Week in Ransomware — weekly signals
Automated detection and ranking of meaningful week-over-week changes in reconciled ransomware claim observations: group activity spikes and pauses, sector and country share shifts, newly emerging groups, and high-water weeks.
Latest digest: 2026-W40
Observation window 2026-09-28T00:00:00.000Z through 2026-10-05T00:00:00.000Z (exclusive). 13,403 canonical claim records; ranking method: ai.
- standout: No new claims were observed for direwolf this week — Target 0 claims with baseline median 6 ≥ 3 and activity in 7 ≥ 5 of 8 baseline weeks; all baseline providers healthy.
- notable: Bavacai newly observed claims rose to 31 this week — Target 31 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
- context: Majinahanashi newly observed claims rose to 18 this week — Target 18 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
- context: Imnotavillian was newly observed by providers this week — Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "emerging".
- notable: vypr was newly observed by providers this week — Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "emerging".
- context: No new claims were observed for leakeddata this week — Target 0 claims with baseline median 6 ≥ 3 and activity in 7 ≥ 5 of 8 baseline weeks; all baseline providers healthy.
- context: global cybernetic collective was newly observed by providers this week — Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "emerging".
- context: ZaWoo newly observed claims rose to 18 this week — Target 18 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
Archive
- 2026-W40 — 8 signals, published 2026-10-06
- 2026-W39 — 8 signals, published 2026-09-29
- 2026-W38 — 8 signals, published 2026-09-22
- 2026-W37 — 8 signals, published 2026-09-16
- 2026-W36 — 8 signals, published 2026-09-09
- 2026-W35 — 8 signals, published 2026-09-01
- 2026-W34 — 8 signals, published 2026-08-26
- 2026-W33 — 8 signals, published 2026-08-18
- 2026-W32 — 8 signals, published 2026-08-11
Related: observed activity profiles by country and sector, the year-long claim-publishing calendar, and monthly State of Ransomware reports for longer horizons.
How to cite: Dragons Eye Ransomware Tracker, “Week in Ransomware — weekly signals”, provider-observed ransomware claim data as of 2026-10-06, this page's URL. Keep the observed-claim caveat with any reused figures; the methodology documents the evidence model and the data-quality dashboard quantifies screening and exclusions.
Ordered by measured change and, where available, AI-prioritized; every fact is calculated deterministically from provider observations. Records are provider-reported claims, not confirmed incidents. Source: reconciled leak-site victim claims across independent providers.
Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.
Intelligence overview
Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.