- Halcyon counted 2,766 ransomware attack claims from July to September 2026, nearly 40% more than the prior quarter. Claims are not confirmed attacks.
- Halcyon says AI has not changed how most groups attack but lets skilled operators move faster. Its report also describes attackers targeting backups and network management systems.
- Leaders should test whether backups survive an attacker with admin access, and ask how fast their team patches management systems against Halcyon's three-day average from disclosure to exploitation.
The safety net is now part of the target
Most companies treat backups as the last line of defence. Ransomware gets in, you restore from backup, and you carry on. Halcyon's report on the third quarter of 2026 suggests attackers know that plan.
Between July and September, Halcyon counted 2,766 ransomware claims. They came from 111 groups and named victims in 122 countries. That is nearly 40% above the previous three months. August alone passed 1,000 claims, which Halcyon calls a record.
A caution comes first. These are posts by criminal groups, not confirmed breaches. Wired notes that victims do not always disclose incidents and that attackers inflate their numbers. Even so, Wired says researchers who track leak sites agree that claims spiked over the summer.
What AI changed, and what it did not
Halcyon is measured on this point. Most groups still attack as they did before. But it finds it hard to believe the rise owes nothing to AI. Skilled crews can now work faster and reach more victims.
Halcyon points to a report by Anthropic for one example. AI agents did nearly all the work in a run of about 34 hours. The haul was more than 2,100 sets of Azure AD tokens from over 40 tenants. Tokens are digital passes that show a user has already signed in. Halcyon adds that operators often left unfamiliar systems for the AI to work out.
Halcyon describes another actor who used an AI coding assistant to build and launch a large credential-theft campaign. The job took under six hours.
The picture is not one-sided. Halcyon says most AI-linked malware saw limited use. In one study of 405 such samples, only 12 showed up on protected machines. Security software detected every one of them.
Allan Liska of Recorded Future told Wired that successful groups are still largely run by humans. He warned that heavy AI experimentation could change that quickly. The fair reading is that AI helps people who already know the craft.
Three days to patch
Halcyon found that attackers exploited new flaws about three days after disclosure, on average. That is its average across new flaws in general, not a figure for any one kind of system. How long does your own patch cycle take?
Halcyon also reports that five flaws in management-layer systems came under active attack in a single September week. These are the tools used to run networks.
That is the second lesson. A Qilin affiliate broke into a Cisco Secure Firewall Management Center through a flaw involving a fixed built-in login. The attacker then used the product's own tools to take domain credentials. Next, Qilin ransomware was pushed across the Windows domain. The console administrators use to control the network became the attacker's launch point.
Attackers are reaching offsite backups
Halcyon says attackers have moved beyond local shadow copies. Those are quick restore points kept on the machine itself. Now they go after offsite and disaster-recovery copies.
An August advisory from the FBI and CISA described Gunra actors erasing backups at primary and disaster-recovery sites. Halcyon says affiliates of The Gentlemen tried more than 200 command variants to shut down backup software from Veeam and Backup Exec. Another group, Settra, deleted recovery partitions while it encrypted files.
Halcyon has cautioned that backups alone do not ensure recovery. The lesson here is that a backup protects you only if an intruder with administrator access cannot reach it. Has your team ever tested that?
Where the pressure landed
The United States accounted for more than 1,100 claims, roughly two in every five. Activity spread from 101 countries last quarter to 122. Wired quotes Halcyon's Cynthia Kaiser saying most of the recent rise was international. She believes AI is partly behind it.
Healthcare attacks rose 40%, Halcyon reports, and health technology firms saw nearly three times as many. Trackers counted a 36% rise against government bodies. Twelve government bodies disclosed how they responded, and Halcyon says all twelve had not paid a ransom. Manufacturers saw a 22% rise. Halcyon says a Cl0p campaign against product lifecycle management software likely signals a shift toward stealing intellectual property.
Questions for your next security review
Put three questions to your team.
First: can an attacker with domain administrator rights delete or encrypt our offsite and disaster-recovery backups? When did we last prove a restore from a copy they cannot reach?
Second: which network and firewall management systems do we run, and how fast do we patch them? Halcyon's average time from disclosure to exploitation across new flaws is three days. That is the benchmark to hold our own patch speed against.
Third: do any of our AI gateways, agents or MCP servers hold model keys or database credentials? Halcyon says many were adopted for ease of use over access controls. The report also names Qilin in connection with attacks on the LiteLLM AI gateway, which sits in front of AI models. Separately, a different LiteLLM weakness has landed on CISA's list of vulnerabilities known to be exploited in the wild.
The summer's numbers are sobering. The more useful signal is where attackers now aim: at the tools a company would use to recover. Plan for that, and test it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Halcyon.
