Worldwide Ransomware Victims

Worldwide ransomware victim distribution shows that the United States was the most affected country, with 88 victims, accounting for 43.35% of total ransomware activity. This indicates that more than two-fifths of all reported ransomware victims were located in the United States.

Canada recorded the second-highest number of victims, with 11 cases, representing 5.42% of the total. Spain followed with 8 victims, accounting for 3.94%. Brazil, France, and Germany each 7 victims, contributing 3.45% individually. India and the United Kingdom each recorded 5 victims, repreenting 2.46% of overall ransomware activity.

Other countries with notable ransomware impact included the United Arab Emirates, Australia, and Egypt, each reporting 4 victims, accounting for 1.97% individually. Turkey, Malaysia, Italy, and Taiwan each recorded 3 victims, representing 1.48% of the total ransomware activity.

Several countries reported 2 victims each, accounting for 0.99% individually. These included Saudi Arabia, Chile, Japan, Colombia, Denmark, Mexico, Switzerland, Ireland, Finland, Thailand, and Israel.

The remaining countries recorded 1 victim each, representing 0.49% individually. These included Lebanon, Iran, Trinidad and Tobago, Peru, Haiti, Belgium, Austria, Sweden, Slovakia, the Netherlands, the Czech Republic, Oman, Bulgaria, Cyprus, Qatar, Uruguay, Greece, Algeria, and Vietnam.

Black X Ransomware

Group Overview

Last Week Black X posted three organisations to its leak site, all on 9 October 2026: Bayer (Germany, life sciences), enTouch (Japan, IT for the pharmaceutical sector) and Lopay (United Kingdom, payments). The enTouch post claims the full data.entouch.jp customer and consultation database, while the Bayer post describes no stolen data. None of the claims has been confirmed by the victim, a regulator or the media. [1][2]

Black X runs a double-extortion leak site and is profiled as crypto-ransomware first seen in May 2025, although public reporting of the leak site only began in May 2026. Earlier victims are concentrated in South Korea, including car-parts maker IWIN, with others in Vietnam, South Africa and Yemen. [2][3][5][6]

Technical Analysis

No Black X malware sample, hash, ransom note or file extension is publicly available, so its encryption and intrusion behaviour cannot be confirmed. [3]

MITRE ATT&CK Mapping

The techniques below come from aggregator listings and infostealer exposure data. None is backed by a sample or incident report, so treat them as hunting leads rather than confirmed Black X behaviour. [4][12]

Indicators and Contextual Observables

Only the leak-site onion address is strongly associated with Black X. The IP address comes from a single unverified source and should be treated as a hunting lead. [1][3][7][9]

Public Platform Validation

Detection Opportunities

No Black X payload telemetry is public, so these detections target the claimed behaviour: theft of database and payment records. [2][11]

• Alert on unusual queries, exports and after-hours access to CRM, consultation, customer and payment-transaction databases, especially by accounts that do not normally use them. [2][11]
• Correlate large archive creation, staged exports, cloud-sync activity and sustained outbound transfer from database, application or file servers. [11]
• Alert on Tor client traffic and .onion DNS queries from corporate hosts; ANY.RUN raised Tor DNS-policy alerts when the leak-site URL was opened. [10]
• Hunt firewall, proxy and NetFlow history for 172.86.110[.]111 and TCP 4000 as a low-confidence lead, and escalate only when hits correlate with other intrusion signals. [7][9]
• Monitor for compromised-credential use: new devices, impossible travel, MFA changes and session reuse for accounts that appear in infostealer exposure data. [2]

Mitigation and Remediation Recommendations

• Require phishing-resistant MFA for remote access, privileged administration, email, SaaS and partner portals; rotate exposed credentials and invalidate active sessions. [11]
• Segment customer-data, payment and database systems from user networks and internet-facing services; allow only documented flows. [11]
• Restrict bulk exports and cloud uploads from systems holding customer, clinical or payment data; apply least privilege and approval for high-volume exports. [11]
• Maintain offline or immutable backups, protect backup credentials separately, and test restoration of critical services. [11]
• Organisations that use enTouch, Lopay or Bayer services should request a supplier security statement and review data shared with those platforms while the claims remain unverified.
• If a claim is received, preserve memory, endpoint and server images, authentication, database and firewall logs and the exact operator communication before reimaging, and do not engage the operator without legal and incident-response guidance. [11]

Crystal Eye CE 6.0 Mitigation and Remediation

The following Crystal Eye controls address the claimed data theft and the unknown initial-access path.

• Reduce exposed attack paths - Use Advanced Firewall zones and permit-by-exception rules for internet-facing, database, payment, management and backup networks.
• Detect suspicious access or exploit traffic - Apply IDPS policies to exposed and high-value segments, enable event logging, and add local rules for validated indicators.
• Control anonymizers and leak-site access - Use Web Filter profiles, banned categories and custom policies to block Tor gateways, anonymizers and .onion proxy services.
• Correlate a leak claim with telemetry - Use Threat Hunt top-user, top-device, external-IP and upload-volume views to baseline and investigate spikes from database and payment systems.
• Escalate validated high-risk alerts - Use AI and Escalation Reports and Incident Response Services to escalate relevant IDPS and AV alerts to the Security Operations Team.

Confidence Assessment

Known Intelligence Gaps

• No victim confirmation, data sample or data volume is available for any of the three listings. [2]
• No malware sample, ransom note, extension or behaviour report is public, so no technique is confirmed. [3][4]
• No ransom demand, payment or wallet evidence was found, and trackers disagree on victim counts (14 to 20) and first-seen dates. [1][2][3][4]

Source References