NCC Group counted 1,073 ransomware attacks in August, a second straight 2026 high and 12% above July. Industrial companies took 31% of them, up from 28% in July, so the hardest-hit sector drew a larger slice of a larger total.
Publishers:infosecurity-magazine.com · nccgroup.com Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+25
- Incentives60
- Confidence55
n0n, a ransomware crew first seen September 18, listed over a dozen victims in four days and threatens to wipe the backups of those who refuse to pay. Whether it can depends on what its escalated admin accounts reach.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence40
Fortra researchers say the extortion crew likely read Dynamics 365 data straight out of portals where a table was exposed to the Anonymous Users web role.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+5
- Incentives40
- Confidence55
KnowBe4's Threat Lab logged the messages across July and August 2026. None of them needed a stolen password to look like mail from HR or accounting, and a single send addressed 900 recipients. The report landed September 10.
Reality
- Evidence57
- Adoption54
- Hype gap+14
- Incentives68
- Confidence56
The oversight ratio comes from one vendor's platform telemetry and should be read as such, but the capability data underneath it is checkable, and half of the 500 MCP servers sampled from npm can execute shell commands.
Reality
- Evidence54
- Adoption58
- Hype gap+28
- Incentives82
- Confidence57
The August 21 report says a second provider buys continuity at the price of policy consistency and verifiable authentication, and much of the fix sits on the provider's side of the boundary.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+12
- Incentives45
- Confidence52
Oligo Security says a 32-bit cache key and a trusted .jfrog/ directory let low-privileged users serve other people a poisoned index. JFrog has patched both.
Reality
- Evidence58
- Adoption28
- Hype gap+12
- Incentives55
- Confidence60
KnowBe4 says a new build of the commodity infostealer uses Unicode emoji to break string signatures and keeps its final payload off disk. The lure is a spoofed bank thread aimed at finance teams.
Reality
- Evidence45
- Adoption20
- Hype gap+30
- Incentives70
- Confidence52
The UK cyber authority's interim advice puts sandboxing, threat-modelling of agent tools and network paths, and a human stop button on the deployer rather than the vendor.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+8
- Incentives25
- Confidence55
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality
- Evidence38
- Adoption41
- Hype gap+28
- Incentives68
- Confidence45
Black Kite's read of 13,336 disclosed incidents puts 73% of victims in the mid-market, a share that held while volume rose 44%. The upper band is the only one shrinking.
Reality
- Evidence58
- Adoption60
- Hype gap+20
- Incentives72
- Confidence57