# 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)

> Bitdefender reports 53 ransomware groups claimed US-based victims in January-February 2026 (roughly 750-800 US organizations hit), with seven groups — Qilin, Akira, Clop, INC Ransom, Play, DragonForce, and Sinobi — holding Top-10 rankings for four-plus consecutive months. The cohort is converging on credential/session-token theft over exploitation, AI-assisted automated exploitation (CyberStrikeAI), BYOVD tooling (EDRKillShifter, EDRSandblast, HRSword) to blind EDR, and living-off-the-cloud exfiltration via legitimate cloud/remote-access services.

- **Published:** 2026-08-23T00:00:00Z
- **Last reviewed:** 2026-08-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2125
- **ID:** TL-2026-2125
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Akira
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0257, CVE-2026-50751, CVE-2026-50752, CVE-2024-53704, CVE-2026-12569, CVE-2024-27198, CVE-2023-3519, CVE-2023-4966

## Description

Bitdefender's March 24, 2026 threat report documents a sustained ransomware surge against US organizations across January-February 2026, with 53 distinct ransomware groups claiming US-based victims and an estimated 750-800 US organizations compromised in the period. Seven groups — Qilin, Akira, Clop, INC Ransom, Play, DragonForce, and Sinobi — have held Top-10 activity rankings for over four consecutive months, reflecting a maturing ransomware-as-a-service (RaaS) ecosystem rather than a single campaign.

Across this cohort, Bitdefender identifies a shift to 'identity-first compromise': affiliates increasingly prioritize stealing browser session tokens, OAuth keys, and VPN/SSO credentials over active exploitation of vulnerabilities, because valid identity gives equivalent access with far less detection surface. Where exploitation is used, affiliates increasingly lean on automated PoC-to-exploit tooling — Bitdefender specifically calls out the open-source, AI-orchestrated CyberStrikeAI framework, which compressed the historical 2-3 day PoC-to-mass-exploitation window (2024-2025) down to a couple of hours or less. CyberStrikeAI was independently confirmed in a March 2026 campaign that compromised 600+ FortiGate firewalls across 55 countries, with researchers observing 21 unique operator IPs (China/Singapore/Hong Kong-hosted) running the tool between January 20 and February 26, 2026; it was developed by GitHub user Ed1s0nZ, who also authored the Go-based ransomware prototype banana_blackmail.

For defense evasion, the cohort is converging on BYOVD (Bring Your Own Vulnerable Driver) EDR-killer tooling — Bitdefender names EDRSandblast, HRSword, and EDRKillShifter specifically. EDRKillShifter was first deployed by RansomHub in August 2024 and has since been adopted by Play, Medusa, and BianLian, among others; it is a loader that drops and abuses a signed-but-vulnerable legitimate driver to terminate EDR/AV processes from kernel context. Bitdefender predicts BYOVD will appear in 75%+ of ransomware intrusions going forward. For exfiltration, groups are 'living off the cloud': repurposing legitimate cloud administrative functions (Box, AWS) and remote-access/file-transfer tools (Rclone, Proton Drive, FileZilla) to move stolen data out through channels that blend into normal SaaS/cloud traffic rather than deploying custom exfiltration malware.

