Ransomware in 2026 looks less like a single piece of malware and more like a supply chain of its own. Initial access is bought from brokers, security software is switched off by dedicated tools, and some gangs now pick which files to lock first. Several widely shared numbers about these campaigns are wrong, though, and one case in the original text belongs five years earlier.
This version keeps what holds up against vendor research, government alerts and company filings, and labels the rest. For defenders, the useful lessons are practical: remote access is the usual front door, help desks get impersonated, endpoint tools get killed, and backups need to cover the files people touched today.
Quick summary
- Kaseya (July 2021): The supply-chain case in the original text is from 2021, not “the same period” as the 2026 Indian incidents.
- Bajaj Auto and Tata Electronics (June 2026): Two separate incidents. No public evidence links them.
- Silent Ransom Group: A data-theft extortion campaign using phone calls and remote-support tools against U.S. law firms. It is not file-encrypting ransomware.
- Check Point (CVE-2026-50751): A VPN authentication bypass exploited from May 7, 2026. Only one of the two CVEs was exploited.
- FortiClient EMS and FortiBleed: Two separate Fortinet-related problems. FortiBleed is a credential-theft campaign, not a software flaw.
- Gentlemen and Prinz Eugen: Two ransomware operations with very different tactics, documented by ESET and ThreatDown respectively.
Supply chains
Kaseya and Coop, July 2021
On Friday, July 2, 2021, the REvil group used a flaw in Kaseya’s VSA remote-management software to push ransomware to Kaseya’s customers, many of them IT providers. Kaseya said fewer than 60 of its direct customers were hit, with up to 1,500 downstream businesses affected. REvil demanded $70 million for a universal decryptor.
Coop, a Swedish supermarket chain, was not a Kaseya customer. Its provider, Visma Esscom, was. Coop said a majority of its roughly 800 stores had to close because the tills stopped working, and about 500 closed on the first day. Early press reports said “all 800,” which Coop corrected. Defence minister Peter Hultqvist called the attack very dangerous. The earlier text claimed his quote was about state actors paralyzing society; I could not find that wording.
The original text said the Indian incidents happened “around the same period.” They did not. Kaseya was five years earlier. Kaseya said it did not pay, and it later received a decryptor from a third party on July 23, 2021.
Bajaj Auto and Tata Electronics, June 2026
Bajaj Auto told stock exchanges that a ransomware attack hit its systems and those of its subsidiary Bajaj Auto Technology Ltd at about 8 a.m. IST on June 23, 2026, and said it had notified CERT-In, per BusinessToday. It did not say whether data was stolen or whether a ransom was demanded. By June 26 the company said operations had returned to normal.
Tata Electronics confirmed an incident around June 22, after the group World Leaks claimed to have published more than 200,000 files totaling over 630 GB. Reuters reported the claim, and Tata said manufacturing was unaffected. The file counts are the group’s claim. A security blog saw no indication that the Bajaj attack was connected to the Tata one. CERT-In’s general warning about third-party dependencies does not connect them either. So the “supply-chain shock” framing in the original is the author’s inference, not a finding.
Getting in
Silent Ransom Group (UNC3753)
Mandiant tracks the group as UNC3753, also known as Luna Moth and Chatty Spider. Between January and May 2026 it ran a data-theft extortion campaign against dozens of U.S. legal, financial and professional-services firms, according to Security Affairs. The pattern: a harmless-looking invoice email, then a phone call from a fake IT helpdesk that persuades a worker to open a remote-support session and install a legitimate remote-management tool. Data is then pulled out with tools such as WinSCP and Rclone.
The FBI’s May 26 alert added a physical angle: people posing as IT technicians visited offices and tried to copy data to USB drives. Mandiant said it cannot formally attribute every physical case to the group, but considers the link likely. The group’s leak site had published data from at least 38 law firms as of late May, per a Cloud Security Alliance note. This is extortion without encryption, so calling it “ransomware” oversimplifies it. I removed the claim about ransom demands arriving 30 minutes after the attackers leave, which I could not source.
