Sentrix

Know your enemy

Who attacks here, and how

The ransomware groups claiming victims in the chosen region, the ones on the rise, and for each recognized actor a profile: since when, how it gets in, what it has done, what stops it.

As of Oct 12, 2026: 40 claims in the last thirty days, 417 over twelve months. Data refreshed daily.

40

claims, 30 days

417

over 12 months

85

active groups, 12 months

Qilin

leading actor

The watch graph

From claims to a signal.

Groups publish their claims, the Sentrix watch collects them, matches them to a sector and a region, then passes on what concerns you. The graph runs on the day's snapshot: the eight most active groups in the window, with their number of claims.

417

claims tracked over twelve months, published by 85 active groups. Source ThreatCluster, CC BY 4.0.

Diagram: on the left, the eight most active groups in the window, each with its number of claims. Every group is linked to the central Sentrix node, the watch, which receives the claims. From the watch a link runs to a Correlation node, where the claim is matched to a sector and a region, then to a You node, which receives the alert. In total, 417 claims tracked over twelve months, published by 85 active groups.

Twelve months of claims

Targeted sectors, 12 months

Twelve months, chosen region. The group named is the one with the most claims in the sector.

  1. Services and construction1,578 claims · Qilin
  2. Manufacturing1,275 claims · Qilin
  3. Technology1,108 claims · Qilin
  4. Healthcare1,046 claims · Qilin
  5. Retail and hospitality772 claims · Qilin
  6. Finance417 claims · Qilin
  7. Education304 claims · Qilin
  8. Public sector272 claims · Qilin
  9. Energy244 claims · Qilin

Leading actors, 12 months

Share of the region's claims. Linked names have a profile.

  1. 01Qilin52 claims
  2. 02The Gentlemen37 claims
  3. 03Akira26 claims
  4. 04DragonForce19 claims
  5. 05INC Ransom18 claims
  6. 06Storm16 claims
  7. 07Clop16 claims
  8. 08Shinyhunters16 claims

Emerging radar

Groups whose first claim in this region is less than six months old and that have posted again.

  • Stormsince Aug 7, 202616 claims
  • Crpxosince Jul 27, 20267 claims
  • Globalsecretgroupsince Jul 26, 20266 claims
  • N0nsince Sep 18, 20265 claims
  • Krybitsince Jun 10, 20265 claims
  • Deadlocksince Jun 15, 20264 claims
  • Section9since Jul 26, 20263 claims
  • Settrasince Sep 17, 20262 claims

Latest claims

Title as published by the group; an organization's name here does not prove it was compromised.

  1. MoneyGram · Financial ServicesThe Gentlemen
  2. lopay · Financial ServicesBlack x
  3. capitalbankhaiti.biz · Financial ServicesLockBit 5.0
  4. Wavecrest HFA · Financial ServicesINC Ransom
  5. Gate | Crypto Exchange · Financial ServicesByod
  6. J&D Financial · Financial ServicesQilin
  7. BNYH · Financial ServicesQilin
  8. Company #2 · Financial ServicesN0n

Check

Is your organization named?

The name or domain you type is compared, on our server, with the claims of the last twelve months. Nothing is stored, nothing is sent.

Actor profiles

Who they are, how they get in, what they have done, what stops them. Every fact carries its source and its date.

Official benchmarks

What the authorities measure, with their date. The claims above are the visible part; these figures give the scale.

What it changes for you

The same doors come back in every profile: VPN access without MFA, a stolen credential, a known unpatched vulnerability, poorly governed remote access. The controls that close them are known and measurable; our assessment services verify them and the platform's CTEM module tracks what stays open.

Today's official advisories are on the watch →Our analyses on the blog →

Sources

Claims are published by the groups themselves on their leak sites and recorded by independent observatories; a claim is not a confirmed incident and can be false or duplicated. Profiles rely on joint CISA and FBI advisories, the Canadian Centre for Cyber Security, ANSSI, the NCSC and the research teams named on each profile.

Ransomware is no longer a family of software, it is an economy: affiliate programs that recruit, brokers that sell initial access, infostealers that supply the credentials, and leak sites where the victim is named before any negotiation starts. The Canadian Centre for Cyber Security named Akira, Play and Medusa as the three main ransomware threats to Canada in 2024; in 2026 Qilin, The Gentlemen, INC Ransom and SafePay have moved to the front, while Clop strikes in waves on one software flaw at a time. What does not change is the door: remote access without multi-factor authentication, a stolen credential, an unpatched edge device. The profiles above say, for each group, what authorities and research teams report, and which controls close that door.

Frequently asked questions

Q01
Why does Qilin dominate claims in Canada?
Because it absorbed the affiliates of programs that disappeared. TrendAI notes RansomHub affiliates migrating to its infrastructure in mid-2025 and an alliance with DragonForce and LockBit announced in September 2025; Check Point Research ranks it the most prolific operator worldwide for a fourth consecutive quarter in the second quarter of 2026. Its Canadian targets range from construction to education, often mid-sized organizations with exposed remote access.
Q02
How do these groups really get in?
Through the same door, advisory after advisory: remote access without multi-factor authentication. The joint CISA and FBI advisory on Akira puts VPNs without MFA ahead of any vulnerability; Play and Medusa use valid credentials and unpatched edge devices; Clop prefers a zero-day in a widely deployed file-transfer product. Credentials stolen by infostealers and resold by access brokers feed all of them.
Q03
Your organization appears on a leak site: what now?
Treat the claim as an alert, not as proof, and confirm through incident response: remote access, recently created accounts, unusual outbound transfers. If personal information is involved, Québec's Law 25 requires notifying the Commission d'accès à l'information and the people concerned as soon as there is a risk of serious injury, and PIPEDA requires reporting to the federal Privacy Commissioner when there is a real risk of significant harm. The Canadian Centre for Cyber Security receives reports and publishes the advisories.