For enterprise IT services, ransomware is the type of "emergency call" we receive the most in these years. The data and methods in 2026 have changed significantly, and the direction of change is more unfavorable to enterprises:Attacks are more frequent, targets are more concentrated in manufacturing, methods are more subtle, and there is more data leakage in addition to ransom.
Latest data: two sets of authoritative statistics
Domestic calibre_Cyberspace Security Situation Analysis Report (2026) jointly issued by the National Computer Virus Emergency Response Center and several agencies (September 2,2026, the 4th Tianjin Forum on Cyberspace Security):
| index | data |
|---|---|
| statistical period | July 2025-June 2026 |
| Global extortion attacks | 8819 cases, up 40.1% year-on-year |
| Globally active extortion organizations | 118, of which the top five accounted for more than half of all attacks |
| Number of organizations attacking China | 44 extortion organizations attacked 164 institutions in our country |
| Year-on-year attacks on China | +76.7% |
| The worst affected industries | Computer, communication and other electronic equipment manufacturing |
international industrial calibreDragos, 2026 Q2 Industrial Ransomware Analysis:
| index | data |
|---|---|
| Q2 Industrial blackmail | 1140 from Q1 (1020 from Q1)+12% |
| proportion of manufacturing industry | 747 cases, accounting for 65%(Q1 is 62%) |
| ICS related organizations (engineering companies/system integrators/equipment manufacturers) | 117, the second affected industry |
| transportation and logistics | 95, third |
| Construction/Equipment manufacturing/Food and beverage | 176/ 114/ 70 |
| regional distribution | 514 in North America (431 in the United States, 38% globally), 316 in Europe and 172 in Asia |
| Germany has the largest increase. | Q1 37 → Q2 68, of which manufacturing accounted for 76% of victims in Germany |
| most active tissue | Qilin (140), Akira (129), The Gentlemen (125)--only 15 cases apart |
Why is manufacturing the number one target
Du Zhenhua, senior engineer of the National Computer Virus Emergency Response Center, explained it in place. Three reasons were superimposed:
- Highly dependent on Automation Operations Technology (OT).Prolonged production line downtime can result in huge losses, and the cost of a day's downtime can be millions-an attacker knows exactly what.
- Poor resistance to pressure to refuse to pay a ransom.Delays in delivery trigger contract penalties, customer churn, joint supply chain liability, and management has little choice between "paying" and "stopping."
- Insufficient investment in cybersecurity.Compared with the financial and Internet industries, the IT budget of manufacturing industry is low, ERP and MES servers in many factories are still running Windows Server 2012, and the external network exposure is large.
Dragos 'complementary observation is even more noteworthy:An attacker does not need to touch an industrial control system (ICS) to cause a shutdown.2026 Q2 did not observe any instances of ransomware reaching the second stage of the ICS network kill chain or directly manipulating control systems. All operational disruptions came from encrypted or preventively shut down enterprise IT systems (ERP, virtualization platforms, identity services, remote access gateways) on which OT depends.
Mackay Sugar, Australia's second-largest raw sugar producer, is a typical example: two of Queensland's three sugar mills were attacked on June 10 and stopped milling and sugar cane shipments, one of which resumed limited manual crushing two days later. The Gentleman group subsequently linked it to a leak site. Dragos investigation found thatAttackers never touch ICS or OT- The shutdown mainly affects enterprise IT.
The implications for small and medium-sized manufacturing enterprises are very direct:Don't think "our production equipment is isolated so safe", your ERP, file server, domain control is destroyed, production still stops.
Three changes in 2026
Change 1: From "encryption extortion" to "pure data theft"
Dragos makes it clear that the extortion model continues to shift from encryption to data theft-only. The impact of this shift on businesses is grossly underestimated:
- You may not even know you're being attacked.Without encryption, there are no obvious symptoms, and business goes on as usual until the data is posted on a compromised site or ransomware email is received.
- Recovery of the system does not equal the end of the risk.The logic of traditional encryption attack is "restore from backup", but under pure theft attack, the stolen employee information, customer information, supplier contract, financial data, process parameters have been in the external network, can be published, secondary extortion, be used for targeted fraud.
