Sophos State of Ransomware in Retail 2026: Exploited Vulnerabilities Lead Retail Root Causes, Encryption Rate Rises to 62%

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5658 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5658 Web Server Process Spawning Shell or LOLBin (T1190 Exploit Public-Facing Application)

Behaviour-first detection of exploitation of internet-facing applications (T1190), the root cause of 26% of retail ransomware attacks in the Sophos State of Ransomware in Retail 2026 (highest of any sector). The source names no CVEs, so this rule keys on post-exploit behaviour common to any web-app/RCE exploit: IIS, Apache, nginx, Tomcat or PHP-CGI worker processes spawning cmd, PowerShell, script hosts or download/recon LOLBins.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059
• Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

```Exploit Public-Facing Application (T1190), TL-2026-5658: web server worker spawning a shell or LOLBin```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h@h
(ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\tomcat*.exe" OR ParentImage="*\\php-cgi.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe")
| stats count as event_count min(_time) as first_seen max(_time) as last_seen values(Image) as child_processes values(CommandLine) as command_lines by host, ParentImage, User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host User ParentImage child_processes command_lines event_count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe") or InitiatingProcessFileName startswith "tomcat"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "net.exe", "net1.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: TL-2026-5658 Web Server Process Spawning Shell or LOLBin
id: 7c1e4a52-3b0d-4f6e-9a21-5d8e0c3b7a11
status: experimental
description: Detects IIS, Apache, nginx, Tomcat or PHP-CGI worker processes spawning command shells, script hosts or recon/download LOLBins, a common post-exploitation indicator of exploited internet-facing applications (T1190).
references:
  - https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-retail-2026
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
  selection_tomcat:
    ParentImage|contains: '\tomcat'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: (selection_parent or selection_tomcat) and selection_child
falsepositives:
  - Web applications that legitimately shell out to cmd.exe or PowerShell for admin tasks
  - Vulnerability scanners and authorised penetration tests
level: high

Known false positives:

• Web applications that legitimately invoke cmd.exe or PowerShell (e.g. report generators, legacy admin panels)
• Authorised vulnerability scans or penetration tests against internet-facing hosts

Tuning notes: Baseline legitimate parent/child pairs per web tier for 14 days and exclude them by host and CommandLine. Add java.exe as a parent only on hosts known to run Tomcat/JBoss as a generic JVM. Prioritise alerts on internet-facing hosts and hosts missing recent vendor patches.

• 🔒 TL-2026-5658 Phishing Attachment Execution: Office or Mail Client Spawning Script Host (T1566.001) · unlock with TL Creds
• 🔒 TL-2026-5658 Repeated MFA Denials Followed by Successful Entra ID Sign-in (T1621 / T1078.004) · unlock with TL Creds
• 🔒 TL-2026-5658 Ransomware Note and Encrypted-File Extension Creation (T1486 / T1657) · unlock with TL Creds
• 🔒 TL-2026-5658 Rclone Cloud Exfiltration Before Ransomware (T1567.002) · unlock with TL Creds
• 🔒 TL-2026-5658 Connections To Community-Observed Related Infrastructure (T1071) · unlock with TL Creds
• 🔒 TL-2026-5658 Security Tooling Tampering Before Ransomware Deployment (T1562.001) · unlock with TL Creds
• 🔒 TL-2026-5658 Password Spray Followed by Successful Network Logon (T1110.003 / T1078) · unlock with TL Creds
• 🔒 TL-2026-5658 Backup and Shadow Copy Destruction Before Encryption (T1490 / T1486) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5658.

Technical analysis

Median ransom demand was $225,000, median payment $57,500, and mean recovery cost $1.76 million.

This entry documents ransomware trend intelligence for the retail sector from the sixth annual Sophos State of Ransomware in Retail report, written by Mitch Pronschinske. The survey covered 217 IT and cybersecurity leaders at retail organizations in 17 countries that were hit by ransomware in the prior 12 months, and was fielded January to March 2026. The Sophos page does not state a publication date. It is a survey and trend report, not a single campaign: it names no CVEs, ransomware families, threat actors or network indicators.

Root causes: phishing was the leading technical root cause at 29%, followed by exploited vulnerabilities at 26% and malicious email at 22%. The 26% exploited-vulnerability rate is the highest of any sector, against 18% across all sectors in the companion cross-sector report. Identity-based vectors (malicious email, phishing, compromised credentials, brute force) started 69% of retail attacks, the lowest of any sector but still a majority; 66% of retail victims said the ransomware attack was also their most significant identity attack (67% cross-sector). 38% of victims cited a known but unaddressed security gap, retail's most common operational root cause and the only one above the 36% cross-sector rate.

