Ransomware groups that have been newly observed have been driving a significant portion of the increase in public extortion claims during the third quarter of 2026, as reported by external threat intelligence from ReliaQuest’s Threat Research team. However, researchers cautioned that the rise in leak-site listings does not necessarily indicate an increase in successful attacks. The findings focus on third-party threats and the broader threat landscape, not vulnerabilities or incidents that affect ReliaQuest’s systems.
Researchers identified that newly observed groups could potentially be legitimate operations, rebrands, affiliate breakaways, or actors publishing recycled data or unsupported allegations. The total number of organizations listed on data leak sites by sector, Q3 2026 (Source: reliaquest) Storm reported 71 organizations across 20 days in August and September, surpassing DragonForce's 69 and LockBit's 62. Its appearance, roughly five weeks after similarly named Stormous stopped posting, raises an unconfirmed possibility of rebranding.
ExfilSquad demonstrated the importance of careful scrutiny of public claims. Its JSON samples revealed sensitive information such as employee names, email addresses, phone numbers, work locations, and general customer relationship management details. The missed publication deadlines and lack of sample listings further weakened the claims, but neither observation ruled out unauthorized access.
They exploited internet-facing systems, used vulnerable drivers to disable endpoint detection and response tools, and changed Group Policy settings to distribute ransomware.