- Compliance responsibilities do not disappear just because the system is restored.Disclosure of personal information shall fulfill the obligation of notification according to regulations, and leakage of process data may involve infringement of trade secrets.
Change 2: Social workers switch from email to teams fake IT support
Dragos called it "the most consistent initial visit theme of the quarter," and the shift away from mail.Interactive impersonation on enterprise collaboration platforms:
- Attackers contacted employees via Microsoft Teams, claiming to be in-house IT support;
- Guide the target to a screen-sharing session;
- Instruct employees to install remote monitoring tools (AnyDesk, Quick Assist) during sharing;
- After obtaining the remote control right, he began to collect credentials and traverse the intranet.
The tactics also include registering credential collection domain names that are highly similar to the victim organization's naming rules, capturing passwords and MFA Captcha entered by employees.MFA is useless in this scenario-because the Captcha is given to the attacker by the employee himself.
Change 3: Physical intrusion is back
FBI warns in late May 2026 that Silent Ransom Group (aka Luna Moth) has begunSend someone into the office, masquerade as an IT technician, and plug the USB drive directly into the machine.
This is not a movie plot. If there are loopholes in the access control, visitor registration and outsourcing personnel management of the enterprise campus, it is completely feasible for a person wearing a tooling hanging badge to enter the office area and insert a few USB drives. The defense cost is extremely low (USB port control + visitor escort system), but most SMEs do not do it.
Chain of Attack Dismantling: How They Got In
Q2 mainstream TTPs (Tactical Technical Processes) summarized by Dragos:
| stage | main method | typical case |
|---|---|---|
| initial access | Exploit edge device vulnerabilities exposed to the Internet, remote management tools, stolen credentials, and valid account abuse | Qilin exploits Check Point remote access VPN authentication to bypass vulnerabilities, Palo Alto devices;Akira relies on compromised VPN devices (mostly legacy accounts without MFA);The Gentleman targets edge devices |
| Permission maintenance and traverse | Browser saved credentials harvest, disable terminal security tools, enterprise protocol traverse | Akira leaked data through legitimate file sharing services; in one case Akira entered the hypervisor and created a new virtual machine as a springboard to launch an attack |
| defense evasion | EDR-killer tool, BYOVD (comes with vulnerable driver)It's become routine. | DragonForce uses custom Go language RAT and exploits zero-day vulnerabilities driven by Huawei |
| influence | Encryption (partial) or pure data theft, double/triple extortion | Most outages come from limited encryption or preventive shutdowns |
A typical Akira intrusion forensics restore:Enter via a legacy VPN account without MFA → days of quiet credential theft → destroy backups → deploy ransomware last.The interval between invasion and outbreak may be one to two weeks, which is the only window for defenders.
Progress at the law enforcement level (good news)
- The international campaign destroyed First VPN anonymization, seizing 33 servers in 27 countries and identifying thousands of users.
- Operation Endgame hit SocGholish, Amadey, StealC malware families (these are "upstream vendors" that provide credentials and initial access to ransomware organizations) in mid-to-late June and recovered tens of millions of stolen credentials.
- Microsoft destroyed the Fox Tempest malware signature service-although Dragos observed that this had little impact on Qilin's overall activity, indicating that large mature alliance networks are resilient.
- Alarming trends: Blurring lines between criminal extortion organizations and state-sponsored activities. Dragos observed attackers linked to Iran's Ministry of Intelligence and Security using the Chaos brand to cover up their espionage activities.
