Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable Claims

Key facts for Q3 2026 ransomware leak-site surge

Detection coverage for Q3 2026 ransomware leak-site surge

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5226 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix-Style Stager from Explorer or crpx0 C2 Domain in Command Line (TL-2026-5226)

Detects PowerShell, mshta, cmd or curl launched directly by explorer.exe (the Win+R / Run-dialog pattern used by ClickFix) with download-and-execute, hidden-window or encoded-command content, and any command line referencing the crpx0 ClickFix C2 domains caribb.ru, mekhovaya-shuba.ru and beboss34.ru reported by KELA. Covers the phishing-delivered, user-executed initial-access stage described in TL-2026-5226, including mshta proxy execution of remote content.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1204.002, T1059.001, T1218.005
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*mshta.exe" OR Image="*cmd.exe" OR Image="*curl.exe") ParentImage="*explorer.exe"
| eval ioc_domain=if(match(CommandLine,"(?i)(caribb[.]ru|mekhovaya-shuba[.]ru|beboss34[.]ru)"),1,0)
| eval clickfix_stager=if(match(CommandLine,"(?i)(invoke-expression|iex |downloadstring|invoke-webrequest|iwr |irm |frombase64string|-enc |-encodedcommand|-w(indowstyle)? +hidden|mshta(.exe)? +https?://|curl(.exe)? .*https?://)"),1,0)
| where ioc_domain=1 OR clickfix_stager=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines max(ioc_domain) as ioc_domain_hit by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - ioc_domain_hit - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FileName in~ ('powershell.exe', 'pwsh.exe', 'mshta.exe', 'cmd.exe', 'curl.exe')
| extend IocDomain = ProcessCommandLine has_any ('caribb.ru', 'mekhovaya-shuba.ru', 'beboss34.ru')
| extend ClickFixStager = ProcessCommandLine matches regex '(?i)(invoke-expression|iex |downloadstring|invoke-webrequest|frombase64string|-enc |-encodedcommand|-w(indowstyle)? +hidden|mshta(.exe)? +https?://|curl(.exe)? .*https?://)'
| where IocDomain or ClickFixStager
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IocDomain, ClickFixStager
| order by Timestamp desc

Sigma

title: ClickFix-Style Stager Launched From Explorer or crpx0 C2 Domain in Command Line
id: 3b6f0a52-8d1e-4c47-9a63-5e2f7c1d4b90
status: experimental
description: Detects PowerShell, mshta, cmd or curl started by explorer.exe with download-and-execute, hidden-window or encoded content (Run-dialog ClickFix pattern), or any command line referencing the crpx0 ClickFix C2 domains reported by KELA.
references:
  - https://www.kelacyber.com/blog/crpx0-threat-actor-profile/
  - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\curl.exe'
  selection_stager:
    CommandLine|contains:
      - 'invoke-expression'
      - 'iex '
      - 'downloadstring'
      - 'invoke-webrequest'
      - 'frombase64string'
      - ' -enc '
      - '-encodedcommand'
      - ' hidden'
      - 'mshta.exe http'
  selection_ioc:
    CommandLine|contains:
      - 'caribb.ru'
      - 'mekhovaya-shuba.ru'
      - 'beboss34.ru'
  condition: (selection_parent and selection_image and selection_stager) or selection_ioc
falsepositives:
  - Administrators or helpdesk staff running one-off PowerShell one-liners from the Run dialog
  - Software installers that launch encoded PowerShell via explorer.exe
level: high

Known false positives:

• Administrators running legitimate one-line PowerShell from the Run dialog
• Software deployment or installer wrappers that use encoded PowerShell launched from explorer.exe

Tuning notes: Adjust the index name to your Sysmon index. Exclude known admin workstations and approved deployment tooling. The IOC-domain leg is high fidelity and should alert at all times; consider raising the behavioural leg to a risk score if it is noisy. Refresh the domain list as KELA/community reporting adds crpx0 infrastructure. Pair with mail-gateway telemetry for the phishing lure that precedes the Run-dialog paste.

