Established RaaS operations led ransomware activity in April, while extortion-only groups relying on IT help desk social engineering accounted for a growing share of the month's observed activity. Overall volume declined compared to earlier months in 2026, though activity across the year has stayed high compared to 2025.
Qilin led for the fourth consecutive month among groups posting victims in the United States, with Inc, DragonForce, Akira, and ShinyHunters rounding out the top five. Critical unauthenticated remote code execution vulnerabilities in Fortinet FortiClient EMS and Palo Alto Networks PAN-OS saw active exploitation, with the PAN-OS flaw exploited as a zero-day weeks before public disclosure. Professional Services was the most impacted industry in April, followed by Retail and Hospitality, Healthcare, Manufacturing and Production, and Technology.
This month's Case Study examines the ShinyHunters playbook in detail, alongside Cordial Spider, Snarky Spider, and Silent Ransom Group, which are other groups deploying similar tactics. The Resilience Spotlight provides guidance on defending against this class of attack, covering phishing-resistant MFA, help desk identity verification, and SaaS monitoring.
Phishing emails, VPN vulnerabilities, lack of Multifactor Authentication (MFA), software flaws, drive-by downloads, and social engineering remain the most frequently observed initial access points for ransomware attacks.
Ransomware activity in April declined compared to earlier months in 2026, though overall volume across the year has remained elevated compared to 2025. RaaS operations continued to account for a large share of known ransomware attacks, with affiliates driving activity across most of the top-ranked operations. At MOXFIVE, we are seeing an uptick in cases involving extortion-only groups that rely on IT help desk social engineering for initial access. ShinyHunters has been the most visible operation in this space, with other groups adopting similar tactics like Cordial Spider/BlackFile, Snarky Spider, and Silent Ransom Group. MOXFIVE has also recently engaged cases involving FulcrumSec, another extortion-only group operating across cloud environments.
Figure 1: Top ransomware variants in April 2026 based on number of known victims.
The ransomware and industry rankings below are based on observed ransomware data leak site (DLS) activity for impacted organizations in the United States.
For a deeper look into these groups, MOXFIVE has published Threat Actor Spotlights on Qilin, Inc, Akira, ShinyHunters and DragonForce.
Professional Services was the most impacted industry in April. Law firms, consulting groups, and other professional services organizations are consistent targets due to the sensitivity of client data and the intellectual property they hold. Retail and Hospitality ranked second. They are often targets because they process payment data, operate distributed physical locations, and maintain extensive customer records, exposing point-of-sale systems and customer data to compromise.
Healthcare, Manufacturing and Production, and Technology organizations also rank in the top five. Healthcare organizations continue to face risk due to the sensitivity of patient data and the impact of system downtime. Operational disruption in Manufacturing and Production can quickly affect revenue and supply chains, keeping the sector a frequent target. Service providers, software platforms, and managed IT firms in the Technology sector often maintain direct integration with client networks and cloud environments, increasing the potential impact of a single intrusion.
Figure 2: Top industries impacted by ransomware in April 2026.
Targeting across the mainstream RaaS groups was largely scattered in April, with no single operation responsible for a heavy share of activity in any one sector. SilentRansomGroup accounted for the highest concentration of victim postings in Professional Services, continuing a sustained focus on law firms using callback phishing and IT help desk social engineering for initial access. Coinbase Cartel drove much of the observed activity in Retail and Hospitality, operating as a data extortion group that relies on stolen credentials and infostealer logs to gain access without deploying encryption.
Extortion-only operations have gained ground in 2026, and IT help desk social engineering has become the defining initial access vector for this class of threat actor. ShinyHunters is one of the most visible groups running this playbook. The model works for attackers because vishing requires no malware and systems stay online while data is exfiltrated in the background, limiting the visibility of traditional endpoint detection. Scattered Spider has been running this approach since at least 2022, and while activity directly attributed to Scattered Spider has declined since May 2025, the model has been carried forward by ShinyHunters and others operating within the Scattered LAPSUS$ Hunters collective.
The IT Help Desk Vishing Playbook
IT help desk vishing follows two distinct paths, each aimed at the same target: a valid identity inside the victim's environment. In one, attackers call employees at the target organization while impersonating internal IT help desk staff, directing them to a credential harvesting page hosted on a victim-branded subdomain, where adversary-in-the-middle infrastructure captures SSO credentials and MFA codes in real time. In the other, attackers call IT help desk staff while impersonating an employee or third-party vendor, using the interaction to obtain identity access through requested account changes or approvals.
From either entry point, the attacker moves laterally into connected SaaS environments such as Salesforce and SharePoint and exfiltrates data. Stolen data is then used to extort the victim, with threats of public exposure on a data leak site if payment is refused. ShinyHunters has built out its own internal vishing operation, which it refers to as the "SLH Operations Centre." Modeled on a call center, the operation recruits and pays contractors to run scripted vishing calls against targeted employees, enabling the group to run social engineering at scale.
Several other groups have built operations around the same approach:
IT help desk vishing is a human-driven attack, and no single control will stop it on its own. A layered defense combines identity controls that make stolen credentials less useful, verification procedures that make impersonation harder, and visibility into what happens after a help desk interaction. The following are mitigations organizations can consider when assessing their exposure to this class of attack.
Outsourced or third-party IT support adds another layer of risk. When help desk operations sit outside the organization, verification standards and incident response expectations need to be enforced across the provider, not just internally. Organizations using MSPs or external IT support should confirm those partners apply the same procedures the internal team applies.
How MOXFIVE Can Help
MOXGUARD: Strategic advisory including AD/identity assessments, CVE alerting prioritized to active ransomware exploitation, guidance on segmentation and backup hardening, tabletop exercises with response playbooks, and pre-positioned incident response.
Professional Services: Control validation through EDR coverage assessments, purple team exercises, network segmentation reviews, backup immutability and restoration testing, external attack surface reduction, and SIEM/XDR detection engineering.
Our team has handled hundreds of ransomware cases against the most advanced and active operations, aligning preventive, detective, and recovery controls to current threat actor TTPs. Contact us at 833-568-6695 or incident@moxfive.com.