# Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target

> Halcyon's monthly ransomware ranking shows 10 of the top 15 active families in August 2026 had not appeared in July, two of which were never tracked under their current names. Manufacturing remained the top targeted industry at roughly double the claims of the next sector, while hospitality appeared for the first time and software returned near the top. Halcyon ROC reports stopping 98.3% of August activity before encryption or data destruction.

- **Published:** 2026-11-09T00:28:24Z
- **Last reviewed:** 2026-11-09T00:28:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5514
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5514.png
- **ID:** TL-2026-5514
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

Halcyon's Ransomware Research Center (Kevin Gee, published 2026-09-18) reports that the ransomware leaderboard turned over sharply in August 2026: ten of the top fifteen families were absent from July's ranking and two had never been tracked under their current names. The article frames ransomware brands as 'storefronts' (leak site, negotiation portal, encryptor, affiliate-payment reputation) run largely by independent affiliates who migrate between brands, so brand names churn while tradecraft remains stable. Manufacturing held the top industry position at roughly double the claims of the next-ranked industry, attributed to long-lived operational technology, low downtime tolerance, and supply-chain positions where paying is faster than rebuilding. Hospitality appeared in the industry rankings for the first time, and software, which vanished in July, returned near the top; Halcyon attributes sector spikes to opportunistic scanning after a widely deployed product develops a usable vulnerability, lasting until patching catches up.

The article describes the common attack stages: initial access via remote tooling or a vulnerable edge service, persistence, locating and reaching valuable data, evading or disabling the security stack, staging exfiltration, and encryption. Halcyon ROC reports stopping 98.3% of August activity at initial access, enumeration, or lateral movement. The article itself names no specific families, CVEs, or IOCs.

The companion Halcyon Japan ROC STAR Report (August 2026, released 2026-09-16) gives additional figures: Qilin ranked first with 148 attacks and The Gentlemen second with 123 (first in June and July); Cl0p returned at #3 and LockBit at #10; of the top 15, only 5 groups kept their prior rank, 8 re-entered, and Orova and Dark Project were new. Living-off-the-land (LOLBAS) alerts rose from 50 to 86 (+72.0%), data exfiltration alerts from 36 to 45 (+25.0%), RMM alerts fell from 3,262 to 2,440 (-25.2%), and offensive security tool alerts fell from 50 to 30 (-40.0%). VSSAdmin/Shadow Copy rose two places in the abuse-tool ranking (15 organizations), used to delete restore points before encryption. Halcyon reports over 99.2% of attacks prevented before data destruction or encryption. Halcyon Japan cites unpatched VPN gateways and remote access products as common initial access, followed by use of legitimate administrative tools for reconnaissance, with backups deleted first so victims cannot recover without paying.

For context, CYFIRMA's separate August 2026 tracker (a different dataset based on leak-site claims) counted 1,046 publicly claimed victims (up 18.2% from 885 in July), led by Qilin (150), The Gentlemen (95) and Cl0p (90, attributed to batch publishing), with the United States at 41% of victims. Counts across vendors differ by methodology. Defenders should prioritize tradecraft-based detection (RMM abuse, shadow-copy deletion, security-tool tampering, exfiltration staging) over brand-specific indicators.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1133 External Remote Services
- T1685 Disable or Modify Tools
- T1046 Network Service Discovery
- T1087.002 Domain Account
- T1021 Remote Services
- T1219 Remote Access Tools
- T1048 Exfiltration Over Alternative Protocol
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Security Tool Tampering and Backup/DB Service Stops — Defender Disabling, EDR Service Stop, Registry Policy Changes — Defense Evasion** (`TL-2026-5514-SPL-002`)

