June 2026 Threat Trend Report on Ransomware
Purpose and Scope
This report summarizes the quantity of ransomware samples collected, the number of affected systems, statistics on targeted businesses, and major Korean & global issues during the month of June 2026. Statistics on targeted businesses were compiled based on information posted on DLS (Dedicated Leak Sites) operated by ransomware groups, which publish details of attacks.
Key Statistics
Affected Industries.
In June 2026, the Manufacturing sector had the highest number of incidents at 41. This was followed by Wholesale and distribution with 32 incidents, Information and communication with 31, Professional, scientific, and technical services with 16, and Health and social welfare services with 11. Incidents were also confirmed in the construction, Finance and insurance, education services, public administration and defense, and accommodation and food services sectors.
Affected Countries.
By country, the United States (US) had the highest number of incidents with 92. This was followed by Germany (DE) with 19, Canada (CA) with 18, Italy (IT) with 15 cases, the United Kingdom (GB) with 11 cases, India (IN) with 10 cases, Brazil (BR) with 10 cases, Thailand (TH) with 9 cases, Malaysia (MY) with 7 cases, and Japan (JP) with 6 cases.
Changes in Major Groups.
Among the top 10 groups, the Qilin group ranked first with 83 cases. DireWolf ranked second with 68 cases, and WorldLeaks ranked third with 52 cases. Akira (49 cases), LockBit5.0 (47 Cases), Nova (45 cases), Metaencryptor (31 cases), Play (31 cases), IncRansom (30 cases), and DragonForce (22 cases) followed. Qilin maintained high activity levels, while DireWolf and LockBit5.0 Rapidly rose to the top ranks in June.
Statistics on Ransomware DLS and Detection.
Over the past three years, the number of ransomware DLS incidents showed a gradual downward trend after increasing from January to March 2025, with a slight uptick in the most recent month. The number of ransomware detections declined gradually after March 2025, then began to rise after November 2025, and has shown a slight downward trend over the past month.
Major Issues
Activities of The Gentlemen, Qilin, LockBit 5.0, Nova, and others.
The Gentlemen claimed to have attacked multinational targets, including Spain’s Indra Group and Hong Kong’s Pou Sheng International (Holdings) Limited. Qilin targeted Musashino University, Lee International IP & Law, ISUZU MOTORS LIMITED, and the Central Bank of Libya. LockBit (LockBit 5.0) Published a list of numerous victims in Japan, Taiwan, and elsewhere, and shifted its data leak hosting infrastructure from fixed TOR domains to victim-specific non-fixed domains and private torrent methods. Nova was the attack target for the Kedah Darul Aman State Government and, in an unusual move, posted an apology to the Eriell Group.
ICARUS’s Supply Chain Attack.
ICARUS exploited Klue’s exposed credentials to steal OAuth tokens, which it then used to query the Salesforce REST API and exfiltrate large volumes of CRM data—including client sales contacts, consultation histories, quotes, and contract information. Numerous security and software companies, including Huntress, Recorded Future, Tanium, Jamf, Sprout Social, Gong, Insurity, and LastPass, were identified as affected organizations.
New Groups and Rebranding Trends.
New groups such as REDACT, Settra, Wallstreet, Prinz Eugen, SevyWare, and Booba Team have emerged. Booba Team is believed to be a rebranding of the Frag ransomware group and has posted Doosan Bobcat as a victim case. ShadowByt3$ announced its retirement and the closure of its data leak site.
Conclusion
The ransomware threat landscape in June 2026 is characterized by a complex mix of multinational attacks by major established groups, the continuous emergence of new groups, and data exfiltration targeting supply chains and SaaS-integrated environments. In South Korea, damage was confirmed across various sectors, including STNI, Lee International IP & Law, Bitek System Inc., KoMiCo. Ltd., Daechang Solution, and Doosan Bobcat.
