Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target

Key facts for Halcyon ROC STAR August 2026

Detection coverage for Halcyon ROC STAR August 2026

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5514 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Security Tool Tampering and Backup/DB Service Stops — Defender Disabling, EDR Service Stop, Registry Policy Changes — Defense Evasion

TL-2026-5514: Halcyon lists evading or disabling the security stack as a core ransomware stage and reports operators stopping services before encryption. Detects PowerShell Set-MpPreference/Add-MpPreference changes (T1562.001, T1059.001), sc/net stop or config against AV/EDR services, registry policy writes that disable Defender or its tamper protection (T1112), taskkill of security agent processes, and stops of backup and database services such as Veeam, MSSQL and Acronis that release files for encryption (T1489).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1562.001, T1112, T1489, T1059.001
• Data sources: sysmon, windows_security, defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Set-MpPreference*" OR CommandLine="*Add-MpPreference*") (CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*DisableIOAVProtection*" OR CommandLine="*DisableBehaviorMonitoring*" OR CommandLine="*DisableTamperProtection*" OR CommandLine="*ExclusionPath*" OR CommandLine="*ExclusionProcess*" OR CommandLine="*ExclusionExtension*")) OR ((Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") (CommandLine="* stop *" OR CommandLine="* config *" OR CommandLine="* delete *") (CommandLine="*WinDefend*" OR CommandLine="*WdNisSvc*" OR CommandLine="*SentinelAgent*" OR CommandLine="*CSFalconService*" OR CommandLine="*CbDefense*" OR CommandLine="*SepMasterService*" OR CommandLine="*Sophos*" OR CommandLine="*MBAMService*" OR CommandLine="*Veeam*" OR CommandLine="*MSSQL*" OR CommandLine="*SQLWriter*" OR CommandLine="*SQLSERVERAGENT*" OR CommandLine="*BackupExec*" OR CommandLine="*Acronis*" OR CommandLine="*mepocs*" OR CommandLine="*memtas*")) OR (Image="*\\reg.exe" CommandLine="* add *" (CommandLine="*DisableAntiSpyware*" OR CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*TamperProtection*" OR CommandLine="*Windows Defender\\Exclusions*")) OR (Image="*\\taskkill.exe" CommandLine="*/f*" (CommandLine="*MsMpEng*" OR CommandLine="*SentinelAgent*" OR CommandLine="*CSFalconService*" OR CommandLine="*SophosHealth*")))
| eval tool=lower(mvindex(split(Image,"\\"),-1))
| eval technique_hint=case(match(CommandLine,"(?i)Veeam|MSSQL|SQLWriter|SQLSERVERAGENT|BackupExec|Acronis|mepocs|memtas"),"T1489_service_stop",tool="reg.exe","T1112_modify_registry",true(),"T1562.001_impair_defenses")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(technique_hint) as technique_hints by host User tool
| sort 0 -count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Set-MpPreference", "Add-MpPreference")
        and ProcessCommandLine has_any ("DisableRealtimeMonitoring", "DisableIOAVProtection", "DisableBehaviorMonitoring", "DisableTamperProtection", "ExclusionPath", "ExclusionProcess", "ExclusionExtension"))
    or (FileName in~ ("sc.exe", "net.exe", "net1.exe") and ProcessCommandLine has_any (" stop ", " config ", " delete ")
        and ProcessCommandLine has_any ("WinDefend", "WdNisSvc", "SentinelAgent", "CSFalconService", "CbDefense", "SepMasterService", "Sophos", "MBAMService", "Veeam", "MSSQL", "SQLWriter", "SQLSERVERAGENT", "BackupExec", "Acronis", "mepocs", "memtas"))
    or (FileName =~ "reg.exe" and ProcessCommandLine has " add " and ProcessCommandLine has_any ("DisableAntiSpyware", "DisableRealtimeMonitoring", "TamperProtection", "Windows Defender\\Exclusions"))
    or (FileName =~ "taskkill.exe" and ProcessCommandLine has "/f" and ProcessCommandLine has_any ("MsMpEng", "SentinelAgent", "CSFalconService", "SophosHealth"))
| extend TechniqueHint = case(ProcessCommandLine matches regex @"(?i)Veeam|MSSQL|SQLWriter|SQLSERVERAGENT|BackupExec|Acronis|mepocs|memtas", "T1489 service stop", FileName =~ "reg.exe", "T1112 modify registry", "T1562.001 impair defenses")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, TechniqueHint, InitiatingProcessFileName
| order by Timestamp desc