Each of the seven named groups shows independently sourced, real-world confirmation of these patterns in 2026: Qilin (aka Agenda) affiliates exploited PAN-OS GlobalProtect authentication bypass CVE-2026-0257 (Arctic Wolf, intrusions investigated June 2026) and the critical Check Point Remote Access VPN/IKEv1 authentication bypass CVE-2026-50751 (CVSS 9.3, exploited in the wild from May 7, 2026, at least one incident attributed to a Qilin affiliate), alongside embedded Mimikatz LSASS/token theft, Chrome browser credential theft, PsExec/RDP lateral movement, Cobalt Strike C2, AnyDesk/Ngrok/LogMeIn remote access, Rclone/Proton Drive/FileZilla exfiltration, ransomware staging under C:\PerfLogs\, Windows event-log clearing, Defender real-time-protection disabling, and a distinctive registry persistence pattern (an asterisk followed by six randomized lowercase letters). Sinobi — a closed RaaS believed to be a rebrand/successor of Lynx (itself descended from INC) that grew from 40 claimed victims in September 2025 to 215+ by January 2026 — compromises SonicWall SSL VPN credentials via CVE-2024-53704 and encrypts with Curve-25519/AES-128-CTR. INC Ransom (900 cumulative leak-site victims as of August 17, 2026, 33 in the trailing 30 days) gains access via stolen/purchased credentials, RDP, and exploitation of Citrix NetScaler CVE-2023-3519 and 'Citrix Bleed' CVE-2023-4966, then uses PsExec/RDP for lateral movement, BYOVD for EDR evasion, Cobalt Strike/AnyDesk/ScreenConnect/TeamViewer for remote access, and password-protected-archive-then-Rclone for exfiltration. DragonForce operates a white-label RaaS 'cartel' (253 claimed H1-2026 victims, 590+ cumulative, a formal August 2025 LockBit cartel partnership taking a 20% cut) whose affiliates favor phishing/vishing credential theft, unpatched edge-device and RMM exploitation, brute-forced/stolen VPN credentials, SMB scanning, and wmic.exe-driven shadow-copy deletion, with a Conti-linked mutex observed in samples. Clop has pivoted to mass zero-day exploitation of PTC Windchill PDMLink/FlexPLM deserialization flaw CVE-2026-12569 (CVSS 9.8, exploited as a zero-day from early June 2026 per Ransom-ISAC, weeks before vendor patch) via a purpose-built Java web shell that decrypts credentials and enumerates repositories, claiming Shell, General Electric, and Philips among 43 victims in that campaign alone, and prioritizing data theft over encryption. Akira remains an FBI top-five most-investigated ransomware variant, subject of a joint CISA/FBI/DC3/HHS/Europol/France/Germany/Netherlands advisory (AA24-109A, originally April 18 2024, updated November 13 2025) designating it an imminent threat to critical infrastructure, with ties to Storm-1567/Howling Scorpius/Punk Spider/Gold Sahara and possible Conti lineage. Play (Playcrypt), subject of an updated June 4 2025 CISA/FBI/ASD advisory (AA23-352A) after 900+ victims since 2022, has also adopted EDRKillShifter-style BYOVD defense evasion.

Bitdefender notes construction as the single most-targeted sector, followed by manufacturing, technology, healthcare, and legal services, with technology-sector vendors specifically targeted as a pivot point into downstream financial-services, healthcare, and manufacturing customers (trusted-relationship/supply-chain targeting). The report forecasts continued expansion of ransomware-ecosystem specialization (dedicated IABs, pentesters, negotiators), rising targeting of edge devices/hypervisors/cloud services, and hacktivist-flavored extortion messaging tied to the Iran war backdrop.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566 Phishing
- T1199 Trusted Relationship
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1528 Steal Application Access Token
- T1021 Remote Services
- T1560 Archive Collected Data
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery

## Sources

- [Ransomware Attacks Targeting US Organizations 2026](https://www.bitdefender.com/en-us/blog/businessinsights/ransomware-attacks-targeting-us-organizations-2026)
- [#StopRansomware: Akira Ransomware (AA24-109A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [Updated Guidance on Play Ransomware](https://www.cisa.gov/news-events/alerts/2025/06/04/updated-guidance-play-ransomware)
- [Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access](https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html)
- [Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries](https://thehackernews.com/2026/03/open-source-cyberstrikeai-deployed-in.html)
- [Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)](https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/)
- [Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)](https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751/)
- [CVE-2026-50751: Check Point VPN Zero-Day Exploited by Qilin](https://thecybersecguru.com/news/cve-2026-50751-check-point-vpn-zero-day-qilin-ransomware/)
- [Emulating the Concealed Sinobi Ransomware](https://www.attackiq.com/2026/04/02/sinobi-ransomware/)
- [Sinobi: The bougie-exclusive ransomware group that wants to be a ninja](https://blog.barracuda.com/2025/11/17/sinobi--the-bougie-exclusive-ransomware-group-that-wants-to-be-a)
- [INC Ransom (threat group profile)](https://www.halcyon.ai/threat-group/inc-ransom)
- [Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data](https://thehackernews.com/2026/08/clop-linked-windchill-web-shell.html)
- [Clop Hacks Shell, GE, Philips in 43-Victim PTC Windchill Zero-Day Campaign](https://www.techtimes.com/articles/324578/20260815/clop-hacks-shell-ge-philips-43-victim-ptc-windchill-zero-day-campaign.htm)
- [54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security](https://thehackernews.com/2026/03/54-edr-killers-use-byovd-to-exploit-34.html)
- [How Ransomhub Ransomware Uses EDRKillShifter to Disable EDR and Antivirus Protections](https://www.trendmicro.com/en_us/research/24/i/how-ransomhub-ransomware-uses-edrkillshifter-to-disable-edr-and-.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2125