Editor’s note: This report was authored by Tristano Di Liberto
This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest's own environment. Nothing in this report should be interpreted as a vulnerability in ReliaQuest's systems or data.
Key Points
It’s difficult to pull defensive lessons from Q3's ransomware data-leak-site growth, as almost all of it came from newly observed groups whose listings may mix new attacks, rebrands, recycled data and unsupported claims, so victim counts alone no longer show how many attacks happened.
Tracking only Q2’s leading groups would have missed nearly all of Q3's growth, because 93% of the increase came from groups with no prior history or indicators to prepare for.
Data posted by the “ExfilSquad” group didn’t substantiate the breach its leak-site implied, meaning organizations named in a post should check the claim against their own logs.
A few groups reshuffled sector rankings and most growth occurred outside the US, so a lower sector or country ranking doesn't mean lower risk. Build defenses on shared attacker techniques and actual exposure.
Ransomware leak-site activity grew in Q3 2026 but became harder to interpret. Victim counts are now an even less reliable measure of actual attacks, and tracking the quarter's leading groups, sectors, and countries no longer gives defenders the full picture. Organizations named in a post should check the claim against their own logs and data before acting on it.
Organizations named on data-leak sites rose 30%, but 43 groups that had never posted before Q3 drove 93% of that increase. It’s realistically possible their listings mix new attacks, rebrands, recycled data, and unsupported claims—posting patterns varied widely, from steady weekly listings to dozens dumped in a single day, and one group surfaced weeks after a similarly named group went quiet.
For example, a data set posted by "ExfilSquad" contained low-risk workforce and customer relationship details that looked like they likely came from exposed credentials, not a network breach. It didn't substantiate the implied breach or explain how the data was obtained.
This report covers:
Why new groups drove Q3's growth, why that growth is hard to interpret, and what it means for defenses built around known group names.
What ExfilSquad's leaked data did and didn't show, and how to assess a claim when your organization is named.
How a few groups narrowed the professional, scientific, and technical services (PSTS) sector’s lead over manufacturing, why most growth occurred outside the US, and why organizations in other sectors and countries shouldn't assume they're at lower risk.
Newly Observed Names Drove 93% of Q3's Growth
The 30% rise in organizations named on data-leak sites in Q3 is unlikely to reflect a real increase in ransomware activity. The growth was driven almost entirely by unverified new groups, several of which show signs of being rebrands, affiliate breakaways, or exaggerated claims rather than genuine new operations. Because leak-site data can't reliably confirm what's behind these new names, detection should be built around known ransomware behaviors—abuse of remote services, identity compromise, lateral movement, and data exfiltration—rather than tracked through leak-site headcounts.
Groups appearing for the first time in Q3 accounted for 93% of this quarter's uptick in named organizations. By contrast, organizations named by groups active in both Q2 and Q3 rose by only 1% (see Figure 1). Leak-site data has always been an unreliable measure of real ransomware activity, but this quarter's volume of new names makes Q3 especially hard to interpret. Our analysis indicates it’s a realistic possibility that some of this quarter's claimed attacks are false allegations.
Posting patterns among the new groups point in different directions.
Bulk releases indicate data likely compiled in advance, not real-time intrusions: Newcomer "Global Secret Group" listed 48 victims, 28 on a single day. Another new group, "crpx0," listed 47, including 41 on a single day, and hasn't posted since August. Bulk releases don't prove claims are recycled or fabricated, but they're likely more consistent with pre-collected data than a series of separate intrusions.
Figure 1: Percentage of the Q3 increase on victim count coming from new vs. established names
Steady posting looks more like an established operation. New group "Storm" listed 71 victims across 20 days (August–September)—more than established names "DragonForce" (69) and "LockBit" (62)—while newcomer "Orova" listed 47 victims over 10 days. But “Storm” first posted about five weeks after "Stormous," a similarly named group active since 2022, made its last post. The timing makes a rebrand a realistic possibility, though it's unconfirmed.
Leak-Site Growth Doesn’t Equate to Attack Growth
Leak-site posts from ExfilSquad look like real breaches, but our analysis indicates the group is likely an opportunistic credential-scraping actor dressing up limited access as a major breach to pressure targets. Each ExfilSquad claim should be verified against internal evidence before any response, treating the site's framing as pressure tactics, not proof.
Figure 2: Example of generic, null values in the public data released by ExfilSquad
ExfilSquad, an exfiltration-extortion name first seen in July 2026, released JSON samples that appeared to contain genuine workforce data—employee names, aliases, IDs, email addresses, phone numbers, and work locations—along with empty fields and general customer relationship management (CRM) details (see Figure 2). This is low-risk personally identifiable information (PII); the release doesn't confirm a broader network breach, tenant compromise, or monetization. ExfilSquad very likely scans GitHub for exposed credentials and takes only the data those accounts can reach, rather than breaking into networks.
ExfilSquad's leak site presents each listing as the result of a real breach. Its informational page claims it only publishes companies that "fail to meet an agreement," framing every post as the consequence of a missed payment (see Figure 3)—a framing designed to pressure named organizations into responding before verifying the claim, and to make the site look like an established extortion operation.
