Ransomware, November 2026

Rising actorconfidence 100%

If the trend holds, more HYFLOCK claims are likely in the next 30 days, still concentrated in Technology. The baseline is only 8 claims from a zero base, so this is weak support.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

If claim volume continues to grow without sector resolution, Netrunner may be in a target-selection or tooling phase prior to a more visible campaign in the next 30-60 days.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

If the surge reflects an initial operational campaign, claim volume is likely to continue rising in the near term as newly active actors typically escalate before plateauing — watch for sector expansion beyond Technology.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

Further Shiba claims are likely in the near term, with healthcare and small or mid-size organisations the most probable targets. This is based only on the 0 to 5 jump in claims, so the call is tentative.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

If EndZone and eteam activity continues to escalate, BYOD-related incidents in Technology sector targets are likely to increase over the next 30 days, potentially spreading to adjacent sectors.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

Given the steep ramp from zero to 14 claims in a single month with no signs of slowdown, Lamashtu is likely to continue expanding victim count and sector breadth over the next 30 days, potentially moving further into Healthcare and Technology targets already connected in their network.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

Given the abrupt activation pattern and sector focus, UmBra is likely to continue targeting Technology organizations in the near term; further claims are probable if the operational tempo is sustained.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

If the surge is not an artifact, expect claim volume to grow or spread to adjacent sectors (e.g., logistics, industrial supply chain) within the next 30 days as the actor refines targeting.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

Given its association with active ransomware-as-a-service and extortion actors, EndZone is likely to accelerate claim volume in the next 30 days, with Technology sector organizations at elevated risk of targeting; BYOD environments flagged in its connections may be a preferred initial-access vector.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

Surging now: everstake

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

If this activation pattern holds, claim volume is likely to increase further in the next 30 days as the actor establishes operational tempo; Technology sector targets should anticipate continued or escalating activity.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

Surging now: THE SEVEN DEADLY SINS

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

If the trend continues, more Transportation-sector claims attributed to Whitearmor are likely over the next 30 days. The evidence is too thin to say anything about methods or scale.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 100%

If this trajectory holds, additional Healthcare sector victims are likely to surface via LeakBazaar or DragonForce-affiliated leak sites within the next 2-4 weeks given the established pipeline between these EcoActors.

Basis: window last 30d vs prior 60d (Signal live claims)

Watchconfidence 100%

If the current claim rate holds, emperador will surpass 70+ claims within the next 60 days and is likely to expand its entity connections further; early targeting patterns suggest cross-sector exposure including logistics and manufacturing verticals.

Basis: window first appeared <60d ago

Watchconfidence 100%

If claim volume continues at the current pace, ZaWoo is likely to expand targeting scope or escalate claim severity within the next 30-60 days as it seeks to build credibility.

Basis: window first appeared <60d ago

Watchconfidence 100%

If claim velocity continues at the current rate, majinahanashi will likely cross thresholds that trigger broader graph-propagation alerts within the next 30 days, warranting preemptive tracking.

Basis: window first appeared <60d ago

Watchconfidence 100%

If the current claim velocity holds, N0n could exceed 50 total claims within its first 90 days, elevating it from newcomer to established mid-tier threat actor and warranting escalated monitoring.

Basis: window first appeared <60d ago

Watchconfidence 100%

At the current claim velocity, Vexy is likely to surpass 30+ total victims within its first 90 days, and may attract affiliate recruitment or copycat activity if it maintains visibility.

Basis: window first appeared <60d ago

Watchconfidence 100%

Given the Qilin and Crystal Pharmatech associations, Eclipse is likely operating as an affiliate or sub-group rather than a fully independent actor; expect claim volume to accelerate if the pattern mirrors Qilin's historical ramp-up cadence.

Basis: window first appeared <60d ago

Rising actorconfidence 100%

Given the Snatch and Seven Seas Group connections and Transportation sector focus, Spirals is likely to continue targeting Transportation organizations in the near term, potentially escalating claim volume as it establishes its brand identity.

Basis: window last 30d vs prior 60d (Signal live claims)

Watchconfidence 100%

New entrant: Whitearmor

Basis: window first appeared <60d ago

Rising actorconfidence 98%

If the current rate holds, further claims are likely in the next 30 days, with Manufacturing still the most targeted sector. The evidence covers only a small number of claims, so this is a tentative call.

Basis: window last 30d vs prior 60d (Signal live claims)

Watchconfidence 98%

New entrant: iah6477

Basis: window first appeared <60d ago

Rising actorconfidence 97%

If the pace holds, expect more healthcare-sector claims attributed to Booba Project over the next 30 days. The evidence is limited to claim counts and entity links, so this is a trend extrapolation.

Basis: window last 30d vs prior 60d (Signal live claims)

Rising actorconfidence 95%

Surging now: Redact

Basis: window last 30d vs prior 60d (Signal live claims)

Likely next targetconfidence 95%

If the spike reflects a campaign pivot rather than isolated incidents, victim count in BG is likely to grow further over the next 30 days as attackers exploit established access or expand targeting within the region.

Likely next targetconfidence 95%

If the trend holds, victim counts in IL are likely to continue rising in the near term absent defensive intervention or campaign disruption, given the sharp acceleration rather than gradual growth.

Likely next targetconfidence 95%

If the trend continues, Malaysia may see further elevated victim counts next period. The evidence is too thin to call this a sustained campaign.

Likely next targetconfidence 95%

If the trend continues, expect further victim postings tied to EG over the next 30 days, but the low base means this could easily be noise.