September looked quieter than August on paper. ThreatMon counted 762 ransomware victims for the month, down from 1,067 the month before. That drop doesn’t mean much on its own, though. The month still brought attacks on a major Turkish conglomerate, an English-language newspaper in Japan, a small Illinois bank, a hotel in Vilnius and Honda’s operation in Peru, and the groups behind them range from four-year veterans to crews that didn’t exist in July.
The geographic picture hasn’t changed much from previous months. The US carried more than a third of the load by itself, and no other country came close. Germany, in second place, had 38 victims, about one-seventh of the US figure.
Below the top five, the list is fairly flat. The UK had 26, India 24, France 23, and Spain and Argentina 17 each. Brazil in third and Argentina in the top ten are worth noting, since Latin America keeps showing up in these rankings. Play in particular has a long history of going after organizations in the region.
Manufacturing led again with 147 victims. That shouldn’t surprise anyone who has followed these reports. Factories can’t wait out a week of downtime, supplier networks give attackers plenty of entry points, and OT environments are often harder to patch than office IT. All of that makes manufacturers more likely to pay.
Professional Services (99) and Technology (95) came next. Both hold client data that’s valuable in its own right, which makes them good targets for double extortion even when the encryption itself causes less damage. Healthcare stayed above 10% with 82 victims.
ThreatMon picked eight cases for a closer look. Some were chosen because of who the victim is, others because of what the attack could expose further down the line.
Zorlu Holding (Turkey) – Qilin
Qilin listed Zorlu Holding, one of Turkey’s largest conglomerates, on its leak site on 20 September. The group hasn’t said how much data it took, but the post shows 21 photos as proof and had already been marked as published.
Zorlu’s businesses span manufacturing, energy and textiles, so a breach here isn’t limited to one company’s files. Supplier contracts, employee records and financial data from several subsidiaries could all be in scope. Two days later, Qilin also claimed Textile City, a Canadian home textiles company.
Titus (Germany) – Play
Play posted Titus, a German company, on 30 September. The leak page says the stolen data includes private and confidential files, client documents, budget and payroll records, IDs and tax information. Play gave a publication date of 4 October and said part of the data was already online, with the rest to follow if Titus didn’t respond.
One small detail: Play’s post describes the company as “Retail,” while ThreatMon classifies it under Technology. Leak site labels are often loose, which is one reason we verify victim details separately rather than relying on what the group publishes.
First Secure Community Bank (US) – Storm
This one is small, an Illinois bank founded in 2000 with somewhere between 11 and 50 employees. But it shows how Storm works. The group listed the bank on 18 September and the post had moved to “published” by 1 October, less than two weeks later.
A community bank holds Social Security numbers, account details and card data for most of its customers. If that data is out, the damage reaches well beyond the bank: customers in a small town now face the risk of identity theft and fraud.
Datacomm Services (US) – TheGentlemen
Datacomm Services is a 22-person low-voltage contractor in Memphis. It installs cabling, CCTV, access control and alarm systems, mainly for schools and government buyers. The company itself is small, but its project files could include network diagrams and access control setups for the buildings it has worked on. That makes this a supply chain risk for its clients as much as a problem for Datacomm. TheGentlemen began the attack on 29 September, and it was spotted the next day.
Honda Peru – Panzer, 15 September. Panzer is a new group that has been focusing on manufacturing and telecom.
The seven groups split fairly clearly into two camps.
The established players. Qilin (2,342 victims), Play (1,324) and TheGentlemen (922) make up most of the volume. Qilin is a Russian-speaking RaaS that runs on a Golang-based payload and offers its affiliates several encryption modes. Play doesn’t use the affiliate model. It operates as a closed group and builds its own tools, including a .NET infostealer that maps backup and security software inside a network before the encryption begins. TheGentlemen took a different route, offering affiliates a 90% revenue share. A compromised C2 server earlier this year linked the group to more than 1,570 organizations.
SafePay (591 victims) falls in between. It also rejects the RaaS model and handles everything in-house. Its leak site and timeline show it has been steadily active since late 2024.
The newcomers. Storm, Panzer and Eclipse all started posting victims in August 2026. Storm reached 82 victims in two months and leans heavily toward US financial services, which make up about 31% of its targets. Panzer has 38 victims and a habit of deleting Volume Shadow Copies to make recovery harder. Eclipse is the smallest, with 12 victims. According to ThreatMon’s data, it used infostealer logs to get in for about half of them.
All three groups slowed down noticeably in early October. That could mean a break, a rebrand or a disruption. ThreatMon’s recent reports have seen this pattern several times, and in most cases the same operators came back under a new name within a few months.
There are three things worth taking away from September.
First, the newcomer pace. Groups like Storm don’t need years to become dangerous. They borrow tools like Cobalt Strike, AzureHound and PowerShell recon scripts, put a leak site on Tor, and start working through victims right away. A threat list built only around the big names will miss them.
Second, small victims with large reach. A 22-person contractor or an 11-employee bank may look insignificant. But their data covers schools, government buildings and the finances of an entire town.
Third, the window between listing and leak is getting shorter. Play gave Titus four days. Storm published the bank’s data within two weeks. Organizations that find out about a breach from a leak site have very little time to act.
Each attack in this report left traces before it became news: an infostealer log, an access listing on a forum, a new post on a leak site. ThreatMon follows those signals continuously. The platform monitors ransomware leak sites, underground forums and Telegram channels, and alerts customers when their company, their suppliers or their employees’ credentials show up.
For an organization in Zorlu’s position, that means seeing a Qilin listing as soon as it goes up instead of hearing about it from a journalist. For a company like Datacomm’s clients, it means getting a warning when a supplier is hit, before their own building plans end up on a leak site.
If you want to see what’s visible about your organization right now, request a demo from ThreatMon.
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