• 🔒 Web Server Process Spawning Shell or Recon Binaries (Internet-Facing Exploitation) · unlock with TL Creds
• 🔒 BYOVD EDR Killer Activity (GentleKiller) and Security Product Tampering · unlock with TL Creds
• 🔒 Bulk Data Retrieval from Microsoft Dataverse / Power Pages Portal · unlock with TL Creds
• 🔒 GitHub Secret Exposure Signals (Credential Leakage Targeted for Valid-Account Access) · unlock with TL Creds
• 🔒 crpx0 Ransomware Encrypted File Extension ([indicator]), [indicator] Execution or Recovery Inhibition · unlock with TL Creds
• 🔒 Interactive Remote Logon from Public IP Address (Exposed RDP / Valid Account Abuse) · unlock with TL Creds
• 🔒 Group Policy Object Change or SYSVOL Payload Write Consistent with Ransomware Deployment (TL-2026-5226) · unlock with TL Creds
• 🔒 Data Exfiltration Staging and Tooling or crpx0 C2 / Tor Leak-Site DNS Activity (TL-2026-5226) · unlock with TL Creds

Indicators of compromise for Q3 2026 ransomware leak-site surge

As of 2026-11-04, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5226.

Sample indicators (3 of 19)

• Domain: caribb[.]ru
• Domain: mekhovaya-shuba[.]ru
• Domain: beboss34[.]ru

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Community OSINT corroboration for Q3 2026 ransomware leak-site surge

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Q3 2026 ransomware leak-site surge works

ReliaQuest's Q3 2026 ransomware report, as relayed by Cyber Security News on 2026-11-04, found a 30% quarter-over-quarter rise in organizations named on ransomware leak sites. Forty-three new groups accounted for 93% of the increase, while established groups added only about 1% more named victims. The US share of victims fell from 55% in Q1 to 49% in Q2 and 41% in Q3, with roughly 85% of new-group victims outside the US. Manufacturing victims rose 70%, and professional, scientific and technical services remained the top sector for a sixth consecutive quarter. Other vendors report similar record volume with different figures: GuidePoint GRIT counted 2,760 victims (up 21% from Q2, 75% year over year) across 112 active groups and 115 countries, with TheGentlemen (12.9%) and Qilin (12.6%) the top groups, and Comparitech counted 2,627 claimed attacks (up 27% from Q2). Counts differ by methodology and should not be compared directly.

The report stresses that leak-site listings are not proof of compromise. They mix genuine new attacks, rebrands (Storm is a possible rebrand of Stormous), recycled data and unproven claims. Examples cited include Global Secret Group (48 victims, 28 listed on one day), crpx0 (47 victims, 41 on one day, no postings since August), Storm (71 victims), and Orova (47 victims posted over 10 days). ExfilSquad, first seen July 2026, posted generic employee data (names, emails, phones, locations, often with empty fields) judged low-risk, listed targets without data samples, and set payment deadlines it did not follow through on. ReliaQuest assesses it likely scans GitHub for exposed credentials. Separate Resecurity reporting describes ExfilSquad as a pure data-theft and extortion operation that abuses misconfigured cloud and SaaS portals (Microsoft Dataverse, Power Pages, case-management and CRM platforms) and distributes stolen data through per-victim torrents with web seeds, a technique previously seen with LockBit 3.0 and Cl0p.

For established groups, the source describes Qilin and The Gentlemen as exploiting internet-facing systems, using vulnerable signed drivers to disable endpoint security (the GentleKiller tool is named for EDR process termination), and modifying Group Policy to spread ransomware. Qilin's manufacturing victims rose from 50 to 71 and The Gentlemen's from 49 to 74. DragonForce (69 victims) and LockBit (62 victims) are listed among established groups. Phishing against named employees is also cited as a common vector.

KELA profiles crpx0 as combining data theft, file encryption (.CRPx0 extension), cryptocurrency clipboard hijacking, seed-phrase theft and RaaS/HaaS offerings, with ClickFix stagers and C2 domains, and links it to the persona MrAnon00. A vendor briefing on Global Secret Group describes a RaaS model using VPN/gateway exploitation, exposed RDP, phishing and RMM abuse. That briefing is explicitly unverified and its CVE associations are speculative, so they are not recorded here as confirmed. The source article itself lists no CVEs, IP addresses or file hashes.

