Sentrix

Know your enemy

Who attacks here, and how

The ransomware groups claiming victims in the chosen region, the ones on the rise, and for each recognized actor a profile: since when, how it gets in, what it has done, what stops it.

As of Oct 12, 2026: 56 claims in the last thirty days, 625 over twelve months. Data refreshed daily.

56

claims, 30 days

625

over 12 months

79

active groups, 12 months

Qilin

leading actor

The watch graph

From claims to a signal.

Groups publish their claims, the Sentrix watch collects them, matches them to a sector and a region, then passes on what concerns you. The graph runs on the day's snapshot: the eight most active groups in the window, with their number of claims.

625

claims tracked over twelve months, published by 79 active groups. Source ThreatCluster, CC BY 4.0.

Diagram: on the left, the eight most active groups in the window, each with its number of claims. Every group is linked to the central Sentrix node, the watch, which receives the claims. From the watch a link runs to a Correlation node, where the claim is matched to a sector and a region, then to a You node, which receives the alert. In total, 625 claims tracked over twelve months, published by 79 active groups.

Twelve months of claims

Targeted sectors, 12 months

Twelve months, chosen region. The group named is the one with the most claims in the sector.

  1. Services and construction625 claims · Qilin
  2. Healthcare518 claims · Qilin
  3. Manufacturing470 claims · Qilin
  4. Technology374 claims · Clop
  5. Retail and hospitality288 claims · Qilin
  6. Finance188 claims · Akira
  7. Education135 claims · Qilin
  8. Public sector103 claims · Qilin
  9. Energy74 claims · Akira

Leading actors, 12 months

Share of the region's claims. Linked names have a profile.

  1. 01Qilin99 claims
  2. 02Akira59 claims
  3. 03INC Ransom50 claims
  4. 04DragonForce46 claims
  5. 05Play40 claims
  6. 06Silentransomgroup26 claims
  7. 07The Gentlemen21 claims
  8. 08Clop17 claims

Emerging radar

Groups whose first claim in this region is less than six months old and that have posted again.

  • The Gentlemensince Apr 19, 202621 claims
  • Settrasince Jun 28, 202611 claims
  • Darkprojectsince Aug 5, 20266 claims
  • Direwolfsince Aug 15, 20265 claims
  • Stormsince Aug 14, 20265 claims
  • Crpxosince Jul 27, 20265 claims
  • Orovasince Aug 4, 20264 claims
  • Globalsecretgroupsince Jul 26, 20264 claims

Latest claims

Title as published by the group; an organization's name here does not prove it was compromised.

  1. brookslawfirm.com · Professional ServicesINC Ransom
  2. PennEastern Architects LCC · Professional ServicesDark project
  3. RingSide Creative · Professional ServicesQilin
  4. Company #28 · Professional ServicesN0n
  5. Reed & Giordano PA · Professional ServicesRhysida
  6. Gress Clark Young & Schoepper · Professional ServicesRhysida
  7. WAGA Enterprises Architects LLC · Professional ServicesNightspire
  8. RealManage · Professional ServicesRhysida

Check

Is your organization named?

The name or domain you type is compared, on our server, with the claims of the last twelve months. Nothing is stored, nothing is sent.

Actor profiles

Who they are, how they get in, what they have done, what stops them. Every fact carries its source and its date.

Official benchmarks

What the authorities measure, with their date. The claims above are the visible part; these figures give the scale.

What it changes for you

The same doors come back in every profile: VPN access without MFA, a stolen credential, a known unpatched vulnerability, poorly governed remote access. The controls that close them are known and measurable; our assessment services verify them and the platform's CTEM module tracks what stays open.

Today's official advisories are on the watch →Our analyses on the blog →

Sources

Claims are published by the groups themselves on their leak sites and recorded by independent observatories; a claim is not a confirmed incident and can be false or duplicated. Profiles rely on joint CISA and FBI advisories, the Canadian Centre for Cyber Security, ANSSI, the NCSC and the research teams named on each profile.

Ransomware is no longer a family of software, it is an economy: affiliate programs that recruit, brokers that sell initial access, infostealers that supply the credentials, and leak sites where the victim is named before any negotiation starts. The Canadian Centre for Cyber Security named Akira, Play and Medusa as the three main ransomware threats to Canada in 2024; in 2026 Qilin, The Gentlemen, INC Ransom and SafePay have moved to the front, while Clop strikes in waves on one software flaw at a time. What does not change is the door: remote access without multi-factor authentication, a stolen credential, an unpatched edge device. The profiles above say, for each group, what authorities and research teams report, and which controls close that door.

Frequently asked questions

Q01
Why does Qilin dominate claims in Canada?
Because it absorbed the affiliates of programs that disappeared. TrendAI notes RansomHub affiliates migrating to its infrastructure in mid-2025 and an alliance with DragonForce and LockBit announced in September 2025; Check Point Research ranks it the most prolific operator worldwide for a fourth consecutive quarter in the second quarter of 2026. Its Canadian targets range from construction to education, often mid-sized organizations with exposed remote access.
Q02
How do these groups really get in?
Through the same door, advisory after advisory: remote access without multi-factor authentication. The joint CISA and FBI advisory on Akira puts VPNs without MFA ahead of any vulnerability; Play and Medusa use valid credentials and unpatched edge devices; Clop prefers a zero-day in a widely deployed file-transfer product. Credentials stolen by infostealers and resold by access brokers feed all of them.
Q03
Your organization appears on a leak site: what now?
Treat the claim as an alert, not as proof, and confirm through incident response: remote access, recently created accounts, unusual outbound transfers. If personal information is involved, Québec's Law 25 requires notifying the Commission d'accès à l'information and the people concerned as soon as there is a risk of serious injury, and PIPEDA requires reporting to the federal Privacy Commissioner when there is a real risk of significant harm. The Canadian Centre for Cyber Security receives reports and publishes the advisories.