IntelliOSRolling Intelligence|AIRolling Global Ransomware Watch

Global Ransomware Landscape Rolling Intelligence Card

This global rolling 90-day landscape card synthesizes ransomware research, public-disclosure datasets, operator activity, access methods, AI-enabled social engineering, identity exposure, cross-platform impact, and recovery implications across regions and organization sizes. It is the strategic ecosystem companion to the U.S. SMB card—not a second U.S. victim tracker. Source methodologies remain separate, its figures must not be added to the U.S. SMB claim population, and evidence leaves the card when it ages beyond the active window.

Coverage

Jul 30–Oct 27, 2026

Record Version

v23

Updated

Oct 26, 2026

AI Monitor

Weekly · Mon midday ET

Evidence

1 Retained Sources

Product

Rolling Intelligence Card

Classification

TLP:CLEAR

Reporting-Period Statistics

Rolling 90-Day Intelligence Snapshot

At-a-glance measures from the retained evidence set. Citations identify the source controlling each statistic.

Period Coverage

Jul 30, 2026–Oct 27, 2026

90 calendar days, inclusive. Records are included by their first-observed date inside this window; the period does not imply that every underlying incident began or was confirmed during it.

90-day windowWeekly on Monday at midday ET

Jul 30 · Window opensSep 12 · MidpointOct 27 · Latest included

100

percent

Published ransomware activity share

Share of Check Point’s June data-leak-site dataset. These are public extortion listings, not independently confirmed intrusions.Evidence dated Source date not published

The Gentlemen17%

Qilin11%

LockBit7%

Other listed groups65%

Evidence-Prioritized Access Paths

Top Initial Access & Account-Takeover Vectors

Current retained evidence places initial access across four separable lanes: edge and remote-access exposure, people/email interaction, valid identity abuse, and trusted provider or SaaS integration compromise. The sources do not assign one vector to every leak-site post or survey response; use the vectors to drive exposure review and hunting.

People-led access

Malicious email, phishing, and malicious linksEvidence dated Source date not published

Survey-backed current control priority; not assigned to every named victim

How it starts: A user interacts with a convincing email, link, impersonation, or AI-enhanced lure.
Attacker outcome: Credential theft, remote-session creation, data access, or first-stage execution before ransomware or extortion pressure.
What to monitor: URL clicks, phishing reports, suspicious downloads, new remote tools, mail-rule changes, impossible travel, and rapid access to sensitive data.

Identity-led access

Compromised credentials and MFA coverage gapsEvidence dated Source date not published

Survey and incident-response priority

How it starts: Credentials, sessions, tokens, or under-protected accounts provide valid access to SaaS, VPN, firewall admin, or legacy applications.
Attacker outcome: Trusted login, privilege escalation, lateral movement, data theft, and faster time to impact.
What to monitor: Dormant-account use, MFA changes, new tokens, device-code flows, service-account anomalies, and session revocation failures.

Externally reachable control plane

Internet-facing edge and remote-access exposure[11]Evidence dated Source date not published

Research-backed and case-backed exposure path

How it starts: A firewall, VPN, gateway, remote-support tool, or related edge system is exploited, misconfigured, deprecated, or accessed with exposed credentials.
Attacker outcome: Network foothold, credential theft, provider access, ransomware staging, or customer-environment reach.
What to monitor: KEV and critical exposure, unknown admin logins, appliance-originated connections, configuration theft, credential reuse, and post-remediation exposure scans.

Third-party and connected-app access

Trusted provider, SaaS, OAuth, and API integration abuse[11]Evidence dated Source date not published

Source-backed campaign and operating-context priority

How it starts: Stolen provider information, OAuth tokens, API keys, or connected-app credentials are reused against customer or SaaS environments.
Attacker outcome: Data theft or extortion can bypass several traditional network stages by entering through a trusted integration.
What to monitor: Connected-app changes, unusual API activity, customer data access, provider notices, Salesforce or SharePoint bulk access, and cross-tenant anomalies.

