Observation window 2026-10-19T00:00:00.000Z through 2026-10-26T00:00:00.000Z (exclusive UTC). This frozen digest describes provider-observed claim cadence for one complete ISO week; it is not an incident confirmation, targeting evidence, attribution, or a prediction of future risk.
Source coverage: Incomplete source coverage: 1 of 6 contributing sources was not fully up to date when this digest was built: Darkfield (failing, no successful refresh since the week ended). Claims those sources had not delivered for this week or its 8-week baseline are not counted, so totals can be too low, some signals can be missed, and a drop caused by a source outage can look like a real change.
Providers newly observed 9 claims attributed to N0n in the target week, versus an 8-week median of 1.
Why this appeared: Target 9 ≥ 4 and ≥ 2× the median (1) and exceeds it by ≥ 3.
Providers newly observed 7 claims attributed to Whitearmor in the target week, versus an 8-week median of 0.
Why this appeared: Target 7 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
Providers newly observed 5 claims attributed to lamashtu in the target week, versus an 8-week median of 0.
Why this appeared: Target 5 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
Providers newly observed 5 claims attributed to payload in the target week, versus an 8-week median of 0.
Why this appeared: Target 5 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
Whitearmor first qualified as emerging within this ISO week, with 7 newly observed claims. Dates describe provider observations, not when the operation began.
Why this appeared: Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "emerging".
whitearmor first qualified as emerging within this ISO week, with 3 newly observed claims. Dates describe provider observations, not when the operation began.
Why this appeared: Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "emerging".
Providers newly observed 7 claims attributed to ShadowByt3$ in the target week, versus an 8-week median of 0.
Why this appeared: Target 7 ≥ 4 and ≥ 2× the median (0) and exceeds it by ≥ 3.
Mimori first qualified as emerging within this ISO week, with 2 newly observed claims. Dates describe provider observations, not when the operation began.
Why this appeared: Qualifying tracker-first discovery timestamp falls inside the target ISO week; emergence derivation returned "emerging".
Related: all weekly signal digests, country and sector activity profiles, and the claim-publishing calendar for the surrounding weeks.
How to cite: Dragons Eye Ransomware Tracker, “Week in Ransomware 2026-W43”, provider-observed ransomware claim data as of 2026-11-02, this page's URL. Keep the observed-claim caveat with any reused figures; the methodology documents the evidence model and the data-quality dashboard quantifies screening and exclusions.
Ordered by measured change and, where available, AI-prioritized; every fact is calculated deterministically from provider observations. Records are provider-reported claims, not confirmed incidents. Source: reconciled leak-site victim claims across independent providers.
Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.
Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.
The weekly digest figures on this page are stored digest records, each with its own dataset anchor and publication time; the snapshot's dataset version does not cover them. Prerender data snapshot built (dataset version sig-c8140e6930616b9f0c8a1e58f11be44ebebfb4fe8a82be4757d96f7e38bf4737).