Outcomes: data was encrypted in 62% of attacks, up from 48% in 2025 and above the 56% cross-sector rate. Attacks that both encrypted and stole data rose to 19% from 14%. 71% of retailers restored data from backups (62% in 2025, 66% cross-sector), and fewer retailers paid the ransom than in 2025, though the page gives no exact rate. The median ransom demand was $225,000 (cross-sector $698,000) and the median payment $57,500, the lowest of any sector (cross-sector $769,000). The mean demand was $4.32 million, the highest of any sector, and excludes outlier demands of $40 million or more. Mean recovery cost excluding ransom was $1.76 million (up from $1.65 million); mean time to full recovery was 2.54 weeks (down from 3.16), and 56% recovered within one week, the highest share in five years of retail data.

Defensive findings: 97% of victims of credential attacks had MFA enabled, yet more than half still had data encrypted. Firewalls flagged 59% of attacks before ransomware deployed, but victims were still encrypted 60% of the time, versus 50% across all sectors. Sophos recommends a defense-system approach in which identity, email, endpoint and network controls respond together, closing known security gaps, and connecting existing defenses. For context, the 2025 retail edition (reported 5 November 2025) named Akira, Cl0p, Qilin, PLAY and Lynx as the groups most active against retail and noted nearly 90 groups targeting the sector; the 2026 retail page names no groups.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Credential Access

T1110 Brute Force

Impact

T1657 Financial Theft

Remediation

Patches

• Apply vendor security updates for exploited internet-facing products; no specific CVEs are named in the source

Immediate actions

• Close known but unaddressed security gaps (cited by 38% of retail victims) and prioritize patching of internet-facing systems
• Close MFA coverage gaps, particularly on VPNs, firewall admin consoles and legacy applications
• Act on firewall alerts that flag pre-deployment ransomware activity (59% of attacks were flagged but 60% of victims were still encrypted)

Workarounds

• Audit and rotate non-human identities such as API keys and service accounts

Longer-term hardening

• Adopt a defense-system approach in which identity, email, endpoint and network controls respond together
• Connect existing defenses so they work together rather than in isolation
• Deploy advanced email protection with DMARC, DKIM and SPF plus user awareness training
• Maintain tested, restorable backups (71% of retail victims restored from backups)

Affected and fixed versions

• Various — Retail sector IT environments (internet-facing systems, email, identity and firewalls)

Timeline

• 2025-11-05 Coverage of the Sophos State of Ransomware in Retail 2025 (fifth edition): encryption in 48% of attacks, median demand $2 million, 58% of encrypted retailers paid
• 2026-01-01 Sophos begins fielding the 2026 survey of IT and security leaders (January to March 2026)
• 2026-03-06 A March 2026 press article attributes retail ransomware findings to a new Sophos report; the article does not name the report, so the link to the retail edition is unconfirmed
• 2026-03-31 Survey fieldwork ends; 217 retail respondents in 17 countries hit by ransomware in the prior 12 months (end of March 2026 is the close of the stated fielding window)
• 2026-08-10 Daily Mirror (Sri Lanka) business coverage of Sophos retail ransomware findings dated 10 Aug 2026 appears in search results; content not retrieved
• 2026-11-10 Sophos retail 2026 blog and white-paper pages reviewed for this entry; neither page states a publication date

Sources cited

• The State of Ransomware in Retail (Sophos white paper) Sophos · Research
• Sophos State of Ransomware 2026 report (PDF) Sophos · Research
• Sophos Fusion defense system overview Sophos · Vendor report
• The State of Ransomware in Retail 2026 (Sophos blog) Sophos · Blog
• Sophos State of Ransomware 2026 (cross-sector) Sophos · Blog
• Sophos State of Identity Security 2026 Sophos · Blog
• 10 things we learned from the Sophos State of Ransomware in Retail 2025 techeconomy.ng · News · 2025-11-05

More in ransomware

• Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337)
• MedusaLocker ransomware leak-site listing: victim 'Capetown' (identity unverified)
• Bitdefender Threat Debrief Nov 2026: AI-assisted ransomware actors N0n and Azazel (MCP reverse-shell C2), BYOD, Booba Team
• Vortex ransomware group claims Scripps (US healthcare) on leak site
• Vanderbilt University hit in BYOD ransomware attack, data theft claimed