Q2 2026 Ransomware Report: Supply Chain Attacks Rise

Originally published on CyberNetSec.

Executive Summary

An NCC Group threat intelligence report for the second quarter of 2026 reveals a 3% increase in global ransomware attacks, totaling 2,229 incidents. The report underscores a strategic pivot by threat actors towards compromising software supply chains, a method that amplifies the impact of a single breach. The industrial sector was the primary target (30%), followed by consumer discretionary (24%) and IT (11%). North America experienced the highest volume of attacks (44%). The ransomware landscape remains dominated by established groups, with Qilin leading for the fifth consecutive quarter, followed by The Gentlemen and DragonForce.

---

Threat Overview

Published on July 27, 2026, the NCC Group report details a continued escalation in ransomware activity. The 2,229 attacks in Q2 represent a slight but steady increase from the 2,165 incidents in Q1. The most significant finding is the attackers' growing focus on the software supply chain. By exploiting transitive trust in software development and distribution channels, threat actors can compromise a single software vendor or open-source project and infect all dependent organizations. The report references the March 2026 Trivy compromise, where stolen credentials led to the breach of Cisco's development environment, as a stark example of this cascading effect. Internet-facing infrastructure, such as corporate VPNs, also continues to be a primary initial access vector.

Technical Analysis

The attack methodology described involves a sophisticated understanding of modern development practices. Threat actors are targeting build pipelines, code repositories, and software update mechanisms.

TTPs and MITRE ATT&CK Mapping

• Initial Access: Attackers are using T1195.001 - Compromise Software Supply Chain: Compromise Software Dependencies and Development Tools by infiltrating build environments. They also continue to leverage T1190 - Exploit Public-Facing Application against VPNs and other edge devices.
• Execution: Once inside, they likely use standard execution techniques such as T1059.003 - Command and Scripting Interpreter: Windows Command Shell to move through the network.
• Impact: The final stage involves deploying ransomware using T1486 - Data Encrypted for Impact and exfiltrating data for double extortion with T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage.

The most active groups identified were:

• Qilin: 301 attacks
• The Gentlemen: 238 attacks
• DragonForce: 145 attacks
• Akira: 127 attacks
• LockBit5: 104 attacks (Note: Likely a continuation of the LockBit brand)
• INC Ransom: 103 attacks

Impact Assessment

The shift towards supply chain attacks represents a significant increase in systemic risk. A single breach at a popular software provider can lead to thousands of downstream victims, causing widespread disruption. For the industrial sector, this could mean halting production lines, while for the IT sector, it could lead to service outages and further compromises of their own customers. The financial impact extends beyond ransom payments to include incident response costs, regulatory fines, and reputational damage. The high concentration of attacks in North America suggests a focus on mature economies with a higher capacity to pay ransoms.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect potential supply chain or ransomware activity:
| Type | Value | Description |
|---|---|---|
| command_line_pattern | git clone ... or npm install ... from unusual IPs | Suspicious activity in build servers or developer environments. |
| process_name | vssadmin.exe delete shadows | A common precursor to ransomware execution to prevent recovery. |
| network_traffic_pattern | Large data uploads to known cloud storage providers (e.g., Mega, pCloud) from servers that do not typically perform such actions. | Potential data exfiltration for double extortion. |
| log_source | CI/CD Pipeline Logs | Monitor for unauthorized access, unexpected build steps, or modifications to build scripts. |

Detection & Response

Detecting supply chain attacks requires a defense-in-depth approach focused on development environments.

1. Monitor Build Environments: Implement strict monitoring of CI/CD pipelines. Look for anomalous commands, unauthorized access to code repositories, and changes to build configurations. Use D3FEND Process Analysis to baseline normal build processes and alert on deviations.
2. Endpoint Detection and Response (EDR): Deploy EDR solutions on developer workstations and build servers. Monitor for common ransomware precursors, such as the deletion of volume shadow copies (vssadmin) or disabling of security tools.
3. Network Traffic Analysis: Use D3FEND Network Traffic Analysis to monitor for unusual outbound connections from sensitive internal systems, especially large data transfers to cloud storage platforms.

Mitigation

Mitigating supply chain and ransomware threats requires both technical controls and process hardening.

1. Harden Development Environments: Secure CI/CD pipelines by enforcing the principle of least privilege. Use signed commits and require multi-factor authentication for code repository access. This aligns with D3FEND Application Configuration Hardening.
2. Software Bill of Materials (SBOM): Maintain a detailed SBOM for all applications to quickly identify dependencies and assess the impact of a compromised component. This is a key part of M1051 - Update Software.
3. Network Segmentation: Isolate development environments from corporate networks to prevent lateral movement. This D3FEND Network Isolation measure can contain a breach within the development network.
4. Immutable Backups: Ensure critical data and systems are backed up to an isolated, immutable storage location. Regularly test restoration procedures to ensure recovery is possible after an attack.