Ransomware and provide chain assaults hit their second-highest ranges ever in November, and the assault sorts are overlapping in regarding methods.
Ransomware assaults hit their second-highest ranges on report in November, because the variety of assaults rose for the seventh consecutive month.
The 640 ransomware assaults recorded by Cyble in November 2025 are second solely to February 2025’s report totals (chart under).
Ransomware teams are more and more focusing on software program provide chain vulnerabilities, which has contributed to a doubling of provide chain assaults since April 2025. Cyble darkish net researchers documented 38 provide chain assaults in November, slightly below the report set the earlier month (chart under). Ransomware teams claimed 22 of these assaults, or 58%, down from 73% in October.
Regardless of CL0P’s mass exploitation of Oracle E-Enterprise Suite vulnerabilities, Qilin as soon as once more led all ransomware teams in claimed assaults with 127, adopted by Akira at 103. CL0P, INC Ransom and Play rounded out the highest 5 (chart under).
The U.S. stays by far essentially the most attacked nation, its 356 ransomware assaults 10 instances greater than second-place Canada, adopted by the UK, Germany, India, and Italy (chart under).
Building, Skilled Companies, and Manufacturing have been essentially the most attacked sectors in November, adopted by Healthcare, Vitality & Utilities, and IT (chart under).
Main Ransomware Incidents in November
November was noteworthy for the variety of ransomware assaults focusing on important sectors and the IT provide chain, with a number of teams claiming exfiltration of delicate paperwork akin to undertaking and technical documentation.
Beneath are a few of the extra regarding incidents recorded by Cyble in November.
INC Ransom claimed duty for breaching a U.S.-based emergency alert system, together with exfiltrating roughly 1.15 TB of knowledge earlier than deploying encryption. To substantiate their claims, INC Ransom printed a number of samples, together with CSV information with client-related knowledge. The group additionally launched two screenshots allegedly displaying unsuccessful negotiation makes an attempt.
The Akira ransomware group claimed duty for a cyberattack focusing on a main South Korea–based mostly producer of lithium-ion batteries for electrical automobiles, vitality storage techniques, mobility platforms, and client electronics. In line with the group, the stolen knowledge contains 1.67TB of company paperwork and 46GB of SQL databases. As well as to intensive worker private info, Akira additionally claimed to possess confidential undertaking documentation, NDAs, monetary information, consumer and associate info, and a variety of contractual supplies.
The Everest ransomware group claimed an assault on a serious South American vitality firm in addition to a U.S.-based supplier of geophysical knowledge acquisition companies for the oil and gasoline trade. Everest printed pattern information displaying entry to survey stories and geophysical operational knowledge. Primarily based on the character and context of the leaked samples, it seems potential that the U.S. firm could have been the first compromised entity.
Akira claimed a cyberattack focusing on a U.S.-based producer of high-density, modular, and rugged embedded computing techniques, servers, and switches used throughout protection, aerospace, and different industrial sectors. In line with the group’s assertion, they allegedly exfiltrated a variety of company and consumer paperwork, together with detailed undertaking info, monetary knowledge, and confidential military-related supplies.
Akira additionally claimed duty for a cyberattack on a U.S.-based industrial companies and contracting firm that gives development, upkeep, and engineering options to the vitality, marine, and industrial sectors. Akira allegedly stole a big quantity of company and worker knowledge, together with contracts, non-disclosure agreements (NDAs), consumer info, technical drawings, and operational knowledge.
Different alleged Akira victims included two U.S.-based development and infrastructure corporations, one in every of them an engineering and project-management agency supporting railway signaling, practice management, and transportation infrastructure tasks from which Akira claimed to have exfiltrated NDAs, contracts and agreements, and undertaking documentation.
Akira additionally claimed to have exfiltrated confidential technical documentation and different delicate knowledge from a U.S.-based electrical cooperative that gives energy distribution, grid upkeep, and vitality companies to residential and industrial prospects in Mississippi.
