Ransomware Roundup: Multiple Gangs Target Global Industries

Ransomware Roundup: Qilin, Gammax, Genesis, and Others Claim Victims

HIGH
August 1, 2026
5m read
RansomwareThreat IntelligenceCyberattack

Impact Scope

Affected Companies

ADPOAguAseoBoyum IT SolutionsContact GroupBlue Vista Capital Management

Industries Affected

TransportationOtherTechnologyFinance

Geographic Impact

BelgiumPanamaDenmarkAustraliaUnited States (global)

Related Entities

Threat Actors

Qilin GammaxGenesisCMDUnsafe

Products & Tech

SAP Business One

Other

ADPOAguAseoBoyum IT SolutionsContact GroupBlue Vista Capital Management

MITRE ATT&CK Techniques

T1486

Data Encrypted for Impact

T1567.002

Exfiltration to Cloud Storage

T1059.003

Windows Command Shell

T1490

Inhibit System Recovery

Full Report

Executive Summary

A surge of activity on ransomware data leak sites on July 31, 2026, saw multiple threat actor groups claim responsibility for attacks on a diverse range of companies across the globe. The victims span industries from logistics and finance to software and construction, demonstrating that no sector is immune. The claims from groups including Qilin, Gammax, Genesis, CMD, and Unsafe all follow the standard double extortion playbook: publicize the breach to pressure victims into paying a ransom to prevent data leakage and obtain a decryption key. This roundup summarizes the latest wave of victims added to these groups' dark web portals.

Threat Overview

The following is a breakdown of the recent claims made by various ransomware gangs:

Qilin Ransomware vs. ADPO

  • Threat Actor: Qilin
  • Victim: ADPO, a logistics and chemical supply chain company.
  • Geography: Belgium
  • Details: Qilin, a prominent ransomware-as-a-service (RaaS) group, listed ADPO on its leak site. The attack is part of a recent string of campaigns by the group, which also claimed attacks on financial and energy firms in the Philippines and Turkey. The listing suggests data was exfiltrated and ADPO is being extorted.

Gammax Ransomware vs. AguAseo

  • Threat Actor: Gammax
  • Victim: AguAseo, an environmental services company.
  • Geography: Panama
  • Details: The Gammax group added AguAseo to its leak portal, signaling a successful breach and data theft. The attack on a public service provider highlights the risk to critical and essential services.

Genesis Ransomware vs. Boyum IT Solutions

  • Threat Actor: Genesis
  • Victim: Boyum IT Solutions, a software company specializing in solutions for SAP Business One.
  • Geography: Denmark
  • Details: The Genesis group claimed the attack on Boyum IT. Given the victim's specialization, the stolen data could be highly valuable, potentially including information about Boyum's enterprise customers, creating a supply chain risk.

'CMD' Group vs. Contact Group

  • Threat Actor: CMD
  • Victim: Contact Group, a building services and electrical contracting company.
  • Geography: Australia
  • Details: The emerging 'CMD' hacking group listed Contact Group on its leak site. The breach of a company in the construction sector shows the indiscriminate nature of these attacks.

'Unsafe' Group vs. Blue Vista Capital Management

  • Threat Actor: Unsafe
  • Victim: Blue Vista Capital Management, a real estate investment firm.
  • Geography: United States
  • Details: The 'Unsafe' group claimed the breach, likely involving sensitive financial records, investor data, and deal information from the U.S.-based investment firm.

Technical Analysis

All these incidents leverage the double extortion model, which has become the dominant strategy for ransomware gangs. The general attack lifecycle can be mapped to MITRE ATT&CK:

  1. Initial Access: Typically through phishing, exploitation of unpatched public-facing services, or stolen credentials.
  2. Reconnaissance & Lateral Movement: Once inside, actors use tools like Active Directory scanners and PsExec to map the network and move to high-value targets.
  3. Data Exfiltration (T1567.002 - Exfiltration to Cloud Storage): Before encryption, large amounts of sensitive data are compressed and uploaded to cloud storage services controlled by the attacker.
  4. Impact (T1486 - Data Encrypted for Impact): The ransomware payload is deployed, encrypting files across the network.
  5. Extortion: The victim is presented with a ransom note, and if they refuse to pay, their name is added to the public leak site as a pressure tactic.

Impact Assessment

This wave of attacks demonstrates the global and industry-agnostic nature of the ransomware threat. The collective impact includes:

  • Systemic Risk: The targeting of supply chain entities (ADPO, Boyum IT) creates a ripple effect, where the breach of one company can impact its entire customer base.
  • Critical Services Disruption: The attack on an environmental services firm (AguAseo) shows the potential for ransomware to disrupt essential public services.
  • Economic Loss: All victims face significant costs related to downtime, recovery, incident response, and potential ransom payments.

IOCs — Directly from Articles

No specific Indicators of Compromise were provided for these attacks in the source articles.

