Week in Ransomware — weekly signals

Automated detection and ranking of meaningful week-over-week changes in reconciled ransomware claim observations: group activity spikes and pauses, sector and country share shifts, newly emerging groups, and high-water weeks.

Latest digest: 2026-W34

Observation window 2026-08-17T00:00:00.000Z through 2026-08-24T00:00:00.000Z (exclusive). 9,151 canonical claim records; ranking method: ai.

• standout: IT rose to 9.6% of this week's observations — Target 25 ≥ 5, share 9.6% ≥ 1.5× baseline (3.5%), and absolute share up 6.1 ≥ 5 points.
• standout: direwolf newly observed claims rose to 21 this week — Target 21 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
• standout: xpl0itrs newly observed claims rose to 16 this week — Target 16 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
• notable: No new claims were observed for chaos this week — Target 0 claims with baseline median 3 ≥ 3 and activity in 7 ≥ 5 of 8 baseline weeks; all baseline providers healthy.
• context: No new claims were observed for cmd organization this week — Target 0 claims with baseline median 3 ≥ 3 and activity in 6 ≥ 5 of 8 baseline weeks; all baseline providers healthy.
• context: Iah647 was newly observed by providers this week — Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "emerging".
• context: DYSPHOR1A was newly observed by providers this week — Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "watch".
• context: AUR0RA was newly observed by providers this week — Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "watch".

Archive

• 2026-W34 — 8 signals, published 2026-08-26
• 2026-W33 — 8 signals, published 2026-08-18
• 2026-W32 — 8 signals, published 2026-08-11

Related: observed activity profiles by country and sector, the year-long claim-publishing calendar, and monthly State of Ransomware reports for longer horizons.

How to cite: Dragons Eye Ransomware Tracker, “Week in Ransomware — weekly signals”, provider-observed ransomware claim data as of 2026-08-26, this page's URL. Keep the observed-claim caveat with any reused figures; the methodology documents the evidence model and the data-quality dashboard quantifies screening and exclusions.

Ordered by measured change and, where available, AI-prioritized; every fact is calculated deterministically from provider observations. Records are provider-reported claims, not confirmed incidents. Source: reconciled leak-site victim claims across independent providers.

Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.

Intelligence overview

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.