NCC Group records 2,865 ransomware victim claims in Q3 2026, up 23%

NCC Group recorded 2,865 ransomware victim claims in the third quarter of 2026, up 23% from 2,325 in the second quarter, according to its Cyber Threat Intelligence Report Review of Q3 2026. The industrial sector accounted for 29% of quarterly attacks, the report said.

September attacks fall

Attacks declined 26% month on month in September to 821. North America recorded the most that month with 390, followed by Europe with 211. Qilin remained the most active group for the sixth consecutive quarter with 365 victims. The Gentlemen followed with 356 and INC Ransom with 109.

Critical infrastructure disruption

The report highlighted a July cyber attack against a small UK power generation facility that forced operations to stop for about four days. The incident did not affect the national electricity grid. The report said the techniques were consistent with those previously associated with Iranian-affiliated campaigns, including attacks against internet-exposed industrial controllers. The UK government has not formally attributed the attack, and the techniques remain unconfirmed.

The report also pointed to the seam between IT and operational technology, where remote maintenance and centralized management connect plant networks to office systems. It recommended network segmentation, stronger privileged-access controls and continuous monitoring of OT environments.

Exploited flaws and access brokers

More than 40 vulnerabilities affecting enterprise applications, VPN appliances, e-mail gateways and management platforms joined CISA's Known Exploited Vulnerabilities Catalog during the quarter, the report said. Gunra, a ransomware-as-a-service operation, had targeted 53 victims across multiple industries by the end of Q3. It exploited CVE-2024-55591 and CVE-2025-24472 in internet-facing Fortinet devices, then used stolen credentials, session hijacking and administrative tools to move between systems before deploying ransomware.

Initial access brokers advertised compromised VPN, Remote Desktop Protocol and SSH access, along with access to cloud identities, source code repositories and security management platforms. Other emerging groups included Deadlock and Storm, with Storm claiming 78 victims by the end of September.

AI tools in the attack chain

NCC Group described BraZetsu, an AI-enhanced Windows malware framework that evolved into a specialized initial access toolkit. The report said it uses AI models to automate victim profiling, analyze compromised environments and identify valuable corporate systems. It searches for enterprise software, financial data, digital certificates and cloud credentials, helping operators sell compromised access to other criminals.

The report also flagged risks from legitimate AI agents, including prompt injection, excessive permissions and unintended access to external systems. It cited incidents involving U.S. and Australian government systems as examples of agents accessing resources beyond their intended scope. Researchers said those incidents do not necessarily involve malicious intent but can create consequences resembling conventional cyber intrusions.

NCC Group's recommendations focus on the basics: segment networks, control privileged access and monitor OT environments continuously. The report's figures show why those controls matter. A single exposed appliance or stolen credential can still open a path to encryption and extortion.