InfoSecBulletin Cybersecurity for mankind
2025 ends but in the first week of 2026 a handsome figure of victims have been listed a victims of ransomware attack. Nearly about 10 groups are active for the very first week. Quin, play, direwolf, handala are some notable ones.
Accroding to ransomware.live as of 5 january of 2026, 42 organizations are in the queue of victims by 308 ransomware groups. Recent analysis reveals that a few threat groups account for most ransomware attacks, with Qilin being the most active and having the highest number of victims.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Qilin is the main threat actor, responsible for around 14 victims, making it the most active group during this time.
Play and Direwolf are secondary threats, each causing about 7 victims, showing less activity compared to Qilin.
Handala has moderate activity, with around 5 victims, making it a mid-tier threat.
DragonForce and Incransom show some activity, with about 3 victims each, indicating they may be engaging in opportunistic or targeted attacks.
LockBit5, Sinobi, and Everest show minimal activity around 1 victim each.
