Newly observed ransomware groups drove almost all growth in public extortion claims during Q3 2026, according to external threat intelligence from ReliaQuest’s Threat Research team. However, researchers warned that rising leak-site listings do not prove a matching increase in successful attacks.
Organizations named on ransomware data-leak sites increased by 30% during the quarter. Forty-three groups posting for the first time accounted for 93% of that growth. Listings from groups active in both Q2 and Q3 increased by only 1%.
The findings concern third-party threats and the wider threat landscape, not vulnerabilities or incidents affecting ReliaQuest’s own systems.
Emerging Ransomware Gangs Dominate
Researchers assessed that newly observed groups could include genuine operations, rebrands, affiliate breakaways, and actors publishing recycled data or unsupported allegations. This makes verification more important than tracking victim totals alone.
Posting patterns highlighted the uncertainty. Global Secret Group listed 48 organizations, including 28 in one day. Another newcomer, crpx0, named 47 organizations, with 41 appearing on a single day, before stopping posts after August.
Such releases may reflect previously collected information rather than separate, recent intrusions. However, bulk posting alone does not prove fabrication.
Total number of organizations listed on data leak sites by sector, Q3 2026 (Source: reliaquest)
Storm listed 71 organizations across 20 days during August and September, exceeding DragonForce’s 69 and LockBit’s 62. Its appearance roughly five weeks after similarly named Stormous stopped posting raised an unconfirmed possibility of rebranding.
ExfilSquad illustrated why public claims require scrutiny. Its released JSON samples included employee names, email addresses, phone numbers, work locations, empty fields, and general customer relationship management information.
ReliaQuest assessed that the actor very likely searches GitHub for exposed credentials and retrieves information accessible through those accounts. The samples did not establish a broader network breach or tenant compromise.
Missed publication deadlines and listings without samples further weakened its claims, although neither observation ruled out unauthorized access.
Manufacturing listings rose 70%, narrowing the professional, scientific, and technical services sector’s lead from 420 organizations to 106. Nevertheless, that services sector remained first for the sixth consecutive quarter.
Qilin and The Gentlemen drove much of manufacturing’s increase. Their activity included exploiting internet-facing systems, using vulnerable drivers to disable endpoint detection and response tools, and changing Group Policy settings to distribute ransomware.
These techniques threaten organizations across industries, making exposure and security controls more useful risk measures than sector rankings, reliaquest said.
Geographic activity also shifted. US listings rose 9%, but approximately 85% of the global increase occurred elsewhere. The US share fell from 55% in Q1 to 49% in Q2 and 41% in Q3.
Defenders should validate claims using internal telemetry, access logs, and published samples. Investigations should establish what data was accessed, how access occurred, and whether evidence supports the actor’s account.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
Click Here For The Original Source.
——————————————————–
