Ransomware Intelligence / Sectors / Critical infrastructure

Sector

Ransomware in Critical infrastructure

Energy, utilities, water and wastewater, oil and gas, pipelines, telecoms and other essential services.

  • 14claims, 7 days
  • 55claims, 30 days
  • 112claims, 90 days
  • 2026-11-04most recent claim

Leak-site listings are claims made by criminals, not confirmed incidents. Sector is assigned from the public listing with an automated classifier and a confidence score; 12% of claims in the last 30 days are not yet classified. If a classification looks wrong, tell us.

Activity, last 26 weeks

New leak-site claims per week against critical infrastructure organisations.

Week of 2026-05-11: 4Week of 2026-05-18: 3Week of 2026-05-25: 6Week of 2026-06-01: 5Week of 2026-06-08: 4Week of 2026-06-15: 8Week of 2026-06-22: 3Week of 2026-06-29: 4Week of 2026-07-06: 6Week of 2026-07-13: 8Week of 2026-07-20: 11Week of 2026-07-27: 6Week of 2026-08-03: 6Week of 2026-08-10: 5Week of 2026-08-17: 11Week of 2026-08-24: 5Week of 2026-08-31: 8Week of 2026-09-07: 4Week of 2026-09-14: 9Week of 2026-09-21: 8Week of 2026-09-28: 4Week of 2026-10-05: 12Week of 2026-10-12: 14Week of 2026-10-19: 6Week of 2026-10-26: 20Week of 2026-11-02: 5
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Most active groups, last 90 days

  1. qilin 18
  2. n0n 9
  3. the gentlemen 9
  4. settra 7
  5. safepay 6
  6. endzone 5
  7. lockbit5 4
  8. byod 3
  9. clop 3
  10. deadlock 3

Countries, last 90 days

  1. United States 38
  2. Germany 5
  3. Mexico 5
  4. Malaysia 5
  5. Argentina 4
  6. Indonesia 4
  7. Brazil 3
  8. Canada 3
  9. Switzerland 3
  10. India 3
  11. BD 2
  12. Chile 2
  13. Egypt 2
  14. Spain 2
  15. Italy 2

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog is not sector-specific; if you run the product, patch it.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Request a conversation

Other sectors

Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago

Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology