Purpose and Scope

This report summarizes the quantity of new ransomware samples collected, the number of compromised systems, and statistics on targeted businesses during the month of September 2026, as well as major Korean & global ransomware issues. The analysis is based on data collected through ATIP (AhnLab Threat Intelligence Platform) and AhnLab Smart Defense, as well as information posted on DLS (Dedicated Leak Sites, which disclose affected companies) by ransomware groups. Please note that the method for compiling statistics on targeted businesses was partially revised starting in February 2025; therefore, caution is advised when directly comparing these figures with past data.

Key Statistics

As of September 2026, the Information and communication sector had the highest number of incidents with 39, followed by Manufacturing with 29, Wholesale and distribution with 13, Professional, scientific, and technical services with 19, Health and social welfare services with 17, and Construction with 7. The top 10 industry sectors caused a total of 140 cases of damage. By region, the US had the highest number of incidents at 88, followed by India (IN) and Germany (DE) with 14 each, Canada (CA) with 8, France (FR) with 7, and Brazil (BR), Spain (ES), and South Korea (KR) with 6 each. The top 10 countries accounted for a total of 159 incidents of damage.

In terms of the number of affected companies by the top 10 ransomware groups, Gentlemen ranked first with 102 incidents, followed by the Qilin group in second place with 78 incidents. They were followed by Akira with 47 incidents, Rhysidaarchive with 45, Metaencryptor with 40, KillSecurity with 37, KryBit with 34, IncRansom with 31, SafePay with 29, and DarkProject with 27. The total number of incidents involving the top 10 groups was 470, an increase from 453 in the previous month. Over the past three years, the proportion of affected companies via DLS posts and systems affected by MDP-based attacks has fluctuated, but in September 2026, both metrics declined.

Major Issues

In September 2026, groups such as The Gentlemen, Qilin, Metaencryptor, CL0P, Storm, AUDIT TEAM, LockBit, EMPERADOR, and RansomHouse were active, and new groups like Vladivostok, Vexy, and BlackLocks also emerged. In the South Korean region, five companies in the manufacturing sector were identified as victims. The Gentlemen listed Wooshin Systems as a victim; LockBit listed SPG; Metaencryptor listed HyVision System and SFA Engineering Corporation; and BlackLock listed Gwangmyeong Industry. The domains gownet.Net and dg.Ac.Kr, posted by AUDIT TEAM, were not confirmed to be actual existing domains.

The Gentlemen targeted Aware and Veradigm in the US, Air Canada in Canada, the Japanese restaurant franchise Sarku Japan, TENTAC in Japan, and the Zanini Auto Group in Spain. Qilin targeted SK Logistics, Nissho Electric Manufacturing, Ikegami Tsushinki, and Mitsuwa Trading Co., Ltd. In Japan; ADM and Colonial Hyundai in the US; and the Philippine Ports Authority in the Philippines. Metaencryptor targeted HyVision System and SFA Engineering Corporation in South Korea; Astemo and Nippon Steel Corporation in Japan; and Flex Ltd. In the US.

CL0P revealed new DLS and onion domains after ShinyHunters compromised an existing DLS, and posted General Electric Company, Harley-Davidson, and TriStar Digital Thread Solutions in the US as Attack Targets. Storm targeted First Secure Bank Group, Applied Composites, five US financial and advisory institutions, and Petrocare in Canada. LockBit targeted SPG and Siinqee Bank; EMPERADOR targeted AB Electrolux and RDA MOTORS S.P.A.; RansomHouse targeted Pertamina, the Namibian Defense Force, and REXT Holdings Co., Ltd.; Everest attacked UNIRITA; SafePay attacked Ryomo Systems; and Rhysida attacked General Santos Doctors Hospital and Széchenyi Programiroda Nonprofit Kft.

Among the new groups, Vladivostok released a DLS and recruited collaborators, while Vexy attacked two companies in Ecuador and Brazil and began operating a RaaS affiliate program. BlackLock posted Gwangmyeong Industry as its first victim. Panzer claimed 19 victim organizations since its emergence in August and was reported to operate under a RaaS model offering builds for Windows, Linux, and VMware ESXi. SovCali shared 159 GB of design data for Lucid Motors’ next-generation midsize vehicle on Rehub.

In Japan, Keio Corporation, Keio Plaza Hotel, and Tottori Prefecture’s radiation monitoring system officially announced that they had suffered damage from ransomware. Keio reported disruptions to some of its business systems, while Tottori Prefecture stated that although the main monitoring station was shut down, the backup servers remained unaffected, allowing radiation monitoring to continue.

Conclusion

The ransomware threat landscape in September 2026 can be summarized as a complex mix of multinational attacks by established major groups, the continuous emergence of new groups, and the spread of DLS and RaaS partnership programs. The manufacturing sector suffered the most widespread damage, while attacks also continued in the information and communication, finance, government and public sectors, energy, transportation and logistics, and healthcare sectors. The report recommends the following measures: promptly applying Vulnerability Patches, reviewing third-party and supply chain access permissions, implementing network segmentation, strengthening data backups, utilizing threat intelligence, and enhancing continuous monitoring.