Check Point VPN (CVE-2026-50751)
Check Point disclosed CVE-2026-50751, a critical (CVSS 9.3) authentication bypass in Remote Access VPN and Mobile Access setups that use the deprecated IKEv1 protocol, accept legacy clients and don’t require a machine certificate. Exploitation began around May 7, 2026, and an affiliate of the Qilin ransomware group was linked to at least one case with medium confidence, according to BleepingComputer.
The original text said both CVEs were actively exploited. Not so. CVE-2026-50752 is a related flaw affecting site-to-site tunnels in man-in-the-middle scenarios, and there is no evidence it was exploited. Check Point also saw the same actor targeting VPN products from other vendors, including Palo Alto Networks, Fortinet and F5, per Techzine. I could not verify the named hosting providers.
FortiClient EMS (CVE-2026-35616)
This is a CVSS 9.1 access-control flaw in FortiClient Endpoint Management Server versions 7.4.5 and 7.4.6. Fortinet issued hotfixes in early April after seeing exploitation, and CISA added it to its Known Exploited Vulnerabilities list on April 6, SecurityWeek reported. In May, Arctic Wolf documented attackers using the management server to push a fake “Fortinet patch” that was really a credential stealer (EKZ Infostealer) to managed endpoints. This is not a ransomware campaign by itself. It shows how a management server can become a delivery channel.
FortiBleed
FortiBleed is a separate, credential-harvesting campaign against FortiGate firewalls, and it is not a software vulnerability. SOCRadar reported that the operator targeted about 430,000 FortiGate firewalls, gained administrator access on 409 and completed a full domain compromise on 354, as SecurityWeek described. A custom Go-based sniffer was on roughly 12,000 devices, and about 110 million credentials were collected. Note the wording: 430,000 is the number targeted, not the number compromised.
SOCRadar also saw an operator logged into the negotiation panels of both INC Ransom and Lynx, and confirmed 12 ransomware deployments, per Cybersecurity Dive. These figures come from one vendor. Update: the FBI and Secret Service warned in October 2026 that the campaign remains active. I could not verify the original’s “24 protocols.”
Defeating defenses: the Gentlemen group
ESET published its analysis of Gentlemen on June 18, 2026. The gang emerged in late 2025 (the original said July 2025) and became one of the most active ransomware operations in early 2026. Its operators build and maintain a suite of tools that switch off security software and hand it to affiliates, which ESET calls unusual, per its report.
The main in-house tool is GentleKiller, with at least eight variants. Each uses a vulnerable or malicious kernel driver, a technique called bring your own vulnerable driver (BYOVD), and impersonates a legitimate product. It terminates security processes in a loop. ESET says it targets more than 400 processes it mapped to 48 products, with the caveat that the mapping was AI-assisted and may have minor errors. The original text said GentleKiller abused drivers from Kaspersky and others. In fact some variants merely impersonate those names, while the abused drivers come from other vendors.
Three further tools, HexKiller, ThrottleBlood and HavocKiller, were obtained from outside the group and run through the same disguise layer. ESET says the group can adopt newly published proof-of-concept code within days. It also says Gentlemen’s victims are not mainly in the U.S. and are often chosen by FortiGate misconfiguration, which links back to the Fortinet section above. I removed the original’s “300 attacks and 504 victims” figures, since other outlets cite different counts.
Prinz Eugen: newest files first
Prinz Eugen is a Go-based encryptor that ThreatDown (Malwarebytes) analyzed after an incident on May 11, 2026. It encrypts recently modified files first, sorting by modification time and falling back to alphabetical order for ties. It leaves no ransom note on disk, uses extortion channels outside the victim’s machine, and attempts to erase its tracks, per Techzine. Its leak site listed three victims, and researchers identified at least five, including the South African bank Standard Bank, where a 1 BTC demand was refused, We Fix PC reported.
The operators appear to work by hand, using remote-management software and valid remote-access credentials. They do not appear to run an affiliate program. The claim that this order of encryption targets files “least likely to be backed up” is ThreatDown’s reasoning, not something the group has stated. And the missing ransom note is not entirely new: ThreatDown itself said it is seen more often among organized groups.
