Cyber Threat
Intelligence Reports

Ransomware activity remains elevated as affiliate ecosystems expand, while geopolitical tensions and AI developments continue to shape the threat landscape

May 2026 key insights:

• 749 ransomware listings recorded, reinforcing consistently high activity levels observed throughout 2026
• The Industrials sector remained the most targeted, maintaining a consistent trend month-on-month
• Qilin remained the most active group, responsible for 15% of attacks, followed by The Gentlemen, continuing its rise in the ransomware ecosystem
• North America remained the most targeted region at 49% of attacks, followed by Europe at 25%
• Increasing evidence of state actors leveraging cybercriminal tools, infrastructure, and tactics to obscure intent and complicate attribution

Ransomware activity remains resilient at a sustained baseline, but the nature of threats is becoming more complex. The growing overlap between state-backed and criminal operations is challenging traditional attribution models, while geopolitical developments continue to shape targeting priorities. At the same time, AI-assisted tooling is accelerating attacker capability, lowering barriers to entry, and contributing to a more scalable and adaptive threat ecosystem.

Mini Shai-Hulud and Open-Source Supply Chain Attacks

NCC Group is monitoring the ongoing and rapidly evolving wave of Shai-Hulud supply chain attacks.

This report covers the most recent wave of Shai-Hulud activity (Mini Shai-Hulud, Miasma and Hades), observed throughout May and early June 2026. As well as supporting triage of active infections, it provides guidance for defenders building security postures that address the structural risks of open-source package reliance, rather than simply ingesting wave-specific IOCs in response to each new campaign.

Download the full report