The number of organizations named on ransomware leak sites rose 30% in the third quarter of 2026. Researchers say that does not mean attacks rose by the same amount. Most of the growth came from new, unproven groups, and some of their claims may be false.
Leak sites are where ransomware gangs post the names of victims to pressure them into paying. Defenders have long used these posts to count attacks.
Fake or recycled claims are not new, and a past case of fake extortion demands showed that old data can be passed off as a fresh breach. This quarter the problem looks larger.
Analysts at ReliaQuest noted that 43 groups that had never posted before Q3 drove 93% of the increase. Groups active in both Q2 and Q3 added only 1% more named organizations.
The team said it is realistic that some claimed attacks are false allegations. It also said the listings likely mix new attacks, rebrands, recycled data and claims with no proof behind them.
Ransomware Gangs Claim 30% More Victims
The posting patterns of the new groups differ a lot. Some post steadily every week. Others dump dozens of names at once.
A group called “Global Secret Group” listed 48 victims, 28 of them on one day. Another, “crpx0,” listed 47 victims, 41 on a single day, and has not posted since August.
Researchers say bulk releases do not prove the claims are fake. They fit better with data collected in advance than with many separate break-ins.
Example of generic, null values in the public data released by ExfilSquad (Source – Reliaquest)
Other new groups look more like real operations. “Storm” listed 71 victims over 20 days, more than established names like DragonForce (69) and LockBit (62).
But Storm first posted about five weeks after a similarly named group, “Stormous,” made its last post. That timing makes a rebrand possible, though it is unconfirmed.
The clearest example of a doubtful claim is “ExfilSquad,” first seen in July 2026. It released data samples with employee names, email addresses, phone numbers and work locations, plus empty fields and basic customer relationship details.
ReliaQuest says this is low-risk personal data. It does not prove a network breach. The group likely scans GitHub for exposed credentials and takes only what those accounts can reach.
It then uses a ransomware-style leak site to make that limited access look like a major breach. It also posted payment deadlines it did not follow through on, and it listed some targets with no data samples.
The likely real harm is targeted phishing against the named employees, plus the cost of investigating the claim. That is why researchers advise treating each post as an unverified claim.
Recent cases show the same caution, such as the Emperador ransomware group claim against AB InBev, which stayed unverified with no company confirmation.
What Defenders Should Do When Named
When a new group lists your organization, check three things. Was the organization really compromised? Does the evidence match how the group says it got the data? Is the name a distinct group, a rebrand, an affiliate or an opportunistic poster? Paying on a false claim wastes money and funds crime.
Ignoring a real claim can leave exposed data open to phishing and account takeover. ReliaQuest advises teams to review internal logs, access records and any posted samples. If the evidence shows an intrusion, start incident response.
If it does not, keep the claim marked unverified while looking for other sources of exposure. Teams should also record overlaps in tools and infrastructure with known groups, which can point to a rebrand.
ExfilSquad data leak site informational page (Source – Reliaquest)
Because new names have no history or public indicators, detection should focus on shared behavior. That means abuse of remote services, stolen identities, lateral movement and data theft.
Established groups like Qilin and The Gentlemen show why. Both exploited internet-facing systems, used vulnerable drivers to disable endpoint security tools, and changed Group Policy settings to spread ransomware.
Together they drove about a quarter of listed manufacturing victims. Our earlier look at The Gentlemen ransomware group covers how this affiliate-driven crew grew so fast.
Defenders can block much of this activity. They should patch and monitor edge devices, enforce Microsoft’s vulnerable driver block list, and alert on unexpected Group Policy changes.
The GentleKiller vulnerable driver tool shows how attackers use signed but flawed drivers to shut down security software.
Teams should also audit GitHub and other code repositories for exposed keys and passwords, rotate any they find, and review customer system logs for unusual bulk downloads.
The data also shows ransomware spreading beyond the US. US listings grew 9%, and about 85% of the added victims were elsewhere.
The US share of all listed victims fell from 55% in Q1 to 49% in Q2 and 41% in Q3. Manufacturing victims rose 70%, but professional, scientific and technical services stayed the top sector for the sixth quarter in a row. A lower ranking does not mean lower risk.
Indicators of compromise (IoCs):-
TypeIndicatorContext from sourceGroup nameExfilSquadFirst seen July 2026; likely uses exposed GitHub credentials to take limited dataGroup nameGlobal Secret GroupListed 48 victims, 28 on one dayGroup namecrpx0Listed 47 victims, 41 on one day; no posts since AugustGroup nameStormListed 71 victims over 20 days; possible link to StormousGroup nameOrovaListed 47 victims over 10 daysGroup nameQilinRaaS group; manufacturing victims rose from 50 to 71Group nameThe GentlemenAffiliate-driven; manufacturing victims rose from 49 to 74Hashes / IPs / DomainsNone publishedNot provided in the source
Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
Click Here For The Original Source.
——————————————————–
