# Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable Claims

> Organizations named on ransomware leak sites rose 30% in Q3 2026, with 43 new groups accounting for 93% of the increase (ReliaQuest). Listings mix new attacks, rebrands, recycled data and unproven claims; ExfilSquad is a data-extortion crew that does not deploy encryptors, and ReliaQuest assesses it likely scans GitHub for exposed credentials rather than conducting genuine network breaches.

- **Published:** 2026-11-04T10:12:52Z
- **Last reviewed:** 2026-11-04T10:12:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5226
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5226.png
- **ID:** TL-2026-5226
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

ReliaQuest's Q3 2026 ransomware report, as relayed by Cyber Security News on 2026-11-04, found a 30% quarter-over-quarter rise in organizations named on ransomware leak sites. Forty-three new groups accounted for 93% of the increase, while established groups added only about 1% more named victims. The US share of victims fell from 55% in Q1 to 49% in Q2 and 41% in Q3, with roughly 85% of new-group victims outside the US. Manufacturing victims rose 70%, and professional, scientific and technical services remained the top sector for a sixth consecutive quarter. Other vendors report similar record volume with different figures: GuidePoint GRIT counted 2,760 victims (up 21% from Q2, 75% year over year) across 112 active groups and 115 countries, with TheGentlemen (12.9%) and Qilin (12.6%) the top groups, and Comparitech counted 2,627 claimed attacks (up 27% from Q2). Counts differ by methodology and should not be compared directly.

The report stresses that leak-site listings are not proof of compromise. They mix genuine new attacks, rebrands (Storm is a possible rebrand of Stormous), recycled data and unproven claims. Examples cited include Global Secret Group (48 victims, 28 listed on one day), crpx0 (47 victims, 41 on one day, no postings since August), Storm (71 victims), and Orova (47 victims posted over 10 days). ExfilSquad, first seen July 2026, posted generic employee data (names, emails, phones, locations, often with empty fields) judged low-risk, listed targets without data samples, and set payment deadlines it did not follow through on. ReliaQuest assesses it likely scans GitHub for exposed credentials. Separate Resecurity reporting describes ExfilSquad as a pure data-theft and extortion operation that abuses misconfigured cloud and SaaS portals (Microsoft Dataverse, Power Pages, case-management and CRM platforms) and distributes stolen data through per-victim torrents with web seeds, a technique previously seen with LockBit 3.0 and Cl0p.

For established groups, the source describes Qilin and The Gentlemen as exploiting internet-facing systems, using vulnerable signed drivers to disable endpoint security (the GentleKiller tool is named for EDR process termination), and modifying Group Policy to spread ransomware. Qilin's manufacturing victims rose from 50 to 71 and The Gentlemen's from 49 to 74. DragonForce (69 victims) and LockBit (62 victims) are listed among established groups. Phishing against named employees is also cited as a common vector.

KELA profiles crpx0 as combining data theft, file encryption (.CRPx0 extension), cryptocurrency clipboard hijacking, seed-phrase theft and RaaS/HaaS offerings, with ClickFix stagers and C2 domains, and links it to the persona MrAnon00. A vendor briefing on Global Secret Group describes a RaaS model using VPN/gateway exploitation, exposed RDP, phishing and RMM abuse. That briefing is explicitly unverified and its CVE associations are speculative, so they are not recorded here as confirmed. The source article itself lists no CVEs, IP addresses or file hashes.

Defender takeaways: verify leak-site claims against internal logs and access records before assuming a breach, scan public code repositories for leaked credentials, patch and harden internet-facing systems, enable vulnerable-driver blocklists, and monitor Group Policy changes. BeaconBeagle correlation could not be performed because the API returned HTTP 502 during this run.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1552.001 Unsecured Credentials: Credentials In Files
- T1589.001 Gather Victim Identity Information: Credentials
- T1685 Disable or Modify Tools
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1567 Exfiltration Over Web Service
- T1530 Data from Cloud Storage
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix-Style Stager from Explorer or crpx0 C2 Domain in Command Line (TL-2026-5226)** (`TL-2026-5226-SPL-001`)

Detects PowerShell, mshta, cmd or curl launched directly by explorer.exe (the Win+R / Run-dialog pattern used by ClickFix) with download-and-execute, hidden-window or encoded-command content, and any command line referencing the crpx0 ClickFix C2 domains caribb.ru, mekhovaya-shuba.ru and beboss34.ru reported by KELA. Covers the phishing-delivered, user-executed initial-access stage described in TL-2026-5226, including mshta proxy execution of remote content.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566, T1204.002, T1059.001, T1218.005
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*mshta.exe" OR Image="*cmd.exe" OR Image="*curl.exe") ParentImage="*explorer.exe"
| eval ioc_domain=if(match(CommandLine,"(?i)(caribb[.]ru|mekhovaya-shuba[.]ru|beboss34[.]ru)"),1,0)
| eval clickfix_stager=if(match(CommandLine,"(?i)(invoke-expression|iex |downloadstring|invoke-webrequest|iwr |irm |frombase64string|-enc |-encodedcommand|-w(indowstyle)? +hidden|mshta(.exe)? +https?://|curl(.exe)? .*https?://)"),1,0)
| where ioc_domain=1 OR clickfix_stager=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines max(ioc_domain) as ioc_domain_hit by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - ioc_domain_hit - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FileName in~ ('powershell.exe', 'pwsh.exe', 'mshta.exe', 'cmd.exe', 'curl.exe')
| extend IocDomain = ProcessCommandLine has_any ('caribb.ru', 'mekhovaya-shuba.ru', 'beboss34.ru')
| extend ClickFixStager = ProcessCommandLine matches regex '(?i)(invoke-expression|iex |downloadstring|invoke-webrequest|frombase64string|-enc |-encodedcommand|-w(indowstyle)? +hidden|mshta(.exe)? +https?://|curl(.exe)? .*https?://)'
| where IocDomain or ClickFixStager
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IocDomain, ClickFixStager
| order by Timestamp desc
```

### Sigma

