Week in Ransomware — 2026-W37

Observation window 2026-09-07T00:00:00.000Z through 2026-09-14T00:00:00.000Z (exclusive UTC). This frozen digest describes provider-observed claim cadence for one complete ISO week; it is not an incident confirmation, targeting evidence, attribution, or a prediction of future risk.

Ranked signals

standout: storm newly observed claims rose to 26 this week

Providers newly observed 26 claims attributed to storm in the target week, versus an 8-week median of 0.

Why this appeared: Target 26 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.

standout: kazu newly observed claims rose to 17 this week

Providers newly observed 17 claims attributed to kazu in the target week, versus an 8-week median of 0.

Why this appeared: Target 17 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.

standout: No new claims were observed for krybit this week

krybit had no newly observed claims in the target week after a baseline median of 6 per week across 8 of the prior 8 weeks. This describes provider observations only, not whether the group stopped operating.

Why this appeared: Target 0 claims with baseline median 6 ≥ 3 and activity in 8 ≥ 5 of 8 baseline weeks; all baseline providers healthy.

notable: No new claims were observed for Storm this week

Storm had no newly observed claims in the target week after a baseline median of 6 per week across 5 of the prior 8 weeks. This describes provider observations only, not whether the group stopped operating.

Why this appeared: Target 0 claims with baseline median 6 ≥ 3 and activity in 5 ≥ 5 of 8 baseline weeks; all baseline providers healthy.

notable: No new claims were observed for dragonforce this week

dragonforce had no newly observed claims in the target week after a baseline median of 4 per week across 8 of the prior 8 weeks. This describes provider observations only, not whether the group stopped operating.

Why this appeared: Target 0 claims with baseline median 4 ≥ 3 and activity in 8 ≥ 5 of 8 baseline weeks; all baseline providers healthy.

notable: black nevas newly observed claims rose to 13 this week

Providers newly observed 13 claims attributed to black nevas in the target week, versus an 8-week median of 0.

Why this appeared: Target 13 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.

context: AuditTeam newly observed claims rose to 6 this week

Providers newly observed 6 claims attributed to AuditTeam in the target week, versus an 8-week median of 0.

Why this appeared: Target 6 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.

context: No new claims were observed for coinbase cartel this week

coinbase cartel had no newly observed claims in the target week after a baseline median of 4 per week across 8 of the prior 8 weeks. This describes provider observations only, not whether the group stopped operating.

Why this appeared: Target 0 claims with baseline median 4 ≥ 3 and activity in 8 ≥ 5 of 8 baseline weeks; all baseline providers healthy.

Related: all weekly signal digests, country and sector activity profiles, and the claim-publishing calendar for the surrounding weeks.

How to cite: Dragons Eye Ransomware Tracker, “Week in Ransomware 2026-W37”, provider-observed ransomware claim data as of 2026-09-16, this page's URL. Keep the observed-claim caveat with any reused figures; the methodology documents the evidence model and the data-quality dashboard quantifies screening and exclusions.

Ordered by measured change and, where available, AI-prioritized; every fact is calculated deterministically from provider observations. Records are provider-reported claims, not confirmed incidents. Source: reconciled leak-site victim claims across independent providers.

Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.

Intelligence overview

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.