Government Ransomware Attacks Up 13% in H1 2026

#cybersecurity #ransomware #threatintelligence #cyberattack

Originally published on CyberNetSec.

Executive Summary

A new report from Comparitech reveals a significant increase in ransomware attacks targeting government entities globally. In the first half of 2026, 187 incidents were recorded, marking a 13% rise compared to the latter half of 2025. These attacks resulted in the breach of at least 179,000 records from the 89 incidents that were publicly confirmed. The United States remains the most targeted country, although it experienced a 23% decrease in attacks. The most notable development is the emergence of a new threat group, The Gentlemen, which has become the most active operator against government targets, responsible for 22 attacks. This trend highlights the public sector's continued vulnerability and the dynamic nature of the ransomware threat landscape, with new actors quickly rising to prominence.

Threat Overview

The first six months of 2026 have demonstrated that government agencies at all levels—national, state, and local—remain a prime target for ransomware gangs. The 13% increase in attacks indicates that defensive measures are struggling to keep pace with evolving offensive tactics. The attacks are geographically widespread, with incidents recorded across multiple continents.

Key findings from the report include:

Total Incidents: 187 attacks from January to June 2026.
Confirmed Incidents: 89 attacks were officially confirmed by the victims.
Data Breached: At least 179,000 records were compromised in the confirmed attacks.
Top Targeted Country: The United States with 58 incidents (31% of the total).
Other Affected Nations: Germany (9), France (8), and South Africa (6) were also heavily targeted.

Technical Analysis

While the report focuses on trends rather than technical details, the activity of the top threat actors provides insight into the tactics, techniques, and procedures (TTPs) being used.

The Gentlemen: This group's rapid ascent suggests an aggressive and effective operational model, likely a Ransomware-as-a-Service (RaaS) platform. Their TTPs are not detailed but likely involve common initial access vectors like phishing, exploitation of unpatched vulnerabilities, and stolen credentials. Their focus on government targets indicates a specific strategy, possibly due to perceived pressure points for payment.
Qilin: A known prolific RaaS operator, Qilin often uses phishing emails with malicious links as an initial access vector (T1566.002 - Spearphishing Link). They are known to be aggressive negotiators and employ double extortion tactics, leaking stolen data if the ransom is not paid.
LockBit: Despite internal turmoil and law enforcement disruption, LockBit remains a significant threat. The group has historically exploited vulnerabilities in public-facing applications (T1190 - Exploit Public-Facing Application) and used tools like Cobalt Strike for post-exploitation activities.

Common ransomware attack chain elements include:

Initial Access: Phishing, vulnerability exploitation, or stolen RDP/VPN credentials.
Execution & Persistence: Deployment of beacons, establishing persistent access.
Privilege Escalation: Exploiting local vulnerabilities to gain administrative rights.
Lateral Movement: Moving through the network to identify high-value data and systems.
Impact: Data exfiltration (T1041 - Exfiltration Over C2 Channel) followed by data encryption (T1486 - Data Encrypted for Impact).

Impact Assessment

The impact on government entities is multifaceted. Beyond the financial cost of ransom payments (e.g., Murray County's $200,000 payment), the disruption of public services is a primary consequence. This can affect citizen services, law enforcement operations, and administrative functions. The exfiltration of 179,000 records, which may contain sensitive citizen data, leads to privacy violations and a loss of public trust. The cost of recovery, including system restoration, cybersecurity consulting, and potential regulatory fines, often far exceeds the ransom demand itself. The decision by South Africa's Land and Agricultural Development Bank to refuse a $3.1 million demand and restore from backups demonstrates that with proper preparation, payment can be avoided, though recovery can still be a lengthy process.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Detection & Response

Detecting and responding to these threats requires a multi-layered defense. (D3FEND: Network Traffic Analysis, User Behavior Analysis)

Network Monitoring: Monitor for unusual outbound traffic, which could indicate data exfiltration. Look for connections to known malicious IP addresses or Tor exit nodes.
Endpoint Detection (EDR): Deploy EDR to detect common ransomware behaviors such as the rapid modification/encryption of files, deletion of volume shadow copies (vssadmin.exe delete shadows /all /quiet), and disabling of security tools.
Log Analysis: Centralize and analyze logs from domain controllers, VPNs, and critical servers. Look for brute-force login attempts, suspicious account lockouts, and the use of tools like PsExec for lateral movement.

Mitigation

Government agencies should prioritize the following controls to defend against ransomware. (D3FEND: Application Hardening, Network Isolation)

Patch Management: Aggressively patch internet-facing systems and critical vulnerabilities, particularly those listed in CISA's KEV catalog. (M1051 - Update Software)
Multi-Factor Authentication (MFA): Enforce MFA on all remote access services (VPN, RDP), email accounts, and critical system logins to prevent credential-based attacks. (M1032 - Multi-factor Authentication)
Network Segmentation: Segment networks to prevent attackers from moving laterally. Isolate critical systems from the general user network and restrict access between segments. (M1030 - Network Segmentation)
Immutable Backups: Maintain offline, immutable, and regularly tested backups. A robust backup strategy is the most effective defense against extortion, enabling restoration without payment. (M1053 - Data Backup)
User Training: Conduct regular security awareness training to educate employees on identifying and reporting phishing attempts. (M1017 - User Training)