Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2026-03-12 → 2026-03-18 UTC

Choose a report date

Observed events

171

Public claims in the selected week

Data leak indicators

121

70.8% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

Qilin generated the highest visible claim volume this week, representing 17.0% of observed events.

•

70.8% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Construction was the most represented sector in this window with 11 observed events.

•

2 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.

•

8 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

Coverage snapshot

As of 2026-03-18 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

Qilin

29 events · 14 leak indicators

LockBit 5.0

19 events · 19 leak indicators

Akira

15 events · 13 leak indicators

Gentlemen

15 events · 0 leak indicators

DragonForce

8 events · 8 leak indicators

Eraleignews

8 events · 8 leak indicators

Medusa

5 events · 4 leak indicators

PLAY

5 events · 5 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days

Exitium 2 events
Loki 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States74

Qilin18 events · 8 leak indicators
Akira8 events · 7 leak indicators
DragonForce5 events · 5 leak indicators
Medusa5 events · 4 leak indicators
PLAY5 events · 5 leak indicators
Sinobi5 events · 5 leak indicators
INC Ransom3 events · 1 leak indicator
Payouts King3 events · 3 leak indicators

Canada6

SAFEPAY2 events · 2 leak indicators
Akira1 event · 1 leak indicator
Embargo1 event · 1 leak indicator
Eraleignews1 event · 1 leak indicator
Lynx1 event · 1 leak indicator

France6

Gentlemen3 events · 0 leak indicators
Akira1 event · 1 leak indicator
Kairos1 event · 1 leak indicator
RansomHouse1 event · 1 leak indicator

Colombia5

Gentlemen3 events · 0 leak indicators
BlackShrantac1 event · 0 leak indicators
Qilin1 event · 0 leak indicators

Italy5

Akira1 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
LockBit 5.01 event · 1 leak indicator
NightSpire1 event · 1 leak indicator
Qilin1 event · 0 leak indicators

United Kingdom4

AiLock1 event · 1 leak indicator
Beast1 event · 1 leak indicator
Everest1 event · 1 leak indicator
Qilin1 event · 1 leak indicator

Czech Republic3

Gentlemen2 events · 0 leak indicators
Akira1 event · 0 leak indicators

Germany3

Akira1 event · 1 leak indicator
LockBit 5.01 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Construction11

Qilin4 events · 1 leak indicator
DragonForce2 events · 2 leak indicators
Sinobi2 events · 2 leak indicators
Lynx1 event · 1 leak indicator
PLAY1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator

Government Administration11

Eraleignews4 events · 4 leak indicators
LockBit 5.02 events · 2 leak indicators
Medusa2 events · 1 leak indicator
Exitium1 event · 1 leak indicator
Payload1 event · 1 leak indicator
XP951 event · 0 leak indicators

Hospitals and Health Care6

DragonForce1 event · 1 leak indicator
Eraleignews1 event · 1 leak indicator
FulcrumSec1 event · 1 leak indicator
Medusa1 event · 1 leak indicator
Payload1 event · 0 leak indicators
Qilin1 event · 0 leak indicators

Architecture and Planning5

Qilin2 events · 2 leak indicators
Chaos1 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
Termite1 event · 1 leak indicator

Law Practice5

LeakedData2 events · 2 leak indicators
INC Ransom1 event · 0 leak indicators
Kairos1 event · 1 leak indicator
LockBit 5.01 event · 1 leak indicator

Accounting4

Qilin3 events · 1 leak indicator
Akira1 event · 0 leak indicators

IT Services and IT Consulting4

Gentlemen3 events · 0 leak indicators
AiLock1 event · 1 leak indicator

Machinery Manufacturing4

Qilin2 events · 1 leak indicator
Akira1 event · 0 leak indicators
DragonForce1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

51-200 employees 42
11-50 employees 33
201-500 employees 24
2-10 employees 14
1,001-5,000 employees 11
501-1,000 employees 11

Notable actor profile updates

Active actor records only.