Sigma

title: Security Tool Tampering and Backup Service Stops via PowerShell, sc, net, reg or taskkill
id: 8c4f1d2b-3a6e-4b7c-8d90-1e2f3a4b5c02
status: experimental
description: Detects commands that disable or exclude Microsoft Defender, modify its policy registry keys, stop and delete common AV and EDR services, or stop backup and database services, defense evasion and service-stop steps preceding ransomware encryption
references:
    - https://www.halcyon.ai/blog/ten-of-fifteen-the-ransomware-leaderboard-turned-over-again-in-august
    - https://www.halcyon.ai/resources/reports/roc-star-report-august-2026
    - https://internet.watch.impress.co.jp/docs/news/2141536.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1112
    - attack.impact
    - attack.t1489
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_ps_cmd:
        CommandLine|contains:
            - 'Set-MpPreference'
            - 'Add-MpPreference'
    selection_ps_arg:
        CommandLine|contains:
            - 'DisableRealtimeMonitoring'
            - 'DisableIOAVProtection'
            - 'DisableBehaviorMonitoring'
            - 'DisableTamperProtection'
            - 'ExclusionPath'
            - 'ExclusionProcess'
            - 'ExclusionExtension'
    selection_svc_img:
        Image|endswith:
            - '\sc.exe'
            - '\net.exe'
            - '\net1.exe'
    selection_svc_action:
        CommandLine|contains:
            - ' stop '
            - ' config '
            - ' delete '
    selection_svc_name:
        CommandLine|contains:
            - 'WinDefend'
            - 'WdNisSvc'
            - 'SentinelAgent'
            - 'CSFalconService'
            - 'CbDefense'
            - 'SepMasterService'
            - 'Sophos'
            - 'MBAMService'
    selection_svc_backup:
        CommandLine|contains:
            - 'Veeam'
            - 'MSSQL'
            - 'SQLWriter'
            - 'SQLSERVERAGENT'
            - 'BackupExec'
            - 'Acronis'
            - 'mepocs'
            - 'memtas'
    selection_reg:
        Image|endswith: '\reg.exe'
        CommandLine|contains:
            - 'DisableAntiSpyware'
            - 'DisableRealtimeMonitoring'
            - 'TamperProtection'
            - 'Windows Defender\Exclusions'
    selection_kill:
        Image|endswith: '\taskkill.exe'
        CommandLine|contains|all:
            - '/f'
        CommandLine|contains:
            - 'MsMpEng'
            - 'SentinelAgent'
            - 'CSFalconService'
            - 'SophosHealth'
    condition: (selection_ps_img and selection_ps_cmd and selection_ps_arg) or (selection_svc_img and selection_svc_action and (selection_svc_name or selection_svc_backup)) or selection_reg or selection_kill
falsepositives:
    - Security administrators performing approved exclusions or product upgrades
    - Software installers that stop AV services during installation
    - Database or backup maintenance windows that stop SQL or Veeam services
level: high

Known false positives:

• Security teams adding approved Defender exclusions or upgrading/reinstalling EDR agents
• Software installers that temporarily stop AV services
• Database or backup maintenance windows that stop SQL Server, Veeam or Acronis services

Tuning notes: Exclude change-ticketed admin accounts and the management server's parent processes; raise severity when the same host also triggers shadow-copy deletion (SPL-001) or recovery impairment (SIG-001). Treat backup/DB service stops (T1489) as lower severity unless they occur outside maintenance windows or together with a Defender tamper event. Extend the service-name lists with the security and backup products deployed in your estate.

• 🔒 VPN / Edge Gateway Brute Force Followed by Successful Login — Initial Access · unlock with TL Creds
• 🔒 Domain Account and Network Service Discovery Tooling — Post-Exploitation · unlock with TL Creds
• 🔒 Pre-Encryption Data Staging and Exfiltration (rclone, MEGA, WinSCP, pscp, curl upload, password-protected archives) — Exfiltration · unlock with TL Creds
• 🔒 Backup and Recovery Impairment via bcdedit, wbadmin, vssadmin resize, reagentc and Event Log Clearing — Impact · unlock with TL Creds
• 🔒 LOLBAS Download and Proxy Execution (certutil, bitsadmin, mshta, regsvr32, rundll32) — Post-Exploitation · unlock with TL Creds
• 🔒 Outbound Connections to Community-Observed Ransomware-Related Infrastructure — C2 / Exfiltration · unlock with TL Creds
• 🔒 Ransomware Shadow Copy Deletion via vssadmin, WMIC, diskshadow or PowerShell WMI/CIM — Impact Phase · unlock with TL Creds
• 🔒 Unapproved RMM and Remote Access Tool Execution, PsExec Lateral Movement — C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise for Halcyon ROC STAR August 2026

As of 2026-11-09, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5514.

How Halcyon ROC STAR August 2026 works

Halcyon ROC reports stopping 98.3% of August activity before encryption or data destruction.

Halcyon's Ransomware Research Center (Kevin Gee, published 2026-09-18) reports that the ransomware leaderboard turned over sharply in August 2026: ten of the top fifteen families were absent from July's ranking and two had never been tracked under their current names. The article frames ransomware brands as 'storefronts' (leak site, negotiation portal, encryptor, affiliate-payment reputation) run largely by independent affiliates who migrate between brands, so brand names churn while tradecraft remains stable. Manufacturing held the top industry position at roughly double the claims of the next-ranked industry, attributed to long-lived operational technology, low downtime tolerance, and supply-chain positions where paying is faster than rebuilding. Hospitality appeared in the industry rankings for the first time, and software, which vanished in July, returned near the top; Halcyon attributes sector spikes to opportunistic scanning after a widely deployed product develops a usable vulnerability, lasting until patching catches up.

