1,067 Victims, One Common Vulnerability
ThreatMon tracked 1,067 ransomware victims worldwide in August 2026. The report digs into 11 major incidents: a US federal law enforcement agency, a $10 billion wealth management firm, a Turkish hospital, a Japanese manufacturer, and a Brazilian government intranet among them. Nine different ransomware groups were involved — Qilin, Play, LockBit5, RansomHouse, Direwolf, TheGentlemen, and three others.
The dwell times tell an uncomfortable story. Zayo Group’s breach sat undetected for 11 days. US Bank’s for 19 days. PCL Holding’s compromise started in mid-July and wasn’t discovered until August 3rd — over two weeks of attacker access.
Different groups. Different targets. Different geographies. But every single incident depended on the same technical requirement: ransomware had to write files to disk.
The initial payload — delivered via phishing email, browser exploit, or compromised remote access — has to land on the file system before it can execute. The encryption process itself requires writing a modified (encrypted) copy of each file back to the hard drive. Data exfiltration requires reading files in bulk and writing them to a staging location or transmitting them via tools like Rclone. Lateral movement across the network typically involves writing files to remote SMB shares.
All of those operations happen at the Windows file system layer. And all of them can be controlled there.
Blocking Ransomware Before It Executes
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file operations before they complete. It doesn’t try to recognize ransomware variants. It enforces behavioral rules: which programs are allowed to perform which file operations.
The most upstream intervention point is payload delivery. When a ransomware executable arrives via email attachment, browser download, or remote access tool, it has to write to disk before it can run. A FileSure rule blocks unauthorized programs from writing executable files to the system:
File name filter: *.exe, *.dll, *.scr, *.bat, *.ps1, *.vbs
Operations: Write, Create
Allowed programs: Authorized deployment tools, Windows Update, approved installers
Drive type: Hard drives, Network drives
Result: Block and log all other write attempts
The ransomware payload never lands. It never executes. The encryption, exfiltration, and lateral movement described in the ThreatMon report never happen because the attack stops at step one.
This works on ransomware variants nobody has seen before. Qilin, Play, LockBit5, Direwolf — the group name doesn’t matter. The payload still has to write to disk, and that write operation is what gets blocked.
Detecting and Stopping Encryption in Progress
If a ransomware variant somehow bypasses delivery controls — perhaps it was already on the system before FileSure was deployed, or it exploited a zero-day in an allowed program — a second layer detects and stops the encryption process itself.
Ransomware encryption creates a recognizable pattern: hundreds or thousands of files modified in rapid succession. Normal user behavior doesn’t look like that. A threshold rule detects bulk file modification and blocks further damage:
File name filter: * (all files)
Operations: Write, Rename/Move
Drive type: Hard drives, Network drives, Removable drives
Threshold: 20 file modifications within 60 minutes
Result: Normal file saves pass without restriction. Ransomware crossing the threshold within seconds triggers an immediate block on subsequent write and rename operations.
The Hayward Holdings incident mentioned in the article illustrates why this matters. Falcon’s leak site claimed over a million customer records with PII, Salesforce data, distributor pricing lists, IT infrastructure blueprints, and privileged account credentials. Even if Hayward recovered their files from backup, those stolen credentials created ongoing risk for months.
Stopping the encryption early limits the blast radius. The files modified before the threshold fires are damaged, but the rest of the environment stays intact.
The Dwell Time Problem
The 11-to-19-day dwell times reported for Zayo Group and US Bank represent windows where attackers moved laterally, staged data for exfiltration, and prepared for the final encryption event. File-level monitoring would have flagged unusual activity during that window: unauthorized programs reading large numbers of files, bulk writes to staging directories, file transfers to external systems via Rclone or similar tools.
The article mentions that nearly every group in the report used the same tooling: Cobalt Strike for post-exploitation, Mimikatz for credential theft, AnyDesk for remote access, and Rclone for bulk data exfiltration. Those tools all interact with the file system. Cobalt Strike writes beacons and payloads. Rclone reads files in bulk and writes them to cloud storage or external locations. AnyDesk writes session logs and temporary files.
FileSure logs every file operation — which program accessed which file, when, and from which machine. Bulk read operations by Rclone, unexpected writes by AnyDesk, or lateral movement via SMB file shares all generate audit entries that stand out from normal user behavior. The dwell time becomes an opportunity to detect and respond, rather than an unmonitored window for the attacker.
Signature-based detection tools need to recognize each new ransomware variant before they can stop it. The ThreatMon report describes nine different groups with different tooling, different encryption schemes, and different operational histories. Qilin uses Golang-based ransomware with operator-controlled encryption modes. Play uses a custom .NET infostealer. LockBit5 targets VMware ESXi environments with cross-platform payloads.
Kernel-level file operation control doesn’t care what the ransomware calls itself or what language it’s written in. The payload still has to write to disk. The encryption process still has to modify files. Those operations are what get blocked.
FileSure Defend runs on legacy and modern Windows systems — Server 2003 through Server 2022, and all desktop versions back to XP. If your environment includes older systems that modern endpoint security tools won’t install on, FileSure still protects them. No signatures required. No waiting for vendor updates. It works offline, disconnected from the management server, because the rules are enforced locally at the kernel level.
Start a free 21-day trial at bystorm.com and see it block a simulated ransomware attack in real time. One server, ten workstations, fully functional. No credit card required.
Source: 1,067 Victims in 30 Days: Inside August 2026’s Global Ransomware Wave – ThreatMon
Category: Ransomware
Tags: ransomware, qilin, play, lockbit5, kernel filter driver, file system security, double extortion, bulk encryption detection
