June 2026 Threat Trend Report on Ransomware

June 2026 ransomware landscape: a monthly intelligence summary reporting numerous ransomware incidents concentrated in manufacturing, wholesale and information sectors, with the US most affected (92 incidents). Major groups (Qilin, DireWolf, WorldLeaks, LockBit5.0, Nova) remained active or grew in prominence, new/rebranded groups emerged, and a notable supply-chain compromise (ICARUS using stolen Klue credentials and OAuth tokens to exfiltrate CRM data from many vendors) illustrates ongoing data-leak and SaaS-integrated targeting concerns.