```yaml
title: ClickFix-Style Stager Launched From Explorer or crpx0 C2 Domain in Command Line
id: 3b6f0a52-8d1e-4c47-9a63-5e2f7c1d4b90
status: experimental
description: Detects PowerShell, mshta, cmd or curl started by explorer.exe with download-and-execute, hidden-window or encoded content (Run-dialog ClickFix pattern), or any command line referencing the crpx0 ClickFix C2 domains reported by KELA.
references:
  - https://www.kelacyber.com/blog/crpx0-threat-actor-profile/
  - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\curl.exe'
  selection_stager:
    CommandLine|contains:
      - 'invoke-expression'
      - 'iex '
      - 'downloadstring'
      - 'invoke-webrequest'
      - 'frombase64string'
      - ' -enc '
      - '-encodedcommand'
      - ' hidden'
      - 'mshta.exe http'
  selection_ioc:
    CommandLine|contains:
      - 'caribb.ru'
      - 'mekhovaya-shuba.ru'
      - 'beboss34.ru'
  condition: (selection_parent and selection_image and selection_stager) or selection_ioc
falsepositives:
  - Administrators or helpdesk staff running one-off PowerShell one-liners from the Run dialog
  - Software installers that launch encoded PowerShell via explorer.exe
level: high
```

**Known false positives:**

- Administrators running legitimate one-line PowerShell from the Run dialog
- Software deployment or installer wrappers that use encoded PowerShell launched from explorer.exe

**Tuning notes:** Adjust the index name to your Sysmon index. Exclude known admin workstations and approved deployment tooling. The IOC-domain leg is high fidelity and should alert at all times; consider raising the behavioural leg to a risk score if it is noisy. Refresh the domain list as KELA/community reporting adds crpx0 infrastructure. Pair with mail-gateway telemetry for the phishing lure that precedes the Run-dialog paste.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Web Server Process Spawning Shell or Recon Binaries (Internet-Facing Exploitation) (locked: unlock with TL Creds)
- BYOVD EDR Killer Activity (GentleKiller) and Security Product Tampering (locked: unlock with TL Creds)
- Bulk Data Retrieval from Microsoft Dataverse / Power Pages Portal (locked: unlock with TL Creds)
- GitHub Secret Exposure Signals (Credential Leakage Targeted for Valid-Account Access) (locked: unlock with TL Creds)
- crpx0 Ransomware Encrypted File Extension ([indicator]), [indicator] Execution or Recovery Inhibition (locked: unlock with TL Creds)
- Interactive Remote Logon from Public IP Address (Exposed RDP / Valid Account Abuse) (locked: unlock with TL Creds)
- Group Policy Object Change or SYSVOL Payload Write Consistent with Ransomware Deployment (TL-2026-5226) (locked: unlock with TL Creds)
- Data Exfiltration Staging and Tooling or crpx0 C2 / Tor Leak-Site DNS Activity (TL-2026-5226) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `caribb[.]ru`
- Domain: `mekhovaya-shuba[.]ru`
- Domain: `beboss34[.]ru`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware Gangs Claim 30% More Victims, but Researchers Warn Some Breaches May Be Fake](https://cybersecuritynews.com/ransomware-gangs/)
- [ReliaQuest Early Access Briefing: Ransomware Report Quarter Three](https://reliaquest.com/webinar/early-access-briefing-reliaquest-ransomware-report-quarter-three/)
- [GuidePoint GRIT Q3 2026 Ransomware & Cyber Threat Insights Report](https://www.guidepointsecurity.com/resources/grit-q3-2026-ransomware-cyber-threat-insights-report/)
- [ExfilSquad Adds New Victims and Uses Torrents to Publish Data Stolen from Cloud Portals](https://www.thaicert.or.th/?p=15909)
- [KELA: crpx0 Threat Actor Profile](https://www.kelacyber.com/blog/crpx0-threat-actor-profile/)
- [Global Secret Group Ransomware: 3 New Victims in 24 Hours](https://securityarsenal.com/blog/global-secret-group-ransomware-3-new-victims-in-24-hours-financial-services-under-fire-vpn-edge-exploitation-suspected)
- [Q3 2026 Sets New Record for Ransomware Attacks](https://www.infosecurity-magazine.com/news/q3-new-record-ransomware/)
- [Report: Ransomware Attacks Hit a Record High in Q3 2026](https://blog.knowbe4.com/report-ransomware-attacks-hit-a-record-high-in-q3-2026)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5226