May 2026 Threat Trend Report on Ransomware

May 2026 ransomware intelligence from AhnLab reports elevated and widespread ransomware activity—manufacturing and information/communication sectors were heavily targeted, the US and several other countries saw most incidents, and top groups (e.g., Qilin, Silent, DragonForce) drove many breaches. The report documents established and emerging groups, DLS-based extortion growth, multi-stage attack chains (EtherRAT, TukTuk), exploitation of CVE-2026-41940, and the public distribution of a BLACKNET-00 builder; it recommends patching, network segmentation, reliable backups, and threat-intel driven responses.