Threat video1:00
Q3 2026 Ransomware Leak-Site Surge: Detection & IOCs
ExfilSquad extorts without encryptors, and 43 new groups drove 93% of the Q3 2026 rise. 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for Q3 2026 Ransomware Leak-Site Surge: Detection & IOCs →
Chapters
- 0:00The hookRansomware victims rose by about 30%.
- 0:04The storyForty-three new groups drove the surge.
- 0:11Attack pathGroups hunt credentials in public repositories.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise6 indicators to hunt: 4 domains and 2 file names.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation4 steps now: Verify leak-site claims against internal logs, access records and data.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Ransomware victims rose by about 30%.
0:05Forty-three new groups drove the surge.
0:07Most breaches listed are unproven.
0:11Groups hunt credentials in public repositories.
0:14Or exploit internet-facing systems.
0:17They disable endpoint security with drivers.
0:20Then extract and publish stolen data.
0:22Many post unverified claims on leak sites.
0:28No threat actor is attributed. Confidence: low.
0:326 indicators to hunt: 4 domains and 2 file names.
0:3810 ATT&CK techniques, from reconnaissance to impact.
0:434 steps now: Verify leak-site claims against internal logs, access records and data.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.