Qilin claimed duty for assaults focusing on water administration authorities in Florida and California, and a Canada-based supplier of high-precision GNSS positioning applied sciences, navigation techniques, and geospatial options used throughout autonomous techniques, aerospace, agriculture, and surveying.
Qilin additionally claimed to have stolen delicate knowledge from the European subsidiary of a Japan-based development, engineering, and actual property improvement firm.
One other Qilin assault allegedly focused a U.S.-based firm that gives distant energy administration, community monitoring, and out-of-band management applied sciences used throughout knowledge facilities, telecommunications, industrial operations, and demanding infrastructure environments. The ransomware group printed a number of pattern information displaying alleged entry to monetary paperwork, buyer digital key letters, nondisclosure agreements, and extra inside company supplies, suggesting publicity of each delicate enterprise info and probably downstream consumer environments.
Qilin additionally claimed an assault on a Florida regional airport. Pattern information confirmed entry to scanned worker IDs, aviation alerts and notices, airport blueprints, inside operational paperwork, monetary information, and extra employee-related knowledge.
The Devman ransomware group claimed duty for breaching a Georgia entity answerable for sustaining court docket information, actual property filings, and demanding authorized documentation companies throughout the U.S. state. Shared samples recommend potential entry to inside purposes supporting digital filings, cost techniques, certification techniques, and core knowledge warehouses.
The DragonForce ransomware group claimed an assault on a main telecom companies supplier in the United Arab Emirates, exfiltrating greater than 44 GB of knowledge.
The Sinobi ransomware group claimed duty for a cyberattack focusing on an India-based firm that gives IT companies, digital engineering, cloud transformation, knowledge analytics, product engineering, and managed companies for international enterprise shoppers throughout sectors akin to finance, healthcare, manufacturing, and retail. In line with the group, roughly 450GB of knowledge have been allegedly stolen, together with confidential paperwork, contracts, buyer knowledge, and monetary information.
The Anubis ransomware group leaked greater than 1TB of knowledge allegedly stolen from a U.S.-based automotive producer that gives inside techniques, molded elements, and engineering options to main automakers worldwide. The group printed pattern supplies on its leak web site, together with blueprints, inside paperwork labeled as “confidential,” e-mail correspondence, and numerous company information
A newly noticed ransomware group calling itself Benzona surfaced with an onion data-leak web site, claiming 5 victims. Samples of the group’s encryptor have been recognized within the wild, with compromised information that included a “.benzona” extension. A ransom notice titled RECOVERY_INFO.txt is left on affected techniques, directing victims to speak by way of an onion-based chat portal. The preliminary set of victims included 4 Romanian automotive dealerships and one Ivory Coast–based mostly NGO targeted on healthcare support.
Conclusion
The alarming variety of ransomware assaults focusing on important and delicate sectors – together with the theft of delicate undertaking and technical knowledge – highlights the necessity for safety groups to reply with vigilance equal to the menace. Primary cybersecurity greatest practices that may assist shield towards a variety of cyber threats embody:
- Prioritizing vulnerabilities based mostly on threat.
- Defending web-facing property.
- Segmenting networks and demanding property.
- Hardening endpoints and infrastructure.
- Sturdy entry controls, permitting no extra entry than is required, with frequent verification.
- A robust supply of person id and authentication, together with multi-factor authentication and biometrics, in addition to machine authentication with gadget compliance and well being checks.
- Encryption of knowledge at relaxation and in transit.
- Ransomware-resistant backups which are immutable, air-gapped, and remoted as a lot as potential.
- Honeypots that lure attackers to pretend property for early breach detection.
- Correct configuration of APIs and cloud service connections.
- Monitoring for uncommon and anomalous exercise with SIEM, Lively Listing monitoring, endpoint safety, and knowledge loss prevention (DLP) instruments.
- Routinely assessing and confirming controls by means of audits, vulnerability scanning, and penetration assessments.
Cyble’s complete assault floor administration options might help by scanning community and cloud property for exposures and prioritizing fixes, along with monitoring for leaked credentials and different early warning indicators of main cyberattacks.