The article describes the common attack stages: initial access via remote tooling or a vulnerable edge service, persistence, locating and reaching valuable data, evading or disabling the security stack, staging exfiltration, and encryption. Halcyon ROC reports stopping 98.3% of August activity at initial access, enumeration, or lateral movement. The article itself names no specific families, CVEs, or IOCs.

The companion Halcyon Japan ROC STAR Report (August 2026, released 2026-09-16) gives additional figures: Qilin ranked first with 148 attacks and The Gentlemen second with 123 (first in June and July); Cl0p returned at #3 and LockBit at #10; of the top 15, only 5 groups kept their prior rank, 8 re-entered, and Orova and Dark Project were new. Living-off-the-land (LOLBAS) alerts rose from 50 to 86 (+72.0%), data exfiltration alerts from 36 to 45 (+25.0%), RMM alerts fell from 3,262 to 2,440 (-25.2%), and offensive security tool alerts fell from 50 to 30 (-40.0%). VSSAdmin/Shadow Copy rose two places in the abuse-tool ranking (15 organizations), used to delete restore points before encryption. Halcyon reports over 99.2% of attacks prevented before data destruction or encryption. Halcyon Japan cites unpatched VPN gateways and remote access products as common initial access, followed by use of legitimate administrative tools for reconnaissance, with backups deleted first so victims cannot recover without paying.

For context, CYFIRMA's separate August 2026 tracker (a different dataset based on leak-site claims) counted 1,046 publicly claimed victims (up 18.2% from 885 in July), led by Qilin (150), The Gentlemen (95) and Cl0p (90, attributed to batch publishing), with the United States at 41% of victims. Counts across vendors differ by methodology. Defenders should prioritize tradecraft-based detection (RMM abuse, shadow-copy deletion, security-tool tampering, exfiltration staging) over brand-specific indicators.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Discovery

T1046 Network Service Discovery; T1087.002 Domain Account

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1133 External Remote Services

Command and Control

T1219 Remote Access Tools

Impact

T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools

Remediation for Halcyon ROC STAR August 2026

Patches

• Apply vendor security updates for internet-facing VPN, remote access and edge products as released

Immediate actions

• Patch or restrict exposure of VPN gateways, remote access products and other edge services
• Audit and allow-list RMM platforms; alert on unapproved remote access tools
• Alert on vssadmin/shadow copy deletion and backup-catalog tampering
• Isolate backups from the production network and test restores

Workarounds

• Enforce MFA and restrict management interfaces to trusted networks
• Disable unused remote access and RMM tooling

Longer-term hardening

• Deploy behavioral prevention that stops attacks at initial access, enumeration or lateral movement before encryption
• Monitor for exfiltration utilities and unusual outbound data staging
• Protect and monitor security tooling against tampering or disabling
• Segment operational technology from IT networks, particularly in manufacturing

Affected and fixed versions

• Multiple — Internet-facing VPN gateways, remote access products and RMM platforms
  Vulnerable versions: Unpatched or exposed deployments

Timeline of Halcyon ROC STAR August 2026

• 2026-08-01 Start of the August 2026 reporting period covered by Halcyon's ROC STAR report and CYFIRMA's tracker.
• 2026-08-31 End of the August 2026 period; Halcyon ROC reports 98.3% of activity stopped at initial access, enumeration or lateral movement.
• 2026-09-07 CYFIRMA publishes its August 2026 tracker: 1,046 claimed victims (+18.2% vs. July), led by locked-ioc-7, locked-ioc-1 and locked-ioc-10.
• 2026-09-16 Halcyon Japan releases the August 2026 ROC STAR Report: locked-ioc-7 148 attacks, locked-ioc-1 123, LOTL alerts +72.0%, VSSAdmin up two places.
• 2026-09-17 INTERNET Watch reports the findings, highlighting backup deletion before encryption and unpatched VPN/remote-access initial access.
• 2026-09-18 Halcyon Japan holds an online webinar explaining the August 2026 ROC STAR report.
• 2026-09-18 Halcyon publishes 'Ten of Fifteen': 10 of the top 15 families were new vs. July and manufacturing remained the top industry.

Sources cited for Halcyon ROC STAR August 2026

• Ten of Fifteen: The Ransomware Leaderboard Turned Over Again in August (Kevin Gee, Halcyon) halcyon.ai · Research · 2026-09-18
• Halcyon August 2026 ROC STAR Report halcyon.ai · Research · 2026-09-18
• Halcyon Japan PR TIMES release: ROC STAR Report August 2026 prtimes.jp · Vendor report · 2026-09-16
• CYFIRMA: Tracking Ransomware August 2026 cyfirma.com · Research · 2026-09-07
• INTERNET Watch: Halcyon Japan ROC STAR Report August 2026 (backup deletion before encryption, LOTL +72%) internet.watch.impress.co.jp · News · 2026-09-17

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services