Figure 3 ExfilSquad data leak site informational page, claiming to publish companies that fail to meet an agreement.
The group has posted payment deadlines it didn't follow through on and, in some cases, listed targets without providing any data samples. That doesn't prove no breach occurred, but the available data never substantiated the implied breach or showed anything beyond limited access through exposed credentials.
ExfilSquad is likely an opportunistic actor using exposed credentials to reach limited data, then using a ransomware-style leak site to make that access look like a major breach. The most likely real-world impact is targeted phishing against named employees and the cost of responding to the claim, which is why each claim needs to be checked against internal evidence before any response, as covered below.
How Defenders Should Assess New Claims
When a newly observed name lists your organization, treat the post as an unverified claim. Let evidence from your own environment decide the response rather than the leak-site post or the name behind it. New names have little or no public reporting to check a claim against, so defenders need to answer three questions:
Was the named organization actually compromised?
Does the evidence support the actor’s account of how the data was obtained?
Does the name represent a distinct operation, a rebrand, an affiliate, or an opportunistic poster?
Acting on a false claim and dismissing a real one both carry serious consequences:
Acting on a false claim: An organization may make an unnecessary payment, fund future criminal activity, and waste investigative resources.
Dismissing a real claim: Exposed data may remain unaddressed and enable targeted phishing, account takeover, or further extortion of affected individuals.
When a claim surfaces, defenders should:
Validate the claim: Review internal telemetry, access logs, and posted data samples. If the evidence supports an intrusion, initiate the appropriate incident response measures; if it does not, keep the claim unverified while investigating other possible sources of exposure.
Characterize the activity: Identify the intrusion path, tools used, and data involved. These findings should determine containment and remediation priorities rather than the group’s claimed identity.
Track the identity: Record overlaps in TTPs and infrastructure with known groups. Consistent overlap may indicate a rebrand or affiliate relationship. No overlap should leave the actor unattributed until more evidence emerges.
Manufacturing’s Q3 Surge Was Not Yet a Lasting Shift
Manufacturing's Q3 surge was driven by two active groups in a single quarter, not a lasting change in which sectors ransomware targets. Exposed systems, security controls, and recovery readiness remain a better guide to ransomware risk than sector rankings.
Figure 4: Total number of organizations listed on data leak sites by sector, Q3 2026
Manufacturing victims named on data-leak sites grew by 70% in Q3, cutting PSTS lead from 420 victims to 106 (see Figure 4). But most of that change came from just two groups: "Qilin" (a ransomware-as-a-service [RaaS] operation) and "The Gentlemen" (an affiliate-driven operation). The Gentlemen's manufacturing victims rose from 49 to 74, and Qilin's from 50 to 71, together accounting for about a quarter of the sector's listed victims. PSTS remained the most targeted sector overall for the sixth consecutive quarter.
Operators for both groups exploited internet-facing systems, used vulnerable drivers to disable EDR tools, and changed Group Policy settings to push ransomware across a network. These techniques work against any industry, suggesting the leading groups attack wherever they can gain access rather than targeting primarily by sector.
Because a few groups drove the change in a single quarter, the ranking could reverse if their activity shifts. PSTS didn't become a lower-risk sector, and manufacturing didn't become a uniquely targeted one. Sector rankings say more about which groups are currently active than where the real risk lies.
US Activity Grew, but 85% of Q3’s Rise Occurred Elsewhere
Ransomware activity is becoming more geographically distributed. The US didn't become less of a target, but it accounted for only a small share of Q3's growth, so US-focused threat intelligence alone no longer gives a complete picture. Organizations with multi-country operations should assess regional ransomware activity directly rather than assume US trends represent the global landscape.
US victim listings increased by 9% while total listings increased by 30%—approximately 85% of the added victims were outside the US. The US share of all listed victims fell for the second consecutive quarter: from 55% in Q1, to 49% in Q2, to 41% in Q3 (see Figure 5). The US still leads in absolute victim count, but victims in other countries are growing faster.
Figure 5: US share of data leak site victims, Q1 vs. Q2 vs. Q3 2026
The growth outside the US shows ransomware activity is becoming more geographically distributed. Organizations operating across multiple countries should assess which ransomware groups and techniques are most active in each region where they have employees, systems, or data.
Organizations should apply consistent security standards across their global operations and supplement US-focused threat intelligence with regional reporting. Geographic risk assessments should reflect actual presence and exposure, not an assumption that US trends represent the global picture.
Expect Leak-Site Activity to Stay Fragmented in Q4
ReliaQuest assesses that most Q4 2026 leak-site growth will again come from outside the leading group names, sector, and country, even if the total number of victim listings changes. Q3 activity became less concentrated among the leading group names, sector and country. Established groups remained active but contributed little to the quarter’s net growth, PSTS declined in absolute terms, and US listings increased more slowly than listings elsewhere. We expect this broader distribution to continue in three ways:
The 11 most active ransomware groups will post fewer than half of all victims. New names drove nearly all Q3's growth, and we expect them to keep appearing and claiming victims in Q4, with some likely using recycled or fabricated data. This forecast assumes new names keep emerging, recently formed groups keep posting, and established groups don't sharply increase their activity—we consider any of those shifts unlikely.