TL-2026-5514: Halcyon lists evading or disabling the security stack as a core ransomware stage and reports operators stopping services before encryption. Detects PowerShell Set-MpPreference/Add-MpPreference changes (T1562.001, T1059.001), sc/net stop or config against AV/EDR services, registry policy writes that disable Defender or its tamper protection (T1112), taskkill of security agent processes, and stops of backup and database services such as Veeam, MSSQL and Acronis that release files for encryption (T1489).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1562.001, T1112, T1489, T1059.001
- **Data sources:** sysmon, windows_security, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Set-MpPreference*" OR CommandLine="*Add-MpPreference*") (CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*DisableIOAVProtection*" OR CommandLine="*DisableBehaviorMonitoring*" OR CommandLine="*DisableTamperProtection*" OR CommandLine="*ExclusionPath*" OR CommandLine="*ExclusionProcess*" OR CommandLine="*ExclusionExtension*")) OR ((Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") (CommandLine="* stop *" OR CommandLine="* config *" OR CommandLine="* delete *") (CommandLine="*WinDefend*" OR CommandLine="*WdNisSvc*" OR CommandLine="*SentinelAgent*" OR CommandLine="*CSFalconService*" OR CommandLine="*CbDefense*" OR CommandLine="*SepMasterService*" OR CommandLine="*Sophos*" OR CommandLine="*MBAMService*" OR CommandLine="*Veeam*" OR CommandLine="*MSSQL*" OR CommandLine="*SQLWriter*" OR CommandLine="*SQLSERVERAGENT*" OR CommandLine="*BackupExec*" OR CommandLine="*Acronis*" OR CommandLine="*mepocs*" OR CommandLine="*memtas*")) OR (Image="*\\reg.exe" CommandLine="* add *" (CommandLine="*DisableAntiSpyware*" OR CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*TamperProtection*" OR CommandLine="*Windows Defender\\Exclusions*")) OR (Image="*\\taskkill.exe" CommandLine="*/f*" (CommandLine="*MsMpEng*" OR CommandLine="*SentinelAgent*" OR CommandLine="*CSFalconService*" OR CommandLine="*SophosHealth*")))
| eval tool=lower(mvindex(split(Image,"\\"),-1))
| eval technique_hint=case(match(CommandLine,"(?i)Veeam|MSSQL|SQLWriter|SQLSERVERAGENT|BackupExec|Acronis|mepocs|memtas"),"T1489_service_stop",tool="reg.exe","T1112_modify_registry",true(),"T1562.001_impair_defenses")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(technique_hint) as technique_hints by host User tool
| sort 0 -count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Set-MpPreference", "Add-MpPreference")
        and ProcessCommandLine has_any ("DisableRealtimeMonitoring", "DisableIOAVProtection", "DisableBehaviorMonitoring", "DisableTamperProtection", "ExclusionPath", "ExclusionProcess", "ExclusionExtension"))
    or (FileName in~ ("sc.exe", "net.exe", "net1.exe") and ProcessCommandLine has_any (" stop ", " config ", " delete ")
        and ProcessCommandLine has_any ("WinDefend", "WdNisSvc", "SentinelAgent", "CSFalconService", "CbDefense", "SepMasterService", "Sophos", "MBAMService", "Veeam", "MSSQL", "SQLWriter", "SQLSERVERAGENT", "BackupExec", "Acronis", "mepocs", "memtas"))
    or (FileName =~ "reg.exe" and ProcessCommandLine has " add " and ProcessCommandLine has_any ("DisableAntiSpyware", "DisableRealtimeMonitoring", "TamperProtection", "Windows Defender\\Exclusions"))
    or (FileName =~ "taskkill.exe" and ProcessCommandLine has "/f" and ProcessCommandLine has_any ("MsMpEng", "SentinelAgent", "CSFalconService", "SophosHealth"))
| extend TechniqueHint = case(ProcessCommandLine matches regex @"(?i)Veeam|MSSQL|SQLWriter|SQLSERVERAGENT|BackupExec|Acronis|mepocs|memtas", "T1489 service stop", FileName =~ "reg.exe", "T1112 modify registry", "T1562.001 impair defenses")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, TechniqueHint, InitiatingProcessFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: Security Tool Tampering and Backup Service Stops via PowerShell, sc, net, reg or taskkill
id: 8c4f1d2b-3a6e-4b7c-8d90-1e2f3a4b5c02
status: experimental
description: Detects commands that disable or exclude Microsoft Defender, modify its policy registry keys, stop and delete common AV and EDR services, or stop backup and database services, defense evasion and service-stop steps preceding ransomware encryption
references:
    - https://www.halcyon.ai/blog/ten-of-fifteen-the-ransomware-leaderboard-turned-over-again-in-august
    - https://www.halcyon.ai/resources/reports/roc-star-report-august-2026
    - https://internet.watch.impress.co.jp/docs/news/2141536.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1112
    - attack.impact
    - attack.t1489
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_ps_cmd:
        CommandLine|contains:
