Ransomware operations maintained steady pressure in , with a modest decline from December’s volume, driven by established groups exploiting familiar vulnerabilities while social engineering techniques continued to evolve as effective initial access vectors. Qilin, Sinobi, and Akira led deployment activity, with Manufacturing and Production, Technology, and Healthcare bearing the greatest impact.
January brought a mix of targeted espionage and broad exploitation across critical enterprise infrastructure. APT28 weaponized a Microsoft Office security feature bypass in espionage campaigns targeting Ukraine and European nations. Critical vulnerabilities in Oracle WebLogic proxy components and Ivanti mobile device management systems both saw exploitation following disclosure. MOXFIVE responded to several cases involving ClickFix, a social engineering technique that manipulates users into executing malicious commands by impersonating legitimate system prompts. This month's Case Study examines how ClickFix campaigns function as initial access for ransomware deployment, while the Resilience Spotlight provides guidance on defending against user-initiated compromise that bypasses automated detection.
Phishing emails, VPN vulnerabilities, lack of Multifactor Authentication (MFA), software flaws, drive-by downloads, and social engineering remain the most frequently observed initial access points for ransomware attacks.
Ransomware activity in January showed a modest decline compared to December. Ransomware-as-a-Service models continued to drive a significant portion of attacks in January, with affiliate-driven operations accounting for many of the actively deployed variants. Several newer operations also warrant monitoring based on recent visibility, including LockBit 5.0 and Warlock.
Figure 1: Top ransomware variants in January 2026 based on number of known victims.
The ransomware and industry rankings below are based on observed ransomware data leak site (DLS) activity for impacted organizations in the United States.
For a deeper look into these groups, MOXFIVE has published Threat Actor Spotlights on Qilin, Sinobi, Akira, Inc, and Play.
Manufacturing and Production remained the most impacted industry in January, continuing a trend observed throughout 2025. Threat actors continue to target this sector due to the high impact that business interruption can have and the use of connected supply chains that create multiple paths for initial access. Technology was the second most impacted industry, as service providers and software platforms often maintain direct integration with client networks and cloud environments, increasing the potential impact of a single intrusion.
Healthcare, Professional Services, and Retail and Hospitality also saw consistent ransomware activity in January. Healthcare organizations continued to face attacks due to the sensitivity of patient and operational data and their limited tolerance for sustained outages. Professional
Figure 2: Top industries impacted by ransomware in January 2026.
Services firms remained targets as they often hold sensitive client information and intellectual property. Retail and Hospitality incidents often involve [TS1] organizations that process payment data or operate distributed physical locations, exposing point-of-sale systems and supporting infrastructure.
Manufacturing and Production drew attention from all five top-ranked variants in January. Play showed the highest concentration in the sector, while Sinobi activity was most concentrated across Manufacturing and Production, Healthcare, and Retail and Hospitality. Akira maintained its focus on Manufacturing and Production along with Construction and Engineering. Cl0p, while not ranked among the top five this month, posted several victims in Technology. [TS1]might read better if we change to "involve"
MOXFIVE has responded to several recent cases involving ClickFix, a social engineering technique that manipulates users into executing malicious PowerShell commands by impersonating legitimate error messages or CAPTCHA verifications. First observed in March 2024, campaigns utilizing this technique have surged throughout 2025. Both cybercriminals and nation-state actors from North Korea, Iran, and Russia actively use ClickFix to deliver infostealers, remote access trojans, and ransomware, with the technique serving as initial access in some cases to deploy Qilin ransomware.
The attack relies on convincing users to paste malicious commands into Windows Run dialogs or PowerShell consoles under the pretext of fixing browser errors, completing security verifications, or resolving file access issues. In January 2026, Microsoft identified a new variant called CrashFix that deliberately crashes victims' browsers before presenting fake recovery instructions. ClickFix succeeds by bypassing traditional security controls through user-initiated execution, leaving no suspicious files or links for automated defenses to detect. The technique continues to evolve with variants including FileFix, JackFix, GlitchFix, and fake Windows update screens, all designed to exploit user trust in familiar system interfaces.
ClickFix attacks succeed by bypassing technical controls and exploiting user behavior, requiring a defense strategy that combines user awareness with targeted monitoring. While traditional endpoint protections can struggle to detect user-initiated command execution, organizations can reduce exposure by restricting PowerShell execution policies, monitoring clipboard activity for suspicious patterns, and deploying email gateway filtering for HTML attachments. The most effective defense requires educating users that legitimate sites never ask them to paste commands into Run dialogs or PowerShell consoles.
How MOXFIVE Can Help
MOXGUARD: Strategic advisory including AD/identity assessments, CVE alerting prioritized to active ransomware exploitation, guidance on segmentation and backup hardening, tabletop exercises with response playbooks, and pre-positioned incident response.
Professional Services: Control validation through EDR coverage assessments, purple team exercises, network segmentation reviews, backup immutability and restoration testing, external attack surface reduction, and SIEM/XDR detection engineering.
Our team has handled hundreds of ransomware cases against Qilin, Sinobi, Akira, Inc, Play, and other active operations, aligning preventive, detective, and recovery controls to current threat actor TTPs. Contact us at 833-568-6695 or incident@moxfive.com.