Ransomware is the call we get most from enterprise IT. In 2026 the numbers worsened and the playbook shifted: more attacks, more manufacturing victims, quieter entry, and data theft on top of the ransom.
The latest numbers: two authoritative datasets
The National Computer Virus Emergency Response Center and partner agencies published the Cyberspace Security Situation Analysis Report (2026) on September 2, 2026, at the fourth Tianjin Cyberspace Security Forum. It covers July 2025 to June 2026.
| Indicator | Figure |
|---|---|
| Global extortion attacks | 8,819, up 40.1% year on year |
| Active groups | 118; the top five account for over half of all attacks |
| Groups attacking China | 44 groups, 164 institutions |
| Attacks on China, year on year | +76.7% |
| Worst-hit sector | Computer, communications and electronics manufacturing |
Dragos's Q2 2026 Industrial Ransomware Analysis covers the industrial side.
| Indicator | Figure |
|---|---|
| Industrial cases, Q2 | 1,140, up 12% from 1,020 in Q1 |
| Manufacturing share | 747 cases, 65% (62% in Q1) |
| ICS-related firms | 117, second most affected |
| Transportation and logistics | 95, third |
| Construction / equipment / food and beverage | 176 / 114 / 70 |
| Regions | North America 514 (US 431), Europe 316, Asia 172 |
| Fastest growth | Germany, 37 to 68 cases; manufacturing is 76% of its victims |
| Most active groups | Qilin 140, Akira 129, The Gentlemen 125 |
Why manufacturing is target number one
Du Zhenhua, a senior engineer at the center, cites three factors:
- OT dependence. A day of downtime can cost millions of RMB, and the attackers know it.
- No room to refuse. Late delivery means penalties, lost customers and supply-chain liability, so management has little choice between paying and stopping.
- Thin budgets. Many plants still run ERP and MES on Windows Server 2012, with wide internet exposure.
Dragos adds the point that matters most: an attacker does not need to touch the ICS. In Q2 2026 it saw no case of ransomware reaching the second stage of the ICS kill chain or manipulating control systems. Every outage traced back to enterprise IT being encrypted or shut down as a precaution: ERP, virtualization, identity, remote access. OT runs on those systems.
Mackay Sugar, Australia's second-largest raw sugar producer, is the textbook case. Two of its three Queensland mills were hit on June 10 and stopped milling; one resumed limited manual crushing two days later. The Gentlemen listed it, and Dragos found the attackers never touched ICS or OT.
Isolated production equipment does not make you safe: take out ERP, the file server and the domain controller, and production stops anyway.
Three changes in 2026
Change one: from encryption to pure data theft
Dragos is explicit that the model keeps shifting from encryption to pure data theft. The consequences are underestimated:
- You may never notice. No encryption means no obvious symptom; business runs as usual until the data appears on a leak site.
- Restoring does not end the risk. Employee records, contracts, financials and process parameters are already outside, ready for a second extortion.
- Compliance duties survive. A personal-data breach triggers notification duties; leaked process data can be trade-secret infringement.
Change two: social engineering moves from email to Teams
Dragos calls it the quarter's most consistent initial-access theme, now off email:
- They contact an employee on Teams, posing as internal IT support.
- Steer them into a screen share, then talk them through installing AnyDesk or Quick Assist.
- With remote control, harvest credentials and cross the network.
Some also register credential-harvesting domains that mimic the victim's naming and capture the passwords and MFA codes employees type in. MFA is useless here, because the employee hands over the code.
Change three: physical intrusion is back
The FBI warned in late May 2026 that the Silent Ransom Group, also known as Luna Moth, had begun sending people into offices posing as IT technicians to plug USB drives into machines. Where badge control or visitor logs have gaps, that is easy to pull off. The defense is cheap, USB port controls plus a visitor escort, and most SMEs skip it.
The attack chain: how they get in
| Stage | Main methods | Typical case |
|---|---|---|
| Initial access | Edge-device flaws, remote management tools, stolen or valid credentials | Qilin exploits a Check Point VPN auth bypass; Akira uses compromised VPN devices, mostly legacy accounts without MFA |
| Lateral movement | Browser-saved credentials, endpoint security disabled, protocol traversal | Akira exfiltrated through legitimate file-sharing; one case used a hypervisor VM as a springboard |
| Evasion | EDR-killers and BYOVD, bringing your own vulnerable driver | DragonForce used a custom Go RAT and a Huawei driver zero-day |
| Impact | Partial encryption or pure theft, double and triple extortion | Most outages came from limited encryption or preventive shutdowns |
A reconstructed Akira intrusion: in through a legacy VPN account with no MFA, days of quiet credential theft, backups destroyed, then the ransomware. That week or two is the defender's only window.
Law enforcement progress
- An international operation took down the First VPN anonymization service, seizing 33 servers in 27 countries.
- Operation Endgame hit SocGholish, Amadey and StealC, the credential suppliers upstream of ransomware, in June; tens of millions of credentials were recovered.
- Microsoft took down the Fox Tempest signing service, with little effect on Qilin, and the line between criminal and state-backed work is blurring: Dragos saw Iran-linked actors using the Chaos brand.
Eight defenses for an SME
Ordered by return on effort; the first four do most of the work.
| Priority | Measure | In practice | Cost |
|---|---|---|---|
| Must do | 1. Close needless exposure | VPN, RDP, router and firewall admin ports, NAS QuickConnect, NVR forwarding. Close what can be closed | RMB 0 |
| Must do | 2. MFA everywhere | VPN, email, OA, cloud consoles; clear legacy accounts, Akira's favorite door | RMB 0–500 a year |
| Must do | 3. 3-2-1 backup, one copy offline | Networked backup disks and NAS snapshots get encrypted too. Use removable drives or WORM cloud | RMB 1,000–5,000 |
| Must do | 4. Patch and update firmware | OS, VPN appliances, firewalls, switches. Most exploits are public, patched flaws; set a monthly window | RMB 0 |
| Strongly advised | 5. Social-engineering drills | Teach the screen-share play. IT never asks over chat; verify by callback | RMB 0 |
| Strongly advised | 6. USB control, visitor escorts | Block or limit USB writes; register and escort visitors; lock the server room | RMB 0–2,000 |
| Strongly advised | 7. Endpoint detection and response | Antivirus alone is not enough. Domestic EDR is RMB 100–300 per seat a year | RMB 3,000–10,000 a year for 30 seats |
| When you can | 8. Segmentation, least privilege | Separate office, OT and server VLANs; minimum domain rights | RMB 5,000–50,000 |
If you are hit anyway
- Disconnect, do not power off. Memory may hold keys and traces, and a shutdown loses them.
- Do not pay yet. A decryptor is never guaranteed, fewer than 60% fully recover, and payment marks you as a payer and a target.
- Map the scope. Machines, servers, domain controller, backups, suspicious outbound uploads.
- Pick a recovery path. Offline backup, a known family tool (No More Ransom is free), professional recovery, payment last.
- Ignore decryptor offers. The national center warns that most decryptor tools and recovery agents sold on search engines and shopping sites are follow-on scams.
- Report. Personal-data breaches carry notification duties; important-data leaks may need regulator notice.
- Close the hole. Find the entry point, usually an exposed VPN or RDP service or phishing, and fix it before restoring service.
ACCPC handles the practical side: exposure inventory, MFA rollout, 3-2-1 backup design, EDR deployment, staff training, incident response (on site in Guangzhou within two hours) and recovery assessment. IT outsourcing starts at RMB 1,500–3,000 a month for under 20 people, and we scan public IPs and report what an attacker can see, free. Call 020-39029800.