On or about June 16, 2026, an unauthorized threat actor gained access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”).…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2026-06-24 → 2026-06-30 UTC
Choose a report date
Observed events
175
Public claims in the selected week
Data leak indicators
75
42.9% of observed events
Active actors
39
Distinct groups with observed activity
Torrent-linked events
0
Events intersecting with torrent intelligence
What changed this week?
•
Gentlemen generated the highest visible claim volume this week, representing 18.3% of observed events.
•
42.9% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 12 observed events.
•
6 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
1 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.
Coverage snapshot
As of 2026-06-30 UTC.
Leak sites observed this week
39
Leak sites online near report date
1
Threat actor profiles updated this week
29
Countries represented this week
45
Sectors represented this week
73
Top active actors
By observed claim volumeGentlemen
32 events · 1 leak indicator
SETTRA
22 events · 8 leak indicators
Qilin
18 events · 12 leak indicators
Bavacai
10 events · 1 leak indicator
INC Ransom
8 events · 5 leak indicators
Akira
7 events · 3 leak indicators
CMD Organization
6 events · 5 leak indicators
DragonForce
6 events · 6 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- SETTRA 22 events
- Booba Project 4 events
- BlackNevas 2 events
- REDACT 2 events
- BlackField 1 event
- UnSafe 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States70
- SETTRA16 events · 5 leak indicators
- Akira7 events · 3 leak indicators
- Gentlemen7 events · 0 leak indicators
- Qilin6 events · 5 leak indicators
- INC Ransom5 events · 3 leak indicators
- PLAY4 events · 2 leak indicators
- Chaos3 events · 3 leak indicators
- CMD Organization3 events · 2 leak indicators
Germany12
- Gentlemen3 events · 1 leak indicator
- Qilin3 events · 2 leak indicators
- LockBit 5.02 events · 1 leak indicator
- Anubis1 event · 0 leak indicators
- Aur0ra1 event · 0 leak indicators
- SAFEPAY1 event · 1 leak indicator
- UnSafe1 event · 0 leak indicators
France8
- Gentlemen5 events · 0 leak indicators
- PEAR1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
- SETTRA1 event · 0 leak indicators
Canada6
- Bavacai2 events · 0 leak indicators
- Qilin2 events · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- INTERLOCK1 event · 1 leak indicator
Italy5
- Gentlemen2 events · 0 leak indicators
- DeadLock1 event · 1 leak indicator
- INC Ransom1 event · 0 leak indicators
- Stormous1 event · 1 leak indicator
Spain4
- Booba Project2 events · 1 leak indicator
- DeadLock1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
Taiwan4
- BlackField1 event · 0 leak indicators
- DragonForce1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- SETTRA1 event · 0 leak indicators
India3
- BlackNevas1 event · 0 leak indicators
- INC Ransom1 event · 1 leak indicator
- RALord1 event · 1 leak indicator
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction12
- Gentlemen3 events · 0 leak indicators
- SETTRA3 events · 2 leak indicators
- Akira1 event · 0 leak indicators
- Booba Project1 event · 0 leak indicators
- Chaos1 event · 1 leak indicator
- Gunra1 event · 0 leak indicators
- PLAY1 event · 0 leak indicators
- RansomHouse1 event · 1 leak indicator
IT Services and IT Consulting12
- Qilin3 events · 1 leak indicator
- LockBit 5.02 events · 2 leak indicators
- SETTRA2 events · 0 leak indicators
- Audit Team1 event · 1 leak indicator
- Booba Project1 event · 1 leak indicator
- Gunra1 event · 0 leak indicators
- Payload1 event · 1 leak indicator
- PLAY1 event · 1 leak indicator
Law Practice7
- INC Ransom4 events · 2 leak indicators
- Gentlemen1 event · 0 leak indicators
- Morpheus1 event · 0 leak indicators
- PEAR1 event · 0 leak indicators
Hospitals and Health Care6
- Anubis1 event · 0 leak indicators
- Bavacai1 event · 0 leak indicators
- BravoX1 event · 1 leak indicator
- CMD Organization1 event · 0 leak indicators
- DragonForce1 event · 1 leak indicator
- INTERLOCK1 event · 1 leak indicator
Industrial Machinery Manufacturing6
- SETTRA2 events · 1 leak indicator
- Akira1 event · 1 leak indicator
- DragonForce1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- Stormous1 event · 0 leak indicators
Legal Services5
- Gentlemen2 events · 0 leak indicators
- Anubis1 event · 0 leak indicators
- Genesis1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
Food and Beverage Manufacturing4
- DragonForce1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- Qilin1 event · 0 leak indicators
- SETTRA1 event · 0 leak indicators
Real Estate4
- Gentlemen2 events · 0 leak indicators
- AiLock1 event · 1 leak indicator
- Chaos1 event · 1 leak indicator
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 51-200 employees 41
- 11-50 employees 37
- 2-10 employees 20
- 501-1,000 employees 18
- 201-500 employees 17
- 1,001-5,000 employees 16
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
REDACT
2026-06-28 UTC
Adding TOX ID
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| Gentlemen | Facilities Services | France | Claim only | 2026-06-30 |
| Aur0ra | Medical Equipment Manufacturing | Germany | Claim only | 2026-06-30 |
| PLAY | Construction | United States | Claim only | 2026-06-30 |
| Chaos | Oil and Gas | United States | Data leak | 2026-06-30 |
| Gentlemen | Sporting Goods Manufacturing | China | Claim only | 2026-06-30 |
| Gentlemen | Outsourcing and Offshoring Consulting | France | Claim only | 2026-06-30 |
| Gentlemen | Real Estate | Canada | Claim only | 2026-06-30 |
| Gentlemen | Legal Services | United States | Claim only | 2026-06-30 |
| Gentlemen | Legal Services | Israel | Claim only | 2026-06-30 |
| Gentlemen | Government Administration | United States | Claim only | 2026-06-30 |
| Brain Cipher | Pharmaceutical Manufacturing | United States | Claim only | 2026-06-30 |
| Genesis | Legal Services | United States | Claim only | 2026-06-30 |
News and research context
Recent articles from the same time window.
The Chelan County Clerk's Office put out an update Tuesday on progress made to recover after the county computer systems suffered a malware attack that caused a systemwide disrupt…
Related actor: Payouts King
Zscaler ThreatLabz has been monitoring ransomware operations that align with tactics previously employed by an initial access broker affiliated with Payouts King ransomware. In re…
Bajaj Auto shares fall over 2% after disclosing ransomware attack on company, subsidiary systems
2026-06-24
Shares of Bajaj Auto fell more than 2% in today's session after the company disclosed a ransomware attack that impacted the systems of the automaker and its wholly owned subsidiar…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.