Page 16 - EngineerIT June July Issue 2026
P. 16
CYBERSECURITY
The breakout story: The shift suggests a deliberate effort to reduce exposure to aggressive
The Gentlemen enforcement jurisdictions while maintaining scale. For global organisations, this
One of the most notable increases in reinforces a critical point. Geographic diversification by attackers expands risk;
activity during Q1 2026 was attributed it does not reduce it.
to The Gentlemen, a ransomware
group that reached third place Geographic and industry distribution: How access shapes impact
globally within a few months of initial Ransomware activity in Q1 2026 shows that both industry and geographic impact
activity. are also shaped, in some cases, by where attackers already have access.
Their growth was fueled by pre- Industries with high downtime sensitivity and complex environments continued
positioned access at scale. Rather to experience frequent attacks, including:
than relying on slow, opportunistic • Manufacturing
exploitation, the group operated with • Business services
a large inventory of compromised • Healthcare
network entry points, allowing it to • Industrial sectors
launch attacks immediately and in
volume. In many cases, victims appeared in sectors where exploitable infrastructure,
exposed VPNs, or pre-positioned access already existed, rather than where
Their targeting pattern also attackers expressed a clear industry preference.
stands out:
• Only 13% of publicly extorted The same access-driven pattern was visible geographically:
victims were based in the • The United States accounted for nearly half of all reported victims (49.6%),
United States, compared to an consistent with its large enterprise footprint, with Western developed
ecosystem average of 49.6% economies making up the clear majority of targets.
• Activity clustered in APAC • Thailand accounted for 10.8% of victims tied to a single dominant
and Latin America, mirroring ransomware group (The Gentlemen), pushing it into the top-targeted
the geographic distribution of countries for the first time.
compromised access points, • Play concentrated 85.1% of its activity on US-based organisations,
instead of a shift in the broader demonstrating how individual groups can heavily focus on a certain country.
threat landscape
Taken together, these trends show that ransomware risk is less about sector
This disparity does not indicate or location in isolation, and more about the underlying exposure created by
deliberate avoidance of US targets deployed technology, connectivity, and available access paths.
but rather reflects where the group
already had established access. In
some cases, attackers increasingly
go where access is available, not
necessarily where victims are most RoW
lucrative. 26%
LockBit’s return, with a strategic
shift
LockBit’s reappearance in Q1 2026
confirms that the group has recovered United States
50%
operationally after significant law
Thailand 2%
enforcement disruption in 2024.
India 2%
Brazil 2%
While overall activity more than
Spain 2%
doubled compared to the previous
Italy 2%
quarter, the most notable change
France 3%
was geographic. Historically focused
on the United States, LockBit’s recent Germany 3%
victims were spread more evenly United Kingdom 4%
Canada 4%
across Europe, Latin America, and
other regions.
16 | EngineerIT June/July 2026
