents exploitation in late 2023. Treat it as historical: we found no newer named source attributing a CVE to INC |
A bad week for remote access and backup. CISA added nine flaws to its Known Exploited Vulnerabilities catalogue between October 13 and 16. Every one is flagged "Unknown" for known ransomware campaign use, which is why they are not in the table above. Seven of the nine are the product classes extortion crews enter through, and three carry exploitation detail worth acting on this week.
| CVE | Product | Added | Federal deadline | What is known |
|---|---|---|---|---|
| CVE-2026-104935 | Ivanti Connect Secure, authentication bypass by spoofing | Oct 13 | Oct 16 | Disclosed and added to KEV the same day. Volexity reports an actor it tracks as UTA0576 chaining it with two other flaws since at least October 3 to reach unauthenticated root level code execution on fully patched devices. Ivanti has patched two of the three and is still working on a privilege escalation flaw in the same chain |
| CVE-2026-102764 | BeyondTrust Remote Support, authentication bypass by spoofing | Oct 16 | Oct 19 | Mandiant attributes zero day exploitation in late August 2026 to a suspected PRC nexus actor it calls ARMORY CASTLE. Affects Remote Support 26.2.3 and earlier. SaaS instances were patched on October 8; self hosted installations need manual patching |
| CVE-2026-105133 and CVE-2026-105134 | Ahsay AhsayCBS backup server, improper authentication and command injection | Oct 14 | Oct 17 | Huntress dates exploitation to October 7 and observed the two chained, authentication bypass then code execution, dropping JSP webshells and an XMRig miner across at least five organisations, mostly MSP environments. Ahsay's 10.3.4.0 release did not fully fix them; hotfix 10.3.4.45 shipped October 10 and requires a reboot |
| CVE-2026-0322 | Palo Alto Networks PAN-OS, code injection | Oct 14 | Oct 17 | A second PAN-OS flaw in the catalogue alongside CVE-2026-0257 |
| CVE-2026-76519 | Cisco Secure Email Gateway, relative path traversal | Oct 14 | Oct 17 | Mail gateway, internet facing by design |
| CVE-2026-21589 | Atlassian multiple products, files accessible to external parties | Oct 15 | Oct 18 | Affects multiple products; check the vendor advisory for your version |
| CVE-2025-61624 | Fortinet multiple products, path traversal | Oct 16 | Oct 19 | A 2025 identifier reaching the catalogue in October 2026 |
| CVE-2026-96951 | Microsoft Windows, command injection | Oct 13 | Oct 16 | Microsoft marked it exploitation detected on October 13 and CISA listed it the same day |
The three to act on are the backup server and the two remote access appliances. AhsayCBS matters out of proportion to its market share because the product sits in managed service provider estates, which means one compromised server reaches many downstream companies, and because a backup server is the asset an extortion crew most wants before it encrypts anything. The chain is already in use, the first patch failed, and the fix is a hotfix plus a reboot rather than a routine update. Ivanti Connect Secure matters because the chain works against fully patched devices and one flaw in it is still unfixed, so patching is necessary and not sufficient: hunt on those appliances rather than assuming the update closed the door. BeyondTrust Remote Support matters because a remote support tool is a legitimate route to every endpoint it manages, and self hosted customers were not covered by the October 8 SaaS fix.
Attribution accuracy note. None of this week's nine KEV additions is flagged for ransomware use, and we are not going to imply otherwise. Attribution to an extortion crew usually arrives weeks after exploitation begins, as happened with CVE-2026-0257, which sat unflagged through its first month and is now behind Qilin intrusions five months after its patch. Equally, six of this week's top ten groups have no verifiable access CVE: N0n, WallStreet, Orova, Everest, Play and IAH647. N0n's earlier activity is described as relying on stolen credentials and administrative tools rather than an identified encryptor, and no flaw has been named in the maritime campaign. Redact's route is reported as voice phishing, not an exploit. Where no named source supports an attribution, we leave the row out.
Infrastructure and Operational Shifts
One vendor can produce a sector's worth of victims. The maritime batch is the clearest example this series has carried. 38 organisations, 18 countries, one page, one day, and an interim analysis pointing at a single software provider that at least 21 of them share. Nothing about the shape of that event requires 38 intrusions, and the claimed data, EDI messages and container manifests and gate records, is exactly what a shared platform would hold. Third party risk registers that list a maritime software provider as "low criticality, no PII" are mispricing this. The data was not personal. It was operational, and for a port operator that is the more sensitive of the two.
Two crews, one victim, twice in one week. Taiwan Otsuka Pharmaceutical was listed by The Gentlemen and Eclipse on the same day. Ecuador's police appeared under HYFLOCK on October 12 and The Gentlemen on October 14. We count each organisation once per incident. For a defender the point is different: a second brand claiming your data is evidence that access or data moved between crews, which usually means more hands held it than the first listing suggested.
Six leak sites republished their own back catalogues this week. Termite, Pear, LeakNet, BlackNevas, Alpha Locker and MedusaLocker each reposted their existing victim lists in bulk on October 15 or October 18, 95 entries between them. The shape is unmistakable: the entries carry the site's index text rather than a company name, a bare URL, a bare domain, a blog headline, or a name with a status word bolted on. We checked them one at a time against each crew's earlier postings. In Pear's set, 17 of 17 were victims it first listed between July 15 and September 24, relabelled "LEAKED" once the data went up. Of Termite's, 14 resolve by domain to its own 2024 and 2025 victims, Blue Yonder among them. Counted as posted, those entries would have made this week 390 rather than 302, and they would have put a crew with no new activity into the top five. We count an incident once, in the week it first appeared. If you track these numbers from any public source, ask how a relisting is handled before you compare two weeks.
Named victim counts and anonymous slots now run side by side. N0n published 29 numbered slots, Company #63 to Company #92, inside the same week it published 38 named maritime firms. Anonymous slots pressure one company at a time: the victim knows which card is theirs and nobody else does. Named batches pressure a whole sector and generate press. Running both at once is a crew that has learned which tool each job needs, and it means public victim counts for N0n understate its activity by roughly a third.
The claim that the data is already sold. The Seven Deadly Sins' Canva listing states the data has been sold to a private buyer. We have seen variants of this three times in six weeks across different brands. It is worth recognising as a rhetorical move: it explains the absence of a sample, removes the deadline pressure the actor can no longer apply, and still damages the named company. It is not evidence of anything.
Key Takeaways for Defenders
If you move freight, map your maritime software exposure this week. Find out which terminal operating, port community and EDI platforms hold your shipment data, which of your logistics partners appear on N0n's list, and what your contracts say about incident notification from those vendors. The claimed data describes cargo, consignees and schedules, which has commercial value even with no personal data in it.
Patch the AhsayCBS hotfix, not the release. 10.3.4.0 did not fully fix CVE-2026-105133 and CVE-2026-105134. Install hotfix 10.3.4.45, reboot, and then check for JSP webshells and unexpected miner processes, because exploitation began October 7 and the window before the hotfix was three days wide. If you are an MSP, your customers inherit this.
Treat Ivanti Connect Secure as potentially compromised, not just unpatched. The reported chain reaches root on fully patched appliances and one flaw in it is still unfixed. Patch what is available, then hunt: review authentication logs for sessions from unfamiliar devices, check for unexpected files and processes on the appliance, and rotate credentials and sessions that touched it since at least October 3.
Patch self hosted BeyondTrust Remote Support now. The October 8 fix covered SaaS only. A remote support appliance is a legitimate path to every endpoint it manages, so treat a vulnerable version the same way you would treat an exposed domain controller.
Ask a listed supplier a specific question, in writing. Canva, Harness, Personify Health, iHeartJane, Telecom Egypt and the maritime platforms all hold customer data or sit inside customer systems. Ask each one you use whether your data is in scope, and note how quickly and how specifically they answer. Silence is itself information.
Check the date before you treat a listing as new. Relisted and re-read entries were a significant part of this week's raw volume. If your organisation's name reappears on a leak site, find the date of the original claim before you open a second incident.
Rotate what a patch does not. Session tokens, VPN credentials and backup server passwords captured before an upgrade keep working after it. For the Ivanti, Fortinet, Citrix, SonicWall and PAN-OS flaws above, invalidate sessions and reset local accounts as part of the change.