Eight defense lists for SMEs
Do not pile up terms, sort by "input-output ratio", the first four spend small money to do big things:
| priority | measure | specific practice | cost |
|---|---|---|---|
| You must do it. | 1. Turn off unnecessary Internet exposure | VPN, Remote Desktop (RDP), Router/Firewall management port, NAS QuickConnect/Extranet access, Camera NVR public network mapping--count item by item, if you cannot expose it, you must not expose the restricted source IP | RMB 0 (configuration work) |
| You must do it. | 2. All Remote Access Mandatory MFA | VPN, mailbox, OA, cloud console all open multi-factor. Special attention:Clear legacy accounts(former employees, old suppliers, test accounts), Akira's main entry point is the legacy VPN account without MFA | RMB 0–500/year |
| You must do it. | 3. 3-2-1 backup and one offline | 3 data, 2 media, 1 offsite/offline.The key is "offline".--Attak actively destroys backups, networked backup disks and NAS snapshots are encrypted together. Periodically synced with removable hard drives and physically disconnected, or cloud backups with object lock (WORM) | RMB 1000–5000 |
| You must do it. | 4. Patches and firmware updates | Firmware for operating systems, VPN devices, firewalls, routers, switches-ransomware organizations exploit mainly public, patched vulnerabilities (Check Point VPN authentication bypasses these). Set a fixed monthly update window | RMB 0 (manpower) |
| Strongly recommended | 5. Employee Social Work Exercise | Focus on the new method of "claiming IT support requires screen sharing" on Teams/WeChat/nail, and establish an iron rule:IT departments will never ask employees to share screens or install remote tools via instant messagingAny such request must be verified by calling back a known number | RMB 0 (1 hour training) |
| Strongly recommended | 6. USB port control + guest escort | Group policies disable or restrict USB storage writes; outsourced/guest entries must be registered and accompanied by employees at all times; room and server rooms locked and entry and exit recorded | RMB 0–2000 |
| Strongly recommended | 7. Terminal Detection and Response (EDR) | Do not use only traditional antivirus software. Attackers routinely use EDR-killer and BYOVD, but installing EDR can at least increase the attack cost and probability of detection. Domestic EDR (Qianxin, Shenxin, AsiaInfo, Tinder Enterprise Edition) costs about RMB 100–300 per unit | RMB 3000–10000 per year (30 sets) |
| 🟢Do it again if you have the strength | 8. Network segmentation and minimum permissions | Office network, production network (OT), server network VLAN isolation; domain accounts according to the minimum authorization of the post, cancel "everyone is a local administrator"; file sharing according to the department set permissions, not all readable | Depending on the size, RMB 5000–50000 |
In case you're still hit: the right order of treatment
- Disconnect the network, but don't turn it off.Unplug the network cable/disconnect the Wi-Fi/switch port, isolate the infected machine. Do not shut down-there may be decryption keys, attack traces, process information in the memory, shutdown is gone.
- Don't pay the ransom, do the evaluation first.Payment does not guarantee access to decryption tools (historical statistics show that the percentage of full recovery after payment is less than 60%), and it will mark you as a "willing target" and invite secondary attacks. Also be clear:Even if the decryption is successful, the stolen data is still on the external network.
- Confirm the scope.How many machines are there, which servers, whether domain control and backup systems are touched, and whether there is evidence of data transmission (abnormal upload traffic, unknown external connection).
- Evaluate the recovery path.Priority: Recovery from offline backups Decrypted with family tools known to decrypt (No More Ransom projects have free tools) Professional data recovery Payment considered last.
- Beware of "decryption tools or proxy services" scams.The National Computer Virus Emergency Response Center clearly indicates that many of the so-called "ransomware decryption tools/proxy services" circulating on search engines and shopping platforms are secondary frauds. Suspicious files of unknown origin should not be opened directly, but uploaded to the National Computer Virus Collaborative Analysis Platform for detection.
- Compliance reporting.In case of disclosure of personal information, the obligation of notification and reporting shall be fulfilled according to regulations; disclosure of important data may need to be reported to the competent department.
- Double plate and fill gaps.Find the gateway (high probability is exposed VPN/RDP or phishing), make up and restore the service, otherwise it may be encrypted again on the day of recovery.
ACCPC provides enterprise network security services: exposed surface inventory and hardening, MFA deployment, 3-2-1 backup solution design and implementation (including offline backup and object locking cloud backup), EDR deployment and policy configuration, employee security awareness training, ransomware Incident Response Service (2 hours in Guangzhou), post-attack data recovery assessment. It also provides IT outsourcing annual fee service (RMB 1500–3000/month for less than 20 people, including unlimited remote support + monthly on-site inspection + Incident Response Service priority).A free exposure scan- -We scan your public IP from the external network and issue a report of "what the attacker can see" without charge. Phone020-39029800.