July 2026 Threat Trend Report on Ransomware
The July 2026 Threat Trend Report on Ransomware highlights a complex threat landscape driven by established ransomware groups and the emergence of new data extortion actors. The Gentlemen group led with 159 claimed incidents, while manufacturing and the United States remained the most targeted industry and country, respectively. The report also identifies a SOCKS5 proxy disguised as Nezha RMM and vmtools.Exe, indicating ongoing evasion tactics using legitimate tooling.
- filenamevmtools.ExeFilename used as a disguise for a SOCKS5 proxy, masquerading as a legitimate VMware tool.
Detection / Hunteropenrouter
What Happened
In July 2026, ransomware attacks continued to rise globally, with established groups like The Gentlemen and Qilin leading the charge and several new groups emerging. Manufacturing companies and organizations in the United States were the primary targets. The attackers use dedicated leak sites to pressure victims by threatening to release stolen data. Organizations should focus on patching vulnerabilities, reviewing third-party access, segmenting networks, and maintaining reliable backups to protect against these threats.
Key Takeaways
- The Gentlemen ransomware group ranked first in July 2026 with 159 incidents, attributed to data collection corrections and external cross-referencing.
- Manufacturing was the most targeted industry globally with 85 incidents, followed by Information and communication (59) and Wholesale and distribution (40).
- The United States was the most targeted country with 247 incidents, followed by France (60) and Germany (54).
- New data-stealing and ransomware groups emerged in July 2026, including Gammax, SECTION9, ExfilSquad, Shiba, and GLOBAL SECRET GROUP.
- A SOCKS5 proxy disguised as Nezha RMM and vmtools.Exe was identified, indicating continued use of legitimate tooling for evasion.
Affected Systems
- Manufacturing sector systems
- Information and communication sector systems
- Healthcare and social welfare services sector systems
- Finance and insurance sector systems
- Public administration and defense sector systems
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers likely gain access through unpatched vulnerabilities or compromised third-party/supply chain access.
- Execution & Persistence: A SOCKS5 proxy disguised as Nezha RMM and vmtools.Exe is deployed for covert communication and evasion.
- Data Collection & Exfiltration: Data is stolen from compromised systems in targeted sectors like manufacturing and healthcare.
- Impact & Extortion: Stolen data is published on Dedicated Leak Sites (DLS) operated by groups like The Gentlemen and Qilin to pressure victims into paying ransoms.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules or queries.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR solutions can detect the masquerading of vmtools.Exe if it is running from non-standard directories or exhibiting network proxy behavior. However, if the process runs in a standard path, it may blend in with legitimate VMware tools. |
| Network Visibility | Medium | Network monitoring can detect SOCKS5 proxy traffic, but it requires baselining and analysis of traffic patterns to identify anomalous outbound connections. |
| Detection Difficulty | Moderate | Detecting masquerading and proxy behavior requires correlation between process execution and network telemetry. The use of legitimate tool names increases the difficulty of detection. |
Required Log Sources
- Process creation logs (e.g., Sysmon Event ID 1)
- Network connection logs (e.g., Sysmon Event ID 3)
- DNS resolution logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for instances of vmtools.exe running from non-standard directories or exhibiting unexpected network communication patterns. | Sysmon Event ID 1 (Process Creation) and Event ID 3 (Network Connection) | Execution and Command and Control | High, as legitimate VMware tools may trigger alerts if not properly baselined. |
| Hunt for processes masquerading as Nezha RMM that initiate unexpected outbound network connections. | EDR process and network telemetry | Command and Control | Medium, as Nezha RMM is a legitimate tool; its presence may be authorized in some environments. |
Control Gaps
- Standard signature-based antivirus may not detect masqueraded legitimate tools.
- Network controls may miss SOCKS5 proxy traffic if it uses standard ports like 443.
Key Behavioral Indicators
- vmtools.exe running from non-standard paths (e.g., %TEMP%, %APPDATA%)
- vmtools.exe initiating outbound network connections on non-standard ports
- Processes named after Nezha RMM components exhibiting proxy-like network behavior
False Positive Assessment
High - The use of legitimate tool names like vmtools.exe and Nezha RMM as disguises means that naive detections based solely on process names will generate false positives. Proper path and network behavior correlation is required.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider hunting for vmtools.exe instances running from non-standard directories or initiating unexpected outbound connections.
- If your EDR supports it, consider isolating hosts where masquerading behavior is confirmed.
Infrastructure Hardening
- Evaluate network segmentation to limit lateral movement opportunities for threat actors.
- Consider implementing egress filtering to restrict unauthorized outbound traffic on non-standard ports.
- Audit and restrict third-party and supply chain access privileges as suggested by the report.
User Protection
- Ensure all systems, especially in manufacturing and healthcare sectors, have up-to-date endpoint protection.
- Consider application whitelisting to prevent unauthorized execution of tools like Nezha RMM.
Security Awareness
- Consider rolling threat intelligence updates on active ransomware groups into existing awareness programs.
- If applicable, remind employees about the risks of downloading unverified remote management tools.
MITRE ATT&CK Mapping
Initial Access
Stealth
Command and Control
Exfiltration
Additional IOCs
- Other:
Nezha RMM- Legitimate remote management tool name abused as a disguise for a SOCKS5 proxy.