12OCT

New '2019' group tops June ransomware tally

2 min read

10:55UTC

BlackFog's June report put the newly emerged 2019 group top of ransomware activity with 12 claimed victims, ending Qilin's May lead in a month when 31 groups claimed victims.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A newly emerged group led June's ransomware tally with 12 victims as Qilin's May lead ended and 31 groups claimed attacks.

BlackFog, a cybersecurity firm that tracks ransomware activity, named the newly emerged 2019 group the most active in its State of Ransomware report for June 2026, with 12 claimed victims among 102 publicly disclosed attacks across 21 countries and 31 groups. Qilin, which led BlackFog's May tally with 11, did not repeat, a month after Europol-backed Operation Saffron took down First VPN, an anonymisation service ransomware crews used.⁠¹

June's table shows no single recruiter absorbing the market. Affiliates are the freelance operators who carry out attacks using a brand's tooling in exchange for a cut. When 31 groups claim victims and the leader holds 12, affiliates are spreading across brands rather than gathering under one. Saffron removed a shared anonymisation service; it did not touch the labour market crews draw from, and the June figures show that market still fragmenting.

Deep Analysis

In plain English

Ransomware gangs sometimes act like criminal franchises: a core group builds the malicious software and negotiates with victims, while 'affiliates' actually break into networks and split the ransom. A cyber-security firm called BlackFog tracks which gang is most active each month. In June 2026 the top spot went to a newly emerged group called 2019, with 12 claimed victims, after a gang called Qilin led in May. What makes this notable is how spread out the activity was: 31 different groups claimed victims in June, and no single gang dominated. A month earlier, European police had taken down First VPN, a service criminals used to hide their identity, in an operation called Saffron {{EVREF:/t/cyber-threats-and-defences/6/Europol-seizes-first-vpn-in-saffron-raid/}}. Taking down such tools does not necessarily reduce total ransomware activity; the criminals doing the actual break-ins often move between gangs.

Deep Analysis

Root Causes

Qilin runs a ransomware-as-a-service affiliate model with an unusually generous revenue split, reportedly up to 85% to affiliates versus the 70% more typical among rival brands, which is why disrupted gangs' affiliates tend to migrate to Qilin rather than disappear when law enforcement takes a competitor offline.

Operation Saffron's takedown of the First VPN service in May targeted infrastructure rather than the affiliate marketplace itself. Removing a service operator's servers does not remove the freelance affiliates who did the actual intrusions, and those affiliates simply re-register under whichever brand offers the best terms.

What could happen next?

Meaning
Qilin's second consecutive monthly lead despite Operation Saffron suggests law-enforcement disruption campaigns reshuffle which brand affiliates use rather than reduce total ransomware volume.
Risk
If Qilin continues absorbing displaced affiliates, its higher-than-median ransom demands could become the market's new benchmark rather than an outlier.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: LockBit's takedown in Operation Cronos, February 2024, similarly failed to reduce overall ransomware volume; affiliates scattered to RansomHub, Akira and other brands within weeks, and total attack counts recovered to pre-takedown levels by mid-2024.

Counter-parallel: The 2021 shutdown of REvil, following pressure tied to the Kaseya and JBS attacks, produced a longer-lasting reduction in that specific brand's activity, in part because several core members were arrested rather than merely having infrastructure seized, removing expertise rather than just the storefront.

BlackFog's June count shows no group holding more than 12 of 102 disclosed attacks, so ransomware volume sits with many mid-sized crews rather than one leader.

Coveware's Q2 2026 data shows Qilin's average ransom demand running roughly 40% above the ransomware-market median, consistent with a group that has captured enough affiliate talent to target larger, better-resourced victims.

Sources:BlackFog

Mentions:BlackFog →Qilin →Europol →Operation Saffron →Operation Cronos →

First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

BlackFog· 4 Jul 2026

Read original →

Causes and effects

Caused by

Ransomware tempo holds at 95 in May

Qilin's May lead in BlackFog's ranking is extended into a second consecutive monthly lead in June.

Occurred 31 May 2026

Read story →

Saffron raid takes down First VPN

Europol's Operation Saffron stranded affiliates from disrupted crews, feeding the affiliate-recruitment model that kept Qilin on top despite the takedown.

Occurred 21 May 2026

Read story →

This Event

New '2019' group tops June ransomware tally

June's lead went to a group with 12 of 102 disclosed attacks while 31 groups claimed victims, so no brand dominated and the ecosystem kept fragmenting.

Led to

Ransomware claims rose 11 per cent in August

Qilin's return to first place in August follows its earlier lead in BlackFog's June ranking.

Occurred 31 Aug 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.