799 Attacks in One Month — And the Same Vulnerability
Ransomware attacks jumped nearly 20 percent in July 2026, with 799 incidents recorded by Comparitech. The most-hit sectors were finance (up 71%), tech (up 62%), pharma and medical billing (up 46%), and education (up 44%). The United States saw 322 of those attacks.
Two gangs dominated: Qilin claimed 125 victims, and The Gentlemen claimed 135 — together accounting for nearly a third of all attacks that month. Their methods varied. The Gentlemen typically used stolen credentials. Qilin told The Register they exploited zero-day vulnerabilities in their 2024 Synnovis attack.
Different ingress methods. Different gangs. Different targets. But every single one of those 799 incidents shared the same technical requirement: the ransomware had to write encrypted versions of files to the victim’s disk.
That’s not a vulnerability in the traditional sense. It’s how file encryption works. You can’t encrypt a file without writing the encrypted version somewhere. And that write operation happens at the Windows kernel level, where FileSure Defend operates.
Blocking Ransomware Before It Executes
The article closes with familiar advice: ensure employees use MFA, keep systems updated, make regular backups. All reasonable. But none of those controls address what happens after an attacker gets in.
MFA stops credential theft — until it doesn’t. Patching closes known vulnerabilities — but Qilin was exploiting zero-days. Backups let you recover — after your production environment is already encrypted and your operations are offline.
FileSure Defend enforces file access policies at the kernel level, before the ransomware payload ever lands on disk. When a user clicks a malicious email attachment, their email client attempts to write an executable file to the Downloads folder. That write operation gets intercepted. If the email client isn’t on the authorized list of programs allowed to write executables, the operation is blocked. The payload never lands. The ransomware never runs.
A simple rule configuration:
- File name filter:
*.exe, *.dll, *.bat, *.ps1, *.vbs - Operations: Write, Create
- Programs: Block all except authorized software deployment tools
- Drive type: All local drives
- Result: Ransomware payloads delivered via email, browser downloads, or remote access tools are blocked at the write stage.
No signature required. No waiting for your AV vendor to analyze the new variant and push an update. The rule doesn’t care whether it’s Qilin, The Gentlemen, or a gang that doesn’t exist yet.
Containing Damage When Prevention Fails
Let’s say an attacker bypasses every other control and gets a ransomware binary running on a machine. FileSure’s threshold-based bulk encryption detection fires when a process modifies more than 20 files in 60 minutes. Normal users don’t hit that threshold. Ransomware — which encrypts hundreds of files per minute — crosses it within seconds.
The configuration:
- File name filter:
*(all files) - Operations: Write, Rename/Move
- Drive type: Hard drives, network drives, removable drives
- Threshold: 20 matches within 60 minutes
- Result: After the 20th file modification, subsequent write and rename operations are blocked. Damage is contained to the files modified before the threshold fired.
The article mentions that finance, healthcare, education, and manufacturing are the sectors most likely to pay ransoms — with even the least likely (finance) still paying 51% of the time according to pentesting firm DeepStrike. Organizations pay because the alternative is operational paralysis.
FileSure removes that calculus. The ransomware doesn’t get to encrypt your files in the first place.
The Advice That Doesn’t Scale
“Patch faster” assumes you have zero-day protection. You don’t. “Use MFA” assumes credential theft is your only ingress vector. It isn’t. “Make backups” assumes you’re okay with downtime and recovery costs. Most organizations aren’t.
The 799 organizations hit in July had security tools. They had policies. Many of them probably had backups. They still got encrypted.
The common factor in every one of those incidents was an unauthorized program writing to the file system. That’s the chokepoint. Control it, and the attack method becomes irrelevant.
FileSure Defend runs on Windows systems from Server 2003 through Server 2022. If you’re protecting legacy infrastructure — medical devices, industrial systems, anything locked to an older Windows version — it installs there too. Start a free 21-day trial at bystorm.com and see it block a simulated ransomware attack in real time.
Source: Ransomware attacks spike as world distracted by AI
Category: Ransomware
Tags: ransomware, qilin, the gentlemen, file system security, kernel filter driver, bulk encryption detection, zero-day protection, healthcare ransomware
