Threat Watch · Jul 10, 2026
⚠️ Data source note: in this run the RansomLook API (
/api/posts?days=1) was unreachable from the sandbox (network restricted, empty response); the RSS fallback did not yield real-time entries either. Below is a degraded view based on public reporting, not a real-time leak-site pull.
Overview
- Total new posts: N/A (real-time source unreachable)
- Groups involved: representative active groups listed below per public reporting
- Watchlist hits: 2 groups (Qilin, Akira) + watching The Gentlemen (newcomer, not yet on the watchlist)
Watchlist Hits (Priority)
| Group | Victim | Sector | Geo | Hit | Link |
|---|---|---|---|---|---|
| Akira | Wade's Dairy | Food/Manufacturing | US | group:akira | ransomware.live |
| Akira | RISE Architecture | Professional svc | US | group:akira | ransomware.live |
| Qilin | (ecosystem-dominant, multiple victims) | Multi-sector incl. healthcare | Global | group:qilin; sector:healthcare | ransomware.live |
All New Posts (public reporting, not a real-time pull)
| Group | Victim | Sector | Geo | Discovered | Link |
|---|---|---|---|---|---|
| Akira | Wade's Dairy | Food/Manufacturing | US | 2026-07-08 | ransomware.live |
| Akira | RISE Architecture | Professional svc | US | 2026-07-07 | ransomware.live |
Ecosystem Landscape (trailing 12 months, public statistics)
- Qilin: the most dominant RaaS, roughly 16% market share, with about 1,496victims over the past 12 months; roughly 1,871 tracked cumulatively. After the takedowns of LockBit and RansomHub, the ecosystem is re-concentrating around Qilin.
- Akira: about 1,357 cumulative victims; new victims still being listed in early July.
- RansomHub: about 842 cumulative; activity declining under law-enforcement pressure / internal strife.
- The Gentlemen(newcomer): briefly topped the chart in June 2026 with 115 victims, pushing Qilin (78 that month) off the top spot — worth adding to observation to judge whether this is a flash in the pan or a sustained rise.
Anomalies / Trend Notes
- New/rising groups: The Gentlemen surged to the top in a single month; keep tracking its TTPs and whether it is a rebrand of another group.
- Dormant-then-burst: none (real-time source unreachable, cannot judge for now).
- Single-day sector concentration: cannot be judged from real-time data; Qilin keeps sustained pressure on healthcare / critical infrastructure (watchlist sector hit).
Related Intelligence (same-day ransomware/AI crossover)
- CVE-2026-33825 "BlueHammer"(Microsoft Defender), confirmed by CISA as used in ransomware attacks — prioritize if your patch surface has not covered it.
- AI-driven extortion continues: JADEPUFFER (the first extortion executed end-to-end by an LLM agent) and in-browser AI-generated ransomware remain trend signals.
Sources: ransomware.live, Infosecurity Magazine, Computer Weekly, The Hacker News (BlueHammer), etc. For real-time leak-site data, refer to the RansomLook / ransomware.live websites.