Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
22OCT

New '2019' group tops June ransomware tally

2 min read
16:31UTC

BlackFog's June report put the newly emerged 2019 group top of ransomware activity with 12 claimed victims, ending Qilin's May lead in a month when 31 groups claimed victims.

← Back to Fridge hack spoils food in seven countriesJump to analysis ↓
TechnologyDeveloping
Key takeaway

A newly emerged group led June's ransomware tally with 12 victims as Qilin's May lead ended and 31 groups claimed attacks.

BlackFog, a cybersecurity firm that tracks ransomware activity, named the newly emerged 2019 group the most active in its State of Ransomware report for June 2026, with 12 claimed victims among 102 publicly disclosed attacks across 21 countries and 31 groups. Qilin, which led BlackFog's May tally with 11, did not repeat, a month after Europol-backed Operation Saffron took down First VPN, an anonymisation service ransomware crews used.⁠1

June's table shows no single recruiter absorbing the market. Affiliates are the freelance operators who carry out attacks using a brand's tooling in exchange for a cut. When 31 groups claim victims and the leader holds 12, affiliates are spreading across brands rather than gathering under one. Saffron removed a shared anonymisation service; it did not touch the labour market crews draw from, and the June figures show that market still fragmenting.

Deep Analysis

In plain English

Ransomware gangs sometimes act like criminal franchises: a core group builds the malicious software and negotiates with victims, while 'affiliates' actually break into networks and split the ransom. A cyber-security firm called BlackFog tracks which gang is most active each month. In June 2026 the top spot went to a newly emerged group called 2019, with 12 claimed victims, after a gang called Qilin led in May. What makes this notable is how spread out the activity was: 31 different groups claimed victims in June, and no single gang dominated. A month earlier, European police had taken down First VPN, a service criminals used to hide their identity, in an operation called Saffron {{EVREF:/t/cyber-threats-and-defences/6/Europol-seizes-first-vpn-in-saffron-raid/}}. Taking down such tools does not necessarily reduce total ransomware activity; the criminals doing the actual break-ins often move between gangs.

Deep Analysis
Root Causes

Qilin runs a ransomware-as-a-service affiliate model with an unusually generous revenue split, reportedly up to 85% to affiliates versus the 70% more typical among rival brands, which is why disrupted gangs' affiliates tend to migrate to Qilin rather than disappear when law enforcement takes a competitor offline.

Operation Saffron's takedown of the First VPN service in May targeted infrastructure rather than the affiliate marketplace itself. Removing a service operator's servers does not remove the freelance affiliates who did the actual intrusions, and those affiliates simply re-register under whichever brand offers the best terms.

What could happen next?
  • Meaning

    Qilin's second consecutive monthly lead despite Operation Saffron suggests law-enforcement disruption campaigns reshuffle which brand affiliates use rather than reduce total ransomware volume.

  • Risk

    If Qilin continues absorbing displaced affiliates, its higher-than-median ransom demands could become the market's new benchmark rather than an outlier.

Sources:BlackFog
Mentions:BlackFog →Qilin →Europol →Operation Saffron →Operation Cronos →
First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

BlackFog· 4 Jul 2026
Read original →
Causes and effects
Caused by
Ransomware tempo holds at 95 in May
Qilin's May lead in BlackFog's ranking is extended into a second consecutive monthly lead in June.
Occurred 31 May 2026
Read story →
Saffron raid takes down First VPN
Europol's Operation Saffron stranded affiliates from disrupted crews, feeding the affiliate-recruitment model that kept Qilin on top despite the takedown.
Occurred 21 May 2026
Read story →
This Event
New '2019' group tops June ransomware tally
June's lead went to a group with 12 of 102 disclosed attacks while 31 groups claimed victims, so no brand dominated and the ecosystem kept fragmenting.
Led to
Ransomware claims rose 11 per cent in August
Qilin's return to first place in August follows its earlier lead in BlackFog's June ranking.
Occurred 31 Aug 2026
Read story →
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.