Vector / Evidence	How It Starts	Attacker Outcome	What to Monitor
1 People-led access Malicious email, phishing, and malicious linksEvidence dated Source date not published Survey-backed current control priority; not assigned to every named victim	A user interacts with a convincing email, link, impersonation, or AI-enhanced lure.	Credential theft, remote-session creation, data access, or first-stage execution before ransomware or extortion pressure.	URL clicks, phishing reports, suspicious downloads, new remote tools, mail-rule changes, impossible travel, and rapid access to sensitive data.
2 Identity-led access Compromised credentials and MFA coverage gapsEvidence dated Source date not published Survey and incident-response priority	Credentials, sessions, tokens, or under-protected accounts provide valid access to SaaS, VPN, firewall admin, or legacy applications.	Trusted login, privilege escalation, lateral movement, data theft, and faster time to impact.	Dormant-account use, MFA changes, new tokens, device-code flows, service-account anomalies, and session revocation failures.
3 Externally reachable control plane Internet-facing edge and remote-access exposure[11]Evidence dated Source date not published Research-backed and case-backed exposure path	A firewall, VPN, gateway, remote-support tool, or related edge system is exploited, misconfigured, deprecated, or accessed with exposed credentials.	Network foothold, credential theft, provider access, ransomware staging, or customer-environment reach.	KEV and critical exposure, unknown admin logins, appliance-originated connections, configuration theft, credential reuse, and post-remediation exposure scans.
4 Third-party and connected-app access Trusted provider, SaaS, OAuth, and API integration abuse[11]Evidence dated Source date not published Source-backed campaign and operating-context priority	Stolen provider information, OAuth tokens, API keys, or connected-app credentials are reused against customer or SaaS environments.	Data theft or extortion can bypass several traditional network stages by entering through a trusted integration.	Connected-app changes, unusual API activity, customer data access, provider notices, Salesforce or SharePoint bulk access, and cross-tenant anomalies.

Intended Reader and Decision Context

Persona / Audience

Who this brief is written for, the geographic and organizational lens it uses, and how readers should apply the intelligence.

Audience Field	Assessment
Audience fieldPrimary audience	AssessmentExecutives, boards, CISOs, CIOs, security and IT leaders, incident-response owners, business-continuity leaders, and cyber-insurance stakeholders who need a decision-ready ransomware view.
Audience fieldOrganization profile	AssessmentA global, cross-industry ecosystem view for enterprises, managed service providers, healthcare, education, manufacturing, professional services, and organizations dependent on virtualization or shared service providers. U.S. SMB-specific claim concentration and firmographic limits belong in the companion U.S. SMB card.
Audience fieldDecision perspective	AssessmentUse the brief to decide which edge systems and identities require immediate review, when suspicious activity becomes an incident, whether recovery systems can withstand attack, and which third-party relationships expand the investigation.
Audience fieldEvidence posture	AssessmentLeak-site listings and actor claims are treated as directional intelligence. Local logs, forensic evidence, victim disclosure, or authoritative incident reporting are required before asserting that a specific organization was compromised.

Executive Briefing Priorities

Top 10 Briefing Points

1
Q1 2026 ransomware activity — Aggregate metrics reported for Q1 2026 including payments and tactic frequencies (Coveware - 2026, p.9-12, p.18-19).[11]Evidence dated Source date not published

Automation Transparency

AI Agent Run Status

Agent	Ransomware Rolling Intelligence Card Publisher
Status	Active · rolling 90-day automation
Cadence	Weekly on Monday at midday ET; publish only when retained evidence materially changes the card
Previous run	No completed run is retained within the active rolling window · Run Not available
Previous result	The previous recorded run is outside the current 90-day coverage window and is not displayed.
What the previous run found	•No qualifying run findings are retained within the active rolling window.
Next run	At midday ET on the card's configured weekly review day.
Sources monitored	•Check Point Research ransomware reporting •BlackFog ransomware reporting •Black Kite ransomware reports •Sophos State of Ransomware and incident-response research •Proofpoint ransomware, AI-era, and human-risk research •At-Bay incident-response casework •LevelBlue frontline TTP briefings •Arete crimeware and ransomware research •Unit 42 ransomware research •CISA/FBI/DOJ/Europol official ransomware and cybercrime material •Ransomware ecosystem and actor source tracker •Structured report events •PETRA report database •Connected IntelliOS actor and campaign records •PETRA report database query constrained to the active rolling 90-day publication window; older reports remain discovery-only
Publication and alert policy	Publish and alert only for a material source-backed change; do not notify for no-change checks or date-only rolling-window movement.

Related Intelligence and CARDS Records

Other IntelliOS Products

Rolling Intelligence

U.S. SMB Ransomware Activity & Exposure Trends

Companion quantitative view of reconciled U.S. claim concentration, canonical actor alignment, SMB evidence limits, and practical controls. Its totals must remain separate from this global landscape synthesis.

Open product

PANDA Sector Brief

Ransomware Targeting U.S. SMBs

Sector and business-risk analysis for small and midsize U.S. organizations.

Open product

CARDS Actor Record