Most of that work is triage before it is defence. Somebody has to read the week's postings, set aside the relistings and the unverifiable, and work out which of the rest touch your organisation or your suppliers.
Where Scrutex Fits
Scrutex Threat Insights monitors ransomware leak sites and dark web sources continuously and maps what it finds against your own attack surface and your named suppliers, so a listing that names your domain or a vendor's domain reaches you as an alert and not as a line in a weekly roundup. Vulnerability Insights prioritises flaws like the edge and backup CVEs above by real world exploitability against your exposed assets, not by raw CVSS. Neither will tell you whether a claim is true. Both will tell you, quickly, whether it is about you.
Start at scrutex.ai/signup or read more at scrutex.ai/solution/threat.
Frequently Asked Questions
How many ransomware attacks were there in the week of October 12 to 18, 2026?
Scrutex tracked 302 unique victim postings across 50 active groups and 51 countries. That is up 57% from 192 for October 5 to 11. These are leak site postings, not confirmed compromises, and the underlying intrusion is usually 30 to 90 days older than the posting date.
Why did ransomware postings rise so sharply this week?
One crew, N0n, listed 38 maritime and logistics organisations in a single batch on October 12 and finished the week on 55 listings, against one the week before. Strip that out and the week still reads 247, up 29%, because 24 brands that posted nothing last week posted this week, among them WallStreet with 15, Orova with 11 and Play with 9.
Which ransomware group was most active?
N0n, with 55, ahead of The Gentlemen on 37 and Qilin on 29. N0n published 38 of its 55 in one batch on October 12. Qilin posted on every day of the week across 17 countries.
What happened to the 38 shipping and port companies?
N0n listed them together on October 12 with a deadline of October 19, claiming EDI messages, container manifests, vessel schedules and terminal configuration data. Analysts assess it as one shared system rather than 38 separate intrusions, and the maritime security firm Cydome has linked it to a South Korean maritime software provider whose customers include at least 21 of the 38. That link is one firm's analysis, no product or flaw has been named, and no victim had confirmed a compromise as of October 14.
Was Canva breached?
The Seven Deadly Sins listed Canva on October 15, claiming more than 200 million database rows and two million CRM records, and said the data had already been sold to a private buyer. No sample has been published and Canva has not confirmed this claim. A separate August incident involved a third party tool provider, and Canva stated then that its own platform was not compromised. We rate the current claim low confidence.
Did Eversource Energy, ONEOK or Parker-Hannifin suffer a ransomware attack?
A crew called Redact listed all three between October 12 and 16. Redact steals data without encrypting and is reported to gain access by voice phishing. None of the three has published a statement. Note that Parker-Hannifin was breached by Conti in 2022, a separate and unrelated event that still appears high in search results.
Which sectors were hit hardest?
Transportation and logistics led with 44, its first time in first place in this series, and 35 of those are the maritime batch. Business services followed on 42 and manufacturing on 41. Healthcare rose from 17 to 30 across 15 different crews.
Which CVEs should I patch this week?
CISA added nine exploited flaws between October 13 and 16, none flagged for ransomware use yet. The three with the most exploitation detail are the AhsayCBS backup server pair CVE-2026-105133 and CVE-2026-105134, where the vendor's first patch failed and hotfix 10.3.4.45 is required, Ivanti Connect Secure CVE-2026-104935, where a reported chain reaches root on fully patched appliances, and BeyondTrust Remote Support CVE-2026-102764, where self hosted installations were not covered by the October 8 SaaS fix.
Which CVEs are these groups exploiting?
Qilin and Settra use CVE-2026-0257 on PAN-OS GlobalProtect, The Gentlemen use CVE-2024-55591 on FortiOS and CVE-2023-27532 on Veeam, Akira uses CVE-2024-40766 on SonicWall, and DragonForce intrusions have been traced to CVE-2025-5777 on Citrix NetScaler. Six of this week's top ten groups have no verifiable access CVE, N0n among them.
Where can I get this in real time instead of weekly?
Scrutex Threat Insights monitors leak sites and dark web sources continuously and matches findings against your own asset inventory and your named suppliers, so a relevant listing reaches you when it is posted and not in the following Monday's roundup.
Related reading: Weekly Ransomware Intelligence Report, October 11, 2026 · Threat Insights · Vulnerability Insights