Skip to content
HACKTECH
Ransomware & extortionReported Published 3 sources

Coveware Q3 2026: median ransom rises to $400,000; leak questions paying for silence

Coveware's quarterly ransomware report for Q3 2026, published on 28 October 2026, said the median ransom payment rose 167% to $400,000 while the average payment fell 45% to $1,025,278, and that nearly 80% of incidents were resolved without payment. The report centred on a leak of internal chat logs attributed to the Silent Ransom Group, which Coveware said identified several victims that had paid a ransom to keep their incident out of the public domain. Check Point, which analysed the leaked 'Luna Moth Files' (Luna Moth is another name for the group), described a phone-based data-extortion operation focused on law firms and said it treats the archive's claims as unverified unless independent sources back them up.

  • Coveware
  • Silent Ransom Group
  • Luna Moth
  • data extortion
  • vishing
  • law firms
  • ransom payments
  • Q3 2026

What the sources report

  • Coveware's Q3 2026 report put the median ransom payment at $400,000, up 167% on Q2 2026, while the average payment fell 45% to $1,025,278.
  • Coveware said nearly 80% of incidents were resolved without a ransom payment, although overall and data-exfiltration-only payment rates both rose slightly on the previous quarter.
  • No single group dominated Coveware's caseload: The Gentlemen and independent 'lone wolf' actors each accounted for 6% of cases, Inc Ransom 5%, and FulcrumSec, Qilin and ShinyHunters 4% each; phishing and social engineering led initial access vectors at approximately 29%.
  • Check Point said an anonymous onion site, 'The Luna Moth Files', appeared around 5 October 2026 claiming to expose internal material of the Silent Ransom Group (also tracked as Luna Moth and UNC3753), and that 42 of the group's 50 most recently observed victims were law firms; it treats the archive's claims as unverified unless independently corroborated.
  • Coveware said the leaked chats identified several victims that had paid a ransom to keep their incident out of the public domain, and that victim organisations are recognising that paying for non-disclosure 'offers little guarantee against repeat extortion or eventual data leaks'.
  • Coveware warned senior law-firm partners that several ransomware groups are studying firms' people and profile pages to build bespoke vishing campaigns, and forecast that the majority of the Am Law 100 will have been impacted by the time the campaign winds down.

What it means for your organisation

Coveware ranked phishing and social engineering ahead of software exploitation as an initial access vector, and the leaked material describes intrusions that start with a phone call and a remote-support session rather than an exploit, so perimeter patching alone does not address them. Coveware notes that paying rarely relieves notification obligations and that promises to delete stolen data cannot be verified, which puts as much weight on the response plan and legal decision path as on containment. Firms whose staff profiles are public, such as law firms, should expect those pages to be used to build pretexts.

What we check

  • Run vishing and callback-phishing exercises against executives and partners, using pretexts built from public staff profile pages.
  • Test help-desk and IT-support identity checks for remote sessions, password resets and MFA changes.
  • Review allowlisting and alerting for remote monitoring and management tools installed outside approved channels.
  • Check detection of bulk exports from cloud and SaaS platforms and uploads to consumer file-sharing services.
  • Run a data-only extortion tabletop covering isolation authority, legal notification and the case against paying for silence.

Sources

Services that cover these checks

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works