Bitdefender, one of the world leaders in cybersecurity, published its September Threat Debrief on ransomware. According to the report, attackers claimed 1,000 victims in August 2026. This is the second-highest figure since Bitdefender started tracking such attacks in detail in 2023.
The number of active groups grew from 66 to 83 in a month, that is, by 25%. In other words, the cybercrime market is expanding, and the entry barrier keeps falling.
Ransomware: key findings of the report
- Qilin leads by number of attacks. In August alone, the group claimed 166 victims. It mostly targets Germany, France, Italy and North America. The top ten also includes The Gentlemen, Clop, DireWolf, KryBit and Akira.
- ShinyHunters attacks without encryption: it steals data and demands a ransom. The group has not encrypted systems for several months. Instead, it steals OAuth/SSO credentials through social engineering and voice phishing (vishing) and pulls data through Okta SSO, Salesforce and Snowflake. In four days, it claimed the theft of more than 200 million records from a medical organization and demanded a $55 million ransom.
- Clop breaks in through flaws in corporate software. In its second campaign of 2026, the group claimed more than 40 victims. It uses the critical flaw CVE-2026-12569 in PTC Windchill and FlexPLM, which allows remote code execution without authentication.
- Medusa turns off security tools. The group passed 500 victims and targets the public sector, retail and manufacturing. It enters through remote access services and disables EDR with special utilities (EDR killers).
- Manufacturing is the most attacked sector. Construction and legal services follow. Among countries, the US leads, while Italy saw an unprecedented rise in attacks.
Why it matters for Ukraine
The report mainly covers Western countries, but the same methods work in Ukraine too. According to CERT-UA, Ukraine recorded 3,137 cyber incidents in the first half of 2026, which is 8% more than half a year earlier. Also, artificial intelligence lowers the entry barrier for hackers.
The main conclusion: backups are no longer enough. If an attacker steals data instead of encrypting it, a backup will not help. Therefore, you need to protect access, accounts and the channels through which data can leave the company.
Bitdefender recommendations
- audit the use of OAuth in integrated platforms;
- segment systems, use separate accounts for each platform and require re-authentication in every session;
- limit token creation and shorten token lifetime;
- change credentials in systems that may be at risk;
- install updates for PTC Windchill and FlexPLM.
Read also: Kyiv data centers under attack: why government services survived; Microsoft releases an out-of-band Exchange Server update; Hackers attack Cisco email gateways through attachments.
How S-byte helps protect against ransomware
- Information security audit. We find vulnerable remote access services, outdated components and weak settings before attackers do.
- Multi-factor authentication and access management (RSA Security). We deploy RSA ID Plus and RSA Governance & Lifecycle. This makes attacks with stolen passwords, social engineering and vishing much harder.
- Endpoint and network protection (Trend Micro, Cisco). We integrate solutions that detect attempts to disable protection and unusual data transfers.
- ISS building and authorization and ISO/IEC 27001 compliance. We build processes for risk management, incident response and access control.
- Cloud solutions and backups. We keep your business running even if an attack succeeds.
Ransomware now works like a business, so protection must be systematic too. Contact S-byte to check how ready your company is for modern attacks.