Claim check
| Claim | Status | Note |
|---|---|---|
| Kaseya attack closed all 800 Coop stores | Overstated | A majority; about 500 on day one. |
| Kaseya occurred “around the same period” as Bajaj | Wrong | July 2021 versus June 2026. |
| Bajaj Auto ransomware on June 23, 2026 | Confirmed (company filing) | Data theft unconfirmed. |
| Tata: 630 GB, 200,000 files | Group’s claim | Tata confirmed an incident only. |
| Bajaj and Tata are linked | No evidence | One day apart; separate attackers. |
| Silent Ransom Group uses ransomware | Imprecise | Data-theft extortion. |
| Both Check Point CVEs exploited | Wrong | Only CVE-2026-50751. |
| FortiBleed compromised 430,000 firewalls | Wrong | 430,000 targeted; 409 got admin access. |
| Gentlemen emerged July 2025 | Imprecise | ESET says late 2025. |
| GentleKiller targets 48 products | ESET figure, AI-assisted | Possible minor errors. |
| Prinz Eugen is novel for having no ransom note | Overstated | The tactic appears in other groups. |
My take
I haven’t investigated any of these incidents myself. These views come from reading vendor and government reports.
- The ecosystem story is the real one. Gentlemen, FortiBleed and the Check Point case all point to specialized pieces, such as access brokers, tool builders and affiliates, working together. That matters more than any single group’s name.
- Remote access is the weak spot. VPNs, firewalls and management servers keep appearing at the start of these chains, so patching and hardening them first is the best return.
- One criticism of the “precision strike” framing: Prinz Eugen has few confirmed victims and a single vendor describing its intent. I would treat the “weapon” language as interpretation until more data appears.
What this means for you
- Patch or reconfigure remote access. If you run Check Point VPNs, follow the vendor’s guidance on IKEv1 and machine certificates. For FortiGate, rotate credentials, restrict management interfaces and enable phishing-resistant MFA, as CISA recommends. For FortiClient EMS 7.4.5 or 7.4.6, apply Fortinet’s fix.
- Verify help-desk calls. Staff should confirm unexpected “IT support” calls through a known number. Block or allowlist remote-management tools that you don’t use, and ask visitors claiming to be IT for credentials at reception.
- Don’t rely on one endpoint product. Turn on tamper protection and Microsoft’s vulnerable-driver blocklist, and alert when security services stop unexpectedly.
- Back up active data more often. Keep copies isolated from production and test restores, particularly for files that change daily.
- Map your suppliers. Know which IT or managed-service provider has remote access to your systems, and what happens if it’s compromised.
FAQ
Was the Kaseya attack part of the 2026 wave?
No. It happened in July 2021 and is a useful precedent, not part of this year’s incidents.
Is FortiBleed a Fortinet vulnerability?
No. It is a campaign that harvests credentials from exposed FortiGate devices, using reused or weak passwords and missing MFA, per reporting on SOCRadar’s findings.
Does Prinz Eugen mean no ransom note equals no attack?
No. The lack of a note on the machine doesn’t mean there is no extortion. The group uses other channels, including a leak site.
Sources
- Kuwait Times (AFP): Kaseya impact
- BleepingComputer: Coop closes stores
- Wikipedia: Kaseya VSA ransomware attack
- BusinessToday: Bajaj Auto filing
- Storyboard18: Bajaj Auto operations
- CRN Asia: Bajaj and Tata Electronics
- Security Affairs: UNC3753
- Cloud Security Alliance: UNC3753 note
- BleepingComputer: Check Point and Qilin
- The Next Web: Check Point zero-day
- Techzine: Check Point warning
- SecurityWeek: FortiClient EMS exploited
- SecurityWeek: FortiBleed and INC/Lynx
- Cybersecurity Dive: FortiBleed
- The Hacker News: FBI warning (October 2026)
- ESET Research: Gentlemen’s EDR killers
- Techzine: Prinz Eugen
- We Fix PC: Prinz Eugen and ThreatDown