Threat video1:00
Halcyon August 2026 Ransomware Report: Detection & IOCs
Ten of the top 15 ransomware families in August 2026 were new versus July; 9 detection rules, 10 IOCs and a free Splunk SPL rule cover the shift.
Read the full threat intel for Halcyon August 2026 Ransomware Report: Detection & IOCs →
Chapters
- 0:00The hookHalcyon stopped 98.3% of August activity before encryption.
- 0:06The storyTen of the top fifteen were new.
- 0:12Attack pathOften they entered via unpatched VPN gateways.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Patch or restrict exposure of VPN gateways, remote access products.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Halcyon stopped 98.3% of August activity before encryption.
0:06Ten of the top fifteen were new.
0:08Ransomware brands churn; tradecraft stays.
0:12Often they entered via unpatched VPN gateways.
0:15Remote tools kept access; admin tools mapped the network.
0:20Then they disabled the security stack.
0:22Backups were deleted first, then data was encrypted.
0:28No threat actor is attributed. Confidence: low.
0:33No malicious indicators were published.
0:3810 ATT&CK techniques, from initial access to impact.
0:434 steps now: Patch or restrict exposure of VPN gateways, remote access products.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.