August 2026 Threat Trend Report on Ransomware
August 2026 saw a surge in ransomware incidents led by Qilin and Gentlemen, with CL0P exploiting PTC Windchill and FlexPLM vulnerabilities in a massive supply chain attack. Top 10 ransomware groups caused 577 incidents in August 2026, up from 406 in July. CL0P exploited vulnerabilities in PTC Windchill and FlexPLM, adding 42 organizations across 33 countries to its victim list. Qilin compromised the ATF CALEA system, demonstrating successful attacks against US federal law enforcement.
Detection / Hunteropenrouter
Immediate Actions
- Patch PTC Windchill and FlexPLM to latest versions immediately
- Audit PTC Windchill and FlexPLM deployments for signs of compromise
- Review ATF CALEA system architecture for security weaknesses
Key Takeaways
- Information and communication sector led with 63 incidents, followed by Manufacturing (46).
- US accounted for 158 cases, far exceeding Cyprus (15) and Italy (14).
- Qilin ranked first with 167 cases; Gentlemen second with 112.
- CL0P exploited PTC Windchill and FlexPLM flaws, hitting 42 orgs across 33 countries.
- ATF CALEA system compromised by Qilin, confirming law enforcement targeting.
Attack Chain
- Initial Access: CL0P exploited vulnerabilities in PTC Windchill and FlexPLM software to gain entry to victim networks
- Supply Chain Impact: 42 organizations across 33 countries were compromised through the exploited software vulnerabilities
- Ransomware Deployment: Various groups including Qilin, Gentlemen, and CL0P deployed ransomware across targeted environments
- Data Extortion: Victim data was exfiltrated and published on Dedicated Leak Sites (DLS) for extortion purposes
- Targeted Campaigns: Groups like Qilin specifically targeted law enforcement (ATF) and critical sectors including manufacturing and ICT
Affected Systems
- PTC Windchill product lifecycle management software
- FlexPLM product lifecycle management software
- CALEA system (ATF law enforcement)
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Article describes ransomware deployment and data exfiltration but provides no technical indicators for EDR detection. |
| Network Visibility | Medium | DLS activity and C2 communications implied but no specific network IOCs provided. |
| Detection Difficulty | Hard | No specific IOCs, hashes, or network indicators provided; only high-level campaign and victim information available. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for exploitation attempts against PTC Windchill and FlexPLM applications (T1190) by monitoring for anomalous HTTP requests or payload delivery patterns. | Web application firewall and application logs | Initial Access | Medium — vulnerability scanners may trigger similar patterns |
| Hunt for data exfiltration activity to Dedicated Leak Sites (T1567) by monitoring outbound traffic volume anomalies from servers handling sensitive data. | Network flow data and proxy logs | Exfiltration | Low — large outbound transfers from internal servers are rare |
| Hunt for ransomware deployment activity (T1486) by monitoring for mass file modification or encryption events on file servers and endpoints. | EDR file operation events and file server audit logs | Impact | Low — mass file encryption is rarely legitimate |
Required Log Sources
- Application logs for PTC Windchill
- Application logs for FlexPLM
- Network perimeter firewall logs
- Endpoint detection and response telemetry
Key Behavioral Indicators
- Anomalous HTTP requests targeting PTC Windchill or FlexPLM endpoints
- Mass file modification or encryption events on file servers
- Large outbound data transfers from internal application servers
- New or unknown processes executing on PTC Windchill or FlexPLM servers
Control Gaps
- Application vulnerability scanning may not cover PTC Windchill or FlexPLM
- Network monitoring may not detect slow data exfiltration to DLS
- Endpoint controls may not prevent ransomware deployment on servers
False Positive Assessment
Low — Article describes confirmed ransomware campaigns with verified victims and named threat actors.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy WAF rules to protect PTC Windchill and FlexPLM from exploitation
- Segment networks to limit lateral movement from compromised application servers
- Implement network-level blocking for known ransomware C2 infrastructure
User Protection
- Deploy EDR agents on all PTC Windchill and FlexPLM servers
- Enable application-level logging and alerting for PTC Windchill and FlexPLM
- Monitor for mass file encryption activity on file shares
Security Awareness
- Train staff on recognizing phishing attempts used for initial access
- Brief IT teams on CL0P supply chain attack patterns and indicators
MITRE ATT&CK Mapping
Initial Access
Exfiltration
Plain-Language Summary
Ransomware attacks increased significantly in August 2026, with the top 10 groups causing 577 incidents. The CL0P group exploited security flaws in widely used business software called PTC Windchill and FlexPLM, affecting 42 organizations across 33 countries including major companies like Shell. The Qilin group attacked a US federal law enforcement agency, the ATF, compromising its CALEA system. The United States was the most affected country with 158 cases, and the information technology and manufacturing sectors were hit hardest.