Cyber Observables — Hunting Hints

Security teams should hunt for common ransomware precursors, which are often more detectable than the ransomware payload itself.

Type
process_name
Value
rclone.exe, megacmd.exe
Description
Legitimate sync tools often abused by ransomware groups to exfiltrate data. Their presence on servers is highly suspicious.
Context
EDR telemetry, Process execution logs
Confidence
high
Type
command_line_pattern
Value
vssadmin delete shadows /all /quiet
Description
Command used to delete Volume Shadow Copies to prevent easy file recovery. A hallmark of ransomware.
Context
EDR telemetry, Windows Event ID 4688
Confidence
high
Type
network_traffic_pattern
Value
Large, sustained outbound data transfers to cloud storage providers.
Description
This pattern is highly indicative of data exfiltration prior to encryption.
Context
Firewall logs, Netflow, DLP alerts
Confidence
high

Detection & Response

  • Monitor Leak Sites: Threat intelligence services can monitor ransomware leak sites for mentions of a company or its partners, providing an early warning of a breach.
  • Behavioral Analytics: Use EDR/XDR to detect the TTPs of ransomware, such as credential dumping, lateral movement, and file encryption patterns.
  • Immutable Backups: The most critical response capability is having clean, isolated, and tested backups to restore from, making the encryption aspect of the attack moot.

Mitigation

Foundational cybersecurity hygiene is the best defense against ransomware:

  1. Patch Management: Prioritize patching of internet-facing systems and critical vulnerabilities.
  2. MFA: Enforce multi-factor authentication on all remote access points (VPN, RDP) and critical internal systems.
  3. Network Segmentation: Isolate critical assets and backups from the general corporate network to contain the blast radius of an attack.
  4. User Training: Train employees to identify and report phishing emails, a primary initial access vector.
  5. Principle of Least Privilege: Ensure user and service accounts only have the permissions necessary to perform their functions.

Timeline of Events

1
July 31, 2026
Multiple ransomware groups, including Qilin, Gammax, Genesis, CMD, and Unsafe, list new victims on their data leak sites.
2
August 1, 2026
This article was published

MITRE ATT&CK Mitigations

Update Software

M1051enterprise

Patching internet-facing systems is crucial to prevent the initial access that enables ransomware attacks.

Multi-factor Authentication

M1032enterprise

Enforcing MFA on remote access points like RDP and VPNs is one of the most effective controls against ransomware.

Network Segmentation

M1030enterprise

Properly segmenting networks can contain a ransomware infection, preventing it from spreading to critical assets and backups.

D3FEND Defensive Countermeasures

Inbound Traffic Filtering

D3-ITFMaps to MITREM1037
D3FEND

To combat the initial access phase of ransomware attacks, organizations must implement robust inbound traffic filtering. This goes beyond a basic firewall. It means blocking access to management ports like RDP (3389) and SMB (445) from the internet entirely. If remote access is needed, it must be through a hardened, MFA-protected VPN gateway. Furthermore, organizations should use geo-blocking to restrict access from countries where they do not do business. For web applications, a Web Application Firewall (WAF) should be deployed to filter for and block common exploits that ransomware operators use for initial access. This proactive filtering significantly reduces the attack surface available to groups like Qilin and Gammax.

Decoy Object

D3-DOMaps to MITREM1056
D3FEND

Deploying decoy objects, or honeypots, is an effective way to detect ransomware activity early. This involves creating fake but enticing assets on the network. For example, a file share named 'Finance-Exec-Salaries' containing fake documents, or a decoy domain admin account with no real privileges. These decoys should have no legitimate reason to be accessed. Any interaction with them is, by definition, suspicious or malicious. By heavily instrumenting these decoys with monitoring and alerting, security teams can get a high-fidelity, early warning that an attacker is performing reconnaissance on their network. This allows for a swift response to evict the attacker long before they reach the data exfiltration and encryption stages of their attack.

Timeline of Events

1
July 31, 2026

Multiple ransomware groups, including Qilin, Gammax, Genesis, CMD, and Unsafe, list new victims on their data leak sites.

Sources & References

Recent Data Breaches in 2026
BreachSense•July 31, 2026

Article Author

Jason Gomes

Jason Gomes

• Cybersecurity Practitioner

Cybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.

Threat Intelligence & AnalysisSecurity Orchestration (SOAR/XSOAR)Incident Response & Digital ForensicsSecurity Operations Center (SOC)SIEM & Security AnalyticsCyber Fusion & Threat SharingSecurity Automation & IntegrationManaged Detection & Response (MDR)
LinkedIn

Editorial Standards & Analyst Review

CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.

Tags

RansomwareQilinGammaxGenesisCMDUnsafeData Leak

📢 Share This Article

Help others stay informed about cybersecurity threats

🎯 MITRE ATT&CK Mapped

Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.

🧠 Enriched & Analyzed

Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.

🛡️ Actionable Guidance

Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.

🔗 STIX Visualizer

Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.

⚡ Sigma Generator

Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.