# Sophos State of Ransomware in Retail 2026: Exploited Vulnerabilities Lead Retail Root Causes, Encryption Rate Rises to 62%

> Sophos' sixth annual retail ransomware survey (217 IT/security leaders in 17 countries, fielded Jan-Mar 2026) reports exploited vulnerabilities started 26% of retail attacks (highest of any sector), phishing was the top technical root cause at 29%, and data encryption rose to 62% from 48% in 2025. Median ransom demand was $225,000, median payment $57,500, and mean recovery cost $1.76 million.

- **Published:** 2026-11-10T15:44:43Z
- **Last reviewed:** 2026-11-10T15:44:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5658
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5658.png
- **ID:** TL-2026-5658
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

This entry documents ransomware trend intelligence for the retail sector from the sixth annual Sophos State of Ransomware in Retail report, written by Mitch Pronschinske. The survey covered 217 IT and cybersecurity leaders at retail organizations in 17 countries that were hit by ransomware in the prior 12 months, and was fielded January to March 2026. The Sophos page does not state a publication date. It is a survey and trend report, not a single campaign: it names no CVEs, ransomware families, threat actors or network indicators.

Root causes: phishing was the leading technical root cause at 29%, followed by exploited vulnerabilities at 26% and malicious email at 22%. The 26% exploited-vulnerability rate is the highest of any sector, against 18% across all sectors in the companion cross-sector report. Identity-based vectors (malicious email, phishing, compromised credentials, brute force) started 69% of retail attacks, the lowest of any sector but still a majority; 66% of retail victims said the ransomware attack was also their most significant identity attack (67% cross-sector). 38% of victims cited a known but unaddressed security gap, retail's most common operational root cause and the only one above the 36% cross-sector rate.

Outcomes: data was encrypted in 62% of attacks, up from 48% in 2025 and above the 56% cross-sector rate. Attacks that both encrypted and stole data rose to 19% from 14%. 71% of retailers restored data from backups (62% in 2025, 66% cross-sector), and fewer retailers paid the ransom than in 2025, though the page gives no exact rate. The median ransom demand was $225,000 (cross-sector $698,000) and the median payment $57,500, the lowest of any sector (cross-sector $769,000). The mean demand was $4.32 million, the highest of any sector, and excludes outlier demands of $40 million or more. Mean recovery cost excluding ransom was $1.76 million (up from $1.65 million); mean time to full recovery was 2.54 weeks (down from 3.16), and 56% recovered within one week, the highest share in five years of retail data.

Defensive findings: 97% of victims of credential attacks had MFA enabled, yet more than half still had data encrypted. Firewalls flagged 59% of attacks before ransomware deployed, but victims were still encrypted 60% of the time, versus 50% across all sectors. Sophos recommends a defense-system approach in which identity, email, endpoint and network controls respond together, closing known security gaps, and connecting existing defenses. For context, the 2025 retail edition (reported 5 November 2025) named Akira, Cl0p, Qilin, PLAY and Lynx as the groups most active against retail and noted nearly 90 groups targeting the sector; the 2026 retail page names no groups.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1110 Brute Force
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5658 Web Server Process Spawning Shell or LOLBin (T1190 Exploit Public-Facing Application)** (`TL-2026-5658-SPL-001`)

Behaviour-first detection of exploitation of internet-facing applications (T1190), the root cause of 26% of retail ransomware attacks in the Sophos State of Ransomware in Retail 2026 (highest of any sector). The source names no CVEs, so this rule keys on post-exploit behaviour common to any web-app/RCE exploit: IIS, Apache, nginx, Tomcat or PHP-CGI worker processes spawning cmd, PowerShell, script hosts or download/recon LOLBins.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```Exploit Public-Facing Application (T1190), TL-2026-5658: web server worker spawning a shell or LOLBin```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h@h
(ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\tomcat*.exe" OR ParentImage="*\\php-cgi.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe")
| stats count as event_count min(_time) as first_seen max(_time) as last_seen values(Image) as child_processes values(CommandLine) as command_lines by host, ParentImage, User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host User ParentImage child_processes command_lines event_count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe") or InitiatingProcessFileName startswith "tomcat"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe", "net.exe", "net1.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: TL-2026-5658 Web Server Process Spawning Shell or LOLBin
id: 7c1e4a52-3b0d-4f6e-9a21-5d8e0c3b7a11
status: experimental
description: Detects IIS, Apache, nginx, Tomcat or PHP-CGI worker processes spawning command shells, script hosts or recon/download LOLBins, a common post-exploitation indicator of exploited internet-facing applications (T1190).
references:
  - https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-retail-2026
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
  selection_tomcat:
    ParentImage|contains: '\tomcat'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: (selection_parent or selection_tomcat) and selection_child
falsepositives:
  - Web applications that legitimately shell out to cmd.exe or PowerShell for admin tasks
  - Vulnerability scanners and authorised penetration tests
level: high

```

**Known false positives:**

- Web applications that legitimately invoke cmd.exe or PowerShell (e.g. report generators, legacy admin panels)
- Authorised vulnerability scans or penetration tests against internet-facing hosts

**Tuning notes:** Baseline legitimate parent/child pairs per web tier for 14 days and exclude them by host and CommandLine. Add java.exe as a parent only on hosts known to run Tomcat/JBoss as a generic JVM. Prioritise alerts on internet-facing hosts and hosts missing recent vendor patches.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5658 Phishing Attachment Execution: Office or Mail Client Spawning Script Host (T1566.001) (locked: unlock with TL Creds)
- TL-2026-5658 Repeated MFA Denials Followed by Successful Entra ID Sign-in (T1621 / T1078.004) (locked: unlock with TL Creds)
- TL-2026-5658 Ransomware Note and Encrypted-File Extension Creation (T1486 / T1657) (locked: unlock with TL Creds)
- TL-2026-5658 Rclone Cloud Exfiltration Before Ransomware (T1567.002) (locked: unlock with TL Creds)
- TL-2026-5658 Connections To Community-Observed Related Infrastructure (T1071) (locked: unlock with TL Creds)
- TL-2026-5658 Security Tooling Tampering Before Ransomware Deployment (T1562.001) (locked: unlock with TL Creds)
- TL-2026-5658 Password Spray Followed by Successful Network Logon (T1110.003 / T1078) (locked: unlock with TL Creds)
- TL-2026-5658 Backup and Shadow Copy Destruction Before Encryption (T1490 / T1486) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The State of Ransomware in Retail 2026 (Sophos blog)](https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-retail-2026)
- [The State of Ransomware in Retail (Sophos white paper)](https://www.sophos.com/en-us/resources/white-papers/the-state-of-ransomware-in-retail)
- [Sophos State of Ransomware 2026 (cross-sector)](https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026)
- [Sophos State of Ransomware 2026 report (PDF)](https://assets.sophos.com/X24WTUEQ/at/jbww7pmb8n3gp99wr6hfq4/sophos-state-ransomware-report-2026.pdf)
- [Sophos State of Identity Security 2026](https://www.sophos.com/en-us/blog/sophos-state-of-identity-security-2026)
- [10 things we learned from the Sophos State of Ransomware in Retail 2025](https://techeconomy.ng/10-things-we-learned-from-the-sophos-state-of-ransomware-in-retail-2025/)
- [Sophos Fusion defense system overview](https://www.sophos.com/en-us/blog/sophos-fusion)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5658