PSTS will likely remain the top sector, but by a narrow margin. Manufacturing already outnumbered PSTS in July 2026, and it's a realistic possibility it will do so again in at least one month of Q4. Because the Q3 shift came from a few groups, it could widen or reverse depending on how their activity changes.
The US will remain below half of global victim listings. US listings increased in Q3, but approximately 85% of the quarter’s net growth occurred elsewhere. The US share is unlikely to return above 50% unless activity outside the country slows substantially or US listings begin growing much faster.
Step Up Your Defenses Against Ransomware
ReliaQuest's Approach
ReliaQuest GreyMatter® helps organizations reduce ransomware impact by improving detection speed, automating containment, and expanding visibility into external risk—capabilities that matter when newly observed names drive most of the growth, leak-site claims can't always be verified, and a few groups reshuffle sector rankings while most activity occurs outside the US.
GreyMatter Digital Risk Protection (DRP): Monitors the open, deep, and dark web for mentions of your organization and key vendors. When a new leak site names your organization, DRP alerts your team so it can investigate the claim before payment deadline pressure builds.
GreyMatter Intel: Tracks which ransomware and extortion groups are active in the sectors and countries where your organization operates, so defenders can see when a few groups shift the picture—as they did in manufacturing and outside the US in Q3—rather than relying on global rankings.
GreyMatter Agentic AI: Autonomously triages and correlates alerts tied to common ransomware techniques—exploitation of internet-facing edge devices, vulnerable driver loads used to disable EDR tools, and unexpected Group Policy changes used to deploy ransomware across a network—so defenders can detect and contain attacks regardless of which group or new name is behind them.
Pairing our detection rules with the following GreyMatter Automated Response Playbooks, organizations can contain ransomware threats in as little as five minutes.
Isolate Host: Cuts a compromised host off from critical resources before damage spreads, even when attackers have already disabled endpoint security tools.
Disable User: Revokes access to a compromised account, limiting further credential use and cutting off the foothold ransomware operators rely on for initial access and lateral movement.
Initiate Host Scan: Scans potentially affected hosts to confirm malicious artifacts and scope the compromise before encryption begins or an extortion claim is made.
Your Action Plan
These steps address the Q3 2026 shifts covered in this report.
Build detections around shared ransomware behaviors. Most of Q3's growth came from newly observed names with no history or public indicators, so detections tied to specific group names will lag. Prioritize coverage for abuse of external remote services, identity compromise, lateral movement, defense evasion, and data exfiltration—these techniques apply to any group, new or established.
Harden against the techniques leading groups share. The Gentlemen and Qilin drove most of manufacturing's Q3 growth, but the techniques they rely on work against organizations in any sector. Patch and monitor internet-facing edge devices, enforce Microsoft's vulnerable driver block list to counter EDR termination, and alert on unexpected Group Policy changes.
Verify leak-site claims and audit exposed SaaS platforms. As ExfilSquad showed, a leak-site post doesn't reveal how data was taken or whether a compromise happened at all. Monitor leak sites for your organization and key vendors, and confirm any claim with your own logs before responding. Audit GitHub and other code repositories for exposed credentials, API keys, and secrets; revoke and rotate any you find; and review CRM and portal access logs for unusual bulk reads or exports.
Build threat models for each country and sector where you operate. Use regional and sector trends as context, but don’t base the assessment around group names alone. Identify techniques shared by established and emerging groups, map these techniques to your exposure and security coverage, then prioritize gaps in prevention, detection and recovery. Apply consistent security standards across US and non-US environments.
Key Takeaways
Across Q3, leak-site metrics—rankings, posting volume, and named prominence—became less reliable as standalone measures of ransomware risk. Base defenses on actual exposure and verified capability, not on where a group, sector, or country sits on the leaderboard.
Q3 showed that newly observed names can gain victim share fast without demonstrating the capabilities of an established operation. Group rankings are becoming less reliable as standalone risk measures, and leak-site posting volume shouldn't be treated as confirmed intrusion volume.
ExfilSquad drew attention through numerous claims and recognizable victim names, but the available evidence didn't support the intrusion activity expected of a mature ransomware operation. A claim's significance depends on the evidence behind it, not the prominence of the name publishing it.
PSTS and the US stayed on top in Q3, but most of the quarter's growth happened elsewhere. The sector shift occurred within a single quarter and was driven by a handful of groups, so it may not last. The top three sectors' combined share held steady, meaning victims moved between leading sectors rather than spreading across many. The US share, by contrast, has now fallen for two straight quarters—making geographic spread the stronger trend to watch.
Either way, don't treat a lower sector or country ranking as lower risk. Base defenses on actual exposure, not where the leaderboard points.