New ransom note observed

Tengu

2026-03-15 UTC

Adding ransom note

New actor infrastructure / contact channel

Everest

2026-03-16 UTC

Adding TOX ID

New vuln / TTP intelligence

Warlock

2026-03-16 UTC

Adding additional TTPs from Trend Micro's blog

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
Qilin	Accounting	United States	Data leak	2026-03-18
DragonForce	Construction	United States	Data leak	2026-03-18
DragonForce	Architecture and Planning	Austria	Data leak	2026-03-18
INTERLOCK	Industrial Machinery Manufacturing	United States	Data leak	2026-03-18
DragonForce	Construction	Switzerland	Data leak	2026-03-18
DragonForce	Furniture and Home Furnishings Manufacturing	Italy	Data leak	2026-03-18
DragonForce	Hospitals and Health Care	United States	Data leak	2026-03-18
Chaos	Financial Services	United States	Data leak	2026-03-18
DragonForce	Investment Management	United States	Data leak	2026-03-18
Insomnia	Medical Practice	United States	Data leak	2026-03-18
Akira	Furniture and Home Furnishings Manufacturing	Italy	Data leak	2026-03-18
Qilin	Civic and Social Organizations	Italy	Claim only	2026-03-18

News and research context

Recent articles from the same time window.

Beast Ransomware Toolkit: A Proactive Threat Intelligence Report 2026-03-18

Related actor: Beast

In March 2026, Team Cymru detected an Open Directory on 5.78.84[.]144 hosted at AS212317. Using Team Cymru’s NetFlow-augmented Open Ports collection, we detected a list of notable…

LeakNet ransomware uses ClickFix, Deno runtime in stealthy attacks 2026-03-18

Related actor: Leaknet Blog

The LeakNet ransomware gang is now using the ClickFix technique for initial access into corporate environments and deploys a malware loader based on the open-source Deno runtime f…

Payload ransomware group: mutex MakeAmericaGreatAgain | Derp 2026-03-18

Related actor: Payload

We reversed the Windows binary completely. Every code path, every crypto primitive, every command-line switch. The encryption uses Curve25519 key exchange paired with ChaCha20, an…

MediMap - Health NZ statement – Health New Zealand | Te Whatu Ora 2026-03-17

Health New Zealand is aware that MediMap, a privately owned and operated medication management platform, has taken its platform offline after identifying unauthorised activity wit…

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack 2026-03-16

Related actor: Warlock

We have identified new tactics, techniques, and procedures (TTPs) used by the Warlock ransomware group (tracked by TrendAI™ as Water Manaul). In our previous article, we detailed…

The ransomware economy is shifting toward straight-up data extortion | CyberScoop 2026-03-16

Ransomware remains a scourge that shows some signs of relenting, but incident responders and threat hunters are busier than ever as more financially-motivated attackers lean exclu…

The Snowflake Breach: How Missing MFA Handed Attackers the Keys to Everything | ThreatHunter.ai 2026-03-16

Related actor: Handala

Handala weaponized Microsoft Intune to remotely wipe Stryker Corporation across 61 countries. We built 10 Sigma rules, KQL queries, and OpenSearch queries covering the full attack…

Intuitive statement on cybersecurity incident 2026-03-16

Intuitive has determined that information from certain internal IT business applications was accessed by an unauthorized third party as the result of a targeted cybersecurity phis…

Loblaw Notifies Customers of a Low-Level Data Breach 2026-03-14

After identifying suspicious activity on a contained, non-critical part of its IT network, the Company has determined that a criminal third-party accessed some basic customer info…

Data Exfiltration and Threat Actor Infrastructure Exposed | Huntress 2026-03-14

Related actor: INC Ransom

Threat actors are people, too, and like everyone else, make mistakes. These mistakes can reveal insights into the threat actor, or even expose access to their infrastructure. I…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.