Q2 Ransomware Attacks Rise 3%, VPNs Targeted

Originally published on CyberNetSec.

Executive Summary

Global ransomware attacks continued to climb in the second quarter of 2026, increasing by 3% to a total of 2,229 incidents, as reported by NCC Group. The Qilin ransomware group maintained its position as the most prolific threat actor. A critical finding from the report is the continued dominance of corporate VPNs and other edge devices as the primary initial access vector for these attacks. Threat actors are systematically exploiting vulnerabilities in widely used VPN products to bypass perimeter defenses and gain an initial foothold in target networks. This underscores the urgent need for organizations to prioritize patching and hardening of all internet-facing infrastructure.

Threat Overview

The second quarter of 2026 saw a sustained high tempo of ransomware operations. NCC Group recorded 2,229 attacks, with 665 in June alone. The industrial sector was the most heavily impacted, accounting for 30% of all incidents, followed by consumer discretionary and information technology.

The key players in Q2 2026 were:

1. Qilin: 301 victims (14% of total)
2. The Gentlemen: 238 victims
3. DragonForce: 145 victims

A new Ransomware-as-a-Service (RaaS) group named KryBit also made its debut, claiming 56 victims. Geographically, North America was the most targeted region, suffering 44% of the attacks.

Technical Analysis

The report's most actionable intelligence for defenders is the focus on edge devices as the primary initial access vector. Ransomware groups including Qilin, Akira, and The Gentlemen are actively exploiting vulnerabilities in VPN products from major vendors such as Fortinet, SonicWall, Citrix, and Check Point. This tactic aligns with the MITRE ATT&CK technique T1190 - Exploit Public-Facing Application.

By exploiting a flaw in a VPN appliance, attackers can often bypass authentication mechanisms, including MFA, and gain direct access to the internal corporate network. This corresponds to T1133 - External Remote Services. Once inside, they proceed with standard ransomware TTPs: reconnaissance, lateral movement, privilege escalation, and eventual data exfiltration (T1048 - Exfiltration Over C2 Channel) and encryption (T1486 - Data Encrypted for Impact). NCC Group noted that VPN vulnerabilities accounted for roughly 15% of its high-priority threat alerts in 2026, indicating the severity and frequency of this attack vector.

Impact Assessment

The reliance on VPNs for remote work makes their exploitation a high-impact event. A successful breach can provide an attacker with a significant foothold inside the network perimeter, effectively neutralizing a key layer of defense. For the industrial sector, this is particularly dangerous as it can lead to attackers moving from the IT network to the OT network, potentially causing disruption to physical processes, production downtime, and safety risks. The financial and reputational damage from a successful ransomware attack remains substantial.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams should hunt for signs of VPN exploitation and compromise:
| Type | Value | Description | Context |
|---|---|---|---|
| log_source | VPN Server Logs | The primary source for detecting anomalous login activity. | Ingest into SIEM for correlation and alerting. |
| network_traffic_pattern | Logins from multiple geolocations for a single user in a short time | Indicates potential credential stuffing or account takeover. | VPN logs, Identity and Access Management (IAM) logs. |
| url_pattern | /api/v1/remediation (example for a specific CVE) | Exploit attempts often target specific, vulnerable API endpoints on VPN devices. | Web Application Firewall (WAF) logs, web server logs on the VPN appliance. |
| process_name | w3wp.exe or httpd spawning cmd.exe or powershell.exe | A web server process on the VPN appliance spawning a shell could indicate successful RCE. | EDR logs on the VPN appliance (if available). |

Detection & Response

• VPN Log Analysis: Continuously monitor VPN logs for failed login spikes, successful logins from suspicious IPs or countries, and impossible travel scenarios (D3-UGLPA: User Geolocation Logon Pattern Analysis).
• Network Baselining: Establish a baseline of normal traffic patterns for VPN user activity. Alert on significant deviations, such as a user accessing unusual internal resources or transferring large amounts of data.
• Endpoint Monitoring: Monitor endpoints for signs of lateral movement originating from the VPN user pool, such as widespread use of PsExec or WMI.

Mitigation

• Urgent Patching: Prioritize and accelerate the patching of all internet-facing edge devices, especially VPN concentrators. Subscribe to vendor security advisories (D3-SU: Software Update).
• MFA on VPN: Ensure that MFA is enabled for all VPN users. While some exploits can bypass MFA, it remains a critical defense against credential-based attacks (D3-MFA: Multi-factor Authentication).
• Network Segmentation: Do not treat the VPN user network as fully trusted. Implement network segmentation to limit which resources VPN users can access, restricting lateral movement opportunities post-compromise (D3-NI: Network Isolation).
• Reduce Attack Surface: If possible, replace broad VPN access with a Zero Trust Network Access (ZTNA) solution that grants access to specific applications rather than the entire network.