Ransomware showed no signs of letting up in May, continuing a pace that has made 2026 one of the most active years on record. Qilin drove a high percentage of that activity and has been the most widely deployed ransomware MOXFIVE has tracked all year. MOXFIVE published a full breakdown of Qilin's operations, attack chain, and growth this month, available here.
A separate trend that stood out in May was a sharp increase in targeting against law firms. The activity even warranted a FLASH alert from the FBI warning that Silent Ransom Group has escalated its campaign against US law firms to include physical intrusion into offices.
This month's Case Study examines how infostealer malware harvests credentials from employee devices and feeds them into underground markets where ransomware affiliates purchase verified access. Credential theft through infostealers has become a common precursor to ransomware deployment, giving affiliates a reliable path into target environments. By the time an attack executes, the credentials used to gain access may have been circulating on criminal infrastructure for weeks. The Resilience Spotlight helps defenders get ahead of this tactic.
Phishing emails, VPN vulnerabilities, lack of Multifactor Authentication (MFA), software flaws, drive-by downloads, and social engineering remain the most frequently observed initial access points for ransomware attacks.
Ransomware activity in May stayed high, keeping pace with a 2026 that has been among the most active years on record. The ransomware operation to keep an eye on this year has been Qilin, which is currently the most actively deployed ransomware-as-a-service (RaaS) operation on the market. MOXFIVE published a detailed analysis of Qilin's RaaS model, attack chain, and affiliate-driven growth this month. DragonForce, Inc, Genesis, and Akira made up the remainder of the top five active ransomware operations for the month.
Figure 1: Top ransomware variants in May 2026 based on number of known victims.
The ransomware and industry rankings below are based on observed ransomware data leak site (DLS) activity for impacted organizations in the United States.
For a deeper look into these groups, MOXFIVE has published Threat Actor Spotlights on Qilin, DragonForce, Inc, and Akira.
Professional Services faced more ransomware and extortion pressure in May than any other industry MOXFIVE tracked, with law firms accounting for the largest share of victims within the sector. The data threat actors can extract from a legal practice, privileged client communications, active litigation strategies, merger documentation, and confidential case materials, creates extortion leverage that few other sectors can match.
Based on MOXFIVE's tracking, Silent Ransom Group, Qilin, DragonForce, and Genesis drove the most activity against Professional Services in May, with law firms representing the largest share of victims within the sector. On May 26, the FBI issued a FLASH alert confirming that Silent Ransom Group has escalated its campaign against US law firms, adding physical intrusion to its existing social engineering playbook. As of Spring 2026, the group has dispatched operatives into law firm offices posing as IT support, connecting USB drives directly to workstations to exfiltrate data without deploying malware.
Figure 2: Top industries impacted by ransomware in May 2026.
Healthcare organizations face targeting pressure from multiple directions: patient data carries regulatory weight under HIPAA that makes any unauthorized disclosure a reportable event, and system downtime in clinical environments creates urgency to restore access that ransomware groups have used to pressure victims into paying.
Manufacturing and Production organizations face a related dynamic, where stopping a production line can break supply chain commitments, spoil perishable goods, and void contracts, raising the cost of every hour systems remain offline.
Retail and Hospitality organizations maintain large volumes of payment card data and customer records across distributed locations, making them attractive targets for groups focused on data theft and extortion.
Construction and Engineering firms hold project files, bid documents, and design data tied to active contracts, and threat actors have used the threat of exposing that material to pressure firms into paying even when encryption is the primary attack method.
When ransomware hits, a common entry point is a set of credentials stolen from an infected device, rather than a freshly exploited vulnerability or a complex intrusion. Infostealer malware harvests credentials, session cookies, and authentication tokens from infected devices. That stolen data can be packaged into logs and sold through underground markets, where initial access brokers identify enterprise credentials and resell verified network access to ransomware affiliates. The victim organization often has no indication their credentials are circulating on criminal infrastructure until an attack is already underway. The Verizon 2026 Data Breach Investigations Report, published May 19, quantifies the pattern: half of ransomware victims had a credential or infostealer event in the period before the attack.
How the Attack Chain Works
This attack chain can be difficult to detect because credential theft and ransomware deployment are carried out by different threat actors, often with weeks or months between the initial infostealer infection and the eventual intrusion.
Infostealer malware can reach both managed and unmanaged devices, and the credentials it harvests can be used to access corporate environments weeks or months after the infection occurred. Personal and BYOD devices extend that exposure further because they fall outside enterprise endpoint visibility in most cases. Defending against this requires controls that address the parts of the attack chain that endpoint protection alone does not reach.
Responding to an infostealer detection as a potential ransomware precursor, rather than an isolated endpoint event, can reduce the time between credential exposure and a full intrusion.
How MOXFIVE Can Help
MOXGUARD: Strategic advisory including AD/identity assessments, CVE alerting prioritized to active ransomware exploitation, guidance on segmentation and backup hardening, tabletop exercises with response playbooks, and pre-positioned incident response.
Professional Services: Control validation through EDR coverage assessments, purple team exercises, network segmentation reviews, backup immutability and restoration testing, external attack surface reduction, and SIEM/XDR detection engineering.
Our team has handled hundreds of ransomware cases against the most advanced and active operations, aligning preventive, detective, and recovery controls to current threat actor TTPs. Contact us at 833-568-6695 or incident@moxfive.com.