Defender takeaways: verify leak-site claims against internal logs and access records before assuming a breach, scan public code repositories for leaked credentials, patch and harden internet-facing systems, enable vulnerable-driver blocklists, and monitor Group Policy changes. BeaconBeagle correlation could not be performed because the API returned HTTP 502 during this run.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

defense-impairment

T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools

Collection

T1530 Data from Cloud Storage

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Exfiltration

T1567 Exfiltration Over Web Service

Reconnaissance

T1589.001 Gather Victim Identity Information: Credentials

Impact

T1657 Financial Theft

Remediation for Q3 2026 ransomware leak-site surge

Patches

• Apply vendor security updates to all internet-facing systems

Immediate actions

• Verify leak-site claims against internal logs, access records and data samples before declaring a breach
• Scan GitHub and other public repositories for exposed organizational credentials and rotate any found
• Review internet-facing VPN, gateway and RDP exposure and apply outstanding patches
• Audit Microsoft Dataverse and Power Pages portal permissions and anonymous access

Workarounds

• Restrict management interfaces and RDP from the internet
• Require MFA on all remote access and SaaS portals

Longer-term hardening

• Enable Microsoft vulnerable driver blocklist and HVCI to counter BYOVD EDR-killer tools such as GentleKiller
• Alert on Group Policy Object creation and modification outside change windows
• Run secret scanning and push protection across code repositories
• Train staff against phishing aimed at named employees
• Maintain tested offline backups and an incident-response playbook for extortion without encryption

Affected and fixed versions

• Microsoft — Dataverse / Power Pages portals
  Vulnerable versions: Misconfigured portals (ExfilSquad targeting per Resecurity)
• Multiple — Internet-facing systems, VPN/security gateways and RDP
  Vulnerable versions: Unpatched or exposed instances

Timeline of Q3 2026 ransomware leak-site surge

• 2025-07-01 KELA reports crpx0-related malware active since July 2025, well before the group's public emergence
• 2026-06-01 locked-ioc-16 publicly identified in June 2026 with fewer than ten claimed victims, mainly small healthcare and dental organizations
• 2026-07-01 locked-ioc-16 expands rapidly, reaching 47 claimed victims, 41 of them posted on a single day
• 2026-07-26 locked-ioc-10 surfaces with a Tor leak site claiming data theft from 15 organizations, without deploying encryptors
• 2026-08-04 locked-ioc-17 launches its leak site, immediately listing four Taiwanese companies; it later reaches 47 victims posted over 10 days
• 2026-08-07 locked-ioc-10 distributes stolen data via per-victim torrents and web seeds, with notable seeding activity from China and Russia hosts
• 2026-08-10 locked-ioc-3 posts three victims in 24 hours, two-thirds in financial services; claims unverified
• 2026-09-30 Q3 2026 closes with leak-site named organizations up 30%; 43 new groups account for 93% of the increase
• 2026-11-04 Cyber Security News publishes the ReliaQuest Q3 2026 findings warning that some listings may be fake or recycled

Sources cited for Q3 2026 ransomware leak-site surge

• ExfilSquad Adds New Victims and Uses Torrents to Publish Data Stolen from Cloud Portals thaicert.or.th · Advisory
• ReliaQuest Early Access Briefing: Ransomware Report Quarter Three reliaquest.com · Research
• GuidePoint GRIT Q3 2026 Ransomware & Cyber Threat Insights Report guidepointsecurity.com · Research
• KELA: crpx0 Threat Actor Profile kelacyber.com · Research
• Global Secret Group Ransomware: 3 New Victims in 24 Hours securityarsenal.com · Blog · 2026-08-10
• Ransomware Gangs Claim 30% More Victims, but Researchers Warn Some Breaches May Be Fake cybersecuritynews.com · News · 2026-11-04
• Q3 2026 Sets New Record for Ransomware Attacks infosecurity-magazine.com · News
• Report: Ransomware Attacks Hit a Record High in Q3 2026 blog.knowbe4.com · News

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Previous and next in ransomware

• Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP) Previous report
• LockBit Ransomware v4.0 (LockBitGreen4.0-rc-577) Reverse Engineering Analysis Next report

Further reading

• Edge RCEs: Cisco SD-WAN, Fortinet, NGINX, Exim