During the monitoring period from September 13 to September 20, 2026, our threat intelligence team tracked a total of 212 new extortion and cyber incident claims globally. The landscape continues to be overwhelmingly dominated by ransomware operations rather than disruptive attacks, with 210 claims attributed to ransomware groups compared to just 2 hacktivist or DDoS incidents. Organizations across all verticals must recognize that financially motivated encryption and data theft remain the primary vector of choice for modern cybercriminal enterprises.

Of the total volume recorded this week, 79 claims were classified as high or critical severity, underscoring the severe operational and data-exposure risks facing victims. Among geographic tags, 2 claims were explicitly tagged to the Middle East. While this specific regional count represents a small fraction of the global total, it serves as an important reminder that regional organizations remain within the operational scope of globally active threat groups and must maintain rigorous defensive postures.

An analysis of the threat actor landscape reveals active participation from several prominent extortion groups. The most active actor this week was thegentlemen with 31 claims, closely followed by qilin with 30 claims. Unattributed groups accounted for 20 claims, while N0n and akira each recorded 11 claims. The heavy concentration of activity among a handful of prolific syndicates indicates well-resourced operations with systematic approaches to target acquisition and victim shaming.

Looking at the sectoral distribution, the manufacturing sector bore the brunt of this week's activity with 32 claims, followed closely by technology with 24 claims and professional services with 20 claims. Rounding out the top five most-targeted sectors were healthcare with 12 claims and financial services with 11 claims. The heavy targeting of manufacturing and technology typically reflects the high cost of operational downtime in these industries, which extortionists leverage to pressure victims into paying demands.

On the vulnerability front, the most severe vulnerability highlighted this week was CVE-2026-90770, carrying a CVSS score of 8.8. High-severity flaws of this nature frequently serve as initial access vectors for automated exploitation or targeted intrusions before deployment of payloads. Security teams should prioritize vulnerability management and rapid patching to mitigate these entry points.

In light of these aggregated trends, Forsan advises organizations to review their defensive readiness, focusing particularly on robust data backup strategies, endpoint detection and response capabilities, and rapid patch management for high-severity vulnerabilities. Maintaining visibility across supply chains and critical infrastructure is essential to disrupting the initial access and lateral movement phases utilized by top-tier ransomware syndicates.