            - 'Set-MpPreference'
            - 'Add-MpPreference'
    selection_ps_arg:
        CommandLine|contains:
            - 'DisableRealtimeMonitoring'
            - 'DisableIOAVProtection'
            - 'DisableBehaviorMonitoring'
            - 'DisableTamperProtection'
            - 'ExclusionPath'
            - 'ExclusionProcess'
            - 'ExclusionExtension'
    selection_svc_img:
        Image|endswith:
            - '\sc.exe'
            - '\net.exe'
            - '\net1.exe'
    selection_svc_action:
        CommandLine|contains:
            - ' stop '
            - ' config '
            - ' delete '
    selection_svc_name:
        CommandLine|contains:
            - 'WinDefend'
            - 'WdNisSvc'
            - 'SentinelAgent'
            - 'CSFalconService'
            - 'CbDefense'
            - 'SepMasterService'
            - 'Sophos'
            - 'MBAMService'
    selection_svc_backup:
        CommandLine|contains:
            - 'Veeam'
            - 'MSSQL'
            - 'SQLWriter'
            - 'SQLSERVERAGENT'
            - 'BackupExec'
            - 'Acronis'
            - 'mepocs'
            - 'memtas'
    selection_reg:
        Image|endswith: '\reg.exe'
        CommandLine|contains:
            - 'DisableAntiSpyware'
            - 'DisableRealtimeMonitoring'
            - 'TamperProtection'
            - 'Windows Defender\Exclusions'
    selection_kill:
        Image|endswith: '\taskkill.exe'
        CommandLine|contains|all:
            - '/f'
        CommandLine|contains:
            - 'MsMpEng'
            - 'SentinelAgent'
            - 'CSFalconService'
            - 'SophosHealth'
    condition: (selection_ps_img and selection_ps_cmd and selection_ps_arg) or (selection_svc_img and selection_svc_action and (selection_svc_name or selection_svc_backup)) or selection_reg or selection_kill
falsepositives:
    - Security administrators performing approved exclusions or product upgrades
    - Software installers that stop AV services during installation
    - Database or backup maintenance windows that stop SQL or Veeam services
level: high
```

**Known false positives:**

- Security teams adding approved Defender exclusions or upgrading/reinstalling EDR agents
- Software installers that temporarily stop AV services
- Database or backup maintenance windows that stop SQL Server, Veeam or Acronis services

**Tuning notes:** Exclude change-ticketed admin accounts and the management server's parent processes; raise severity when the same host also triggers shadow-copy deletion (SPL-001) or recovery impairment (SIG-001). Treat backup/DB service stops (T1489) as lower severity unless they occur outside maintenance windows or together with a Defender tamper event. Extend the service-name lists with the security and backup products deployed in your estate.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- VPN / Edge Gateway Brute Force Followed by Successful Login — Initial Access (locked: unlock with TL Creds)
- Domain Account and Network Service Discovery Tooling — Post-Exploitation (locked: unlock with TL Creds)
- Pre-Encryption Data Staging and Exfiltration (rclone, MEGA, WinSCP, pscp, curl upload, password-protected archives) — Exfiltration (locked: unlock with TL Creds)
- Backup and Recovery Impairment via bcdedit, wbadmin, vssadmin resize, reagentc and Event Log Clearing — Impact (locked: unlock with TL Creds)
- LOLBAS Download and Proxy Execution (certutil, bitsadmin, mshta, regsvr32, rundll32) — Post-Exploitation (locked: unlock with TL Creds)
- Outbound Connections to Community-Observed Ransomware-Related Infrastructure — C2 / Exfiltration (locked: unlock with TL Creds)
- Ransomware Shadow Copy Deletion via vssadmin, WMIC, diskshadow or PowerShell WMI/CIM — Impact Phase (locked: unlock with TL Creds)
- Unapproved RMM and Remote Access Tool Execution, PsExec Lateral Movement — C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Ten of Fifteen: The Ransomware Leaderboard Turned Over Again in August (Kevin Gee, Halcyon)](https://www.halcyon.ai/blog/ten-of-fifteen-the-ransomware-leaderboard-turned-over-again-in-august)
- [Halcyon August 2026 ROC STAR Report](https://www.halcyon.ai/resources/reports/roc-star-report-august-2026)
- [INTERNET Watch: Halcyon Japan ROC STAR Report August 2026 (backup deletion before encryption, LOTL +72%)](https://internet.watch.impress.co.jp/docs/news/2141536.html)
- [Halcyon Japan PR TIMES release: ROC STAR Report August 2026](https://prtimes.jp/main/html/rd/p/000000008.000183451.html)
- [CYFIRMA: Tracking Ransomware August 2026](https://www.cyfirma.com/?p=61891)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5514