US ransomware victims pile up in 48 hours

Security Arsenal recorded a run of ransomware postings from three groups naming victims in the United States. DIREWOLF said it had added six victims in 48 hours, including PayrHealth, Colla Health and AAM:HOA Management. COINBASECARTEL reported four new victims over a five-day window, with Sweet Water Holdings and Serruya private equity among the cases cited. XPL0ITRS listed RapidFort as a victim in a batch of three cases.

¿Qué mostraron las publicaciones de DIREWOLF?

DIREWOLF posted six victims in 48 hours, with PayrHealth, Colla Health and AAM:HOA Management among the organizations affected in the United States, according to Security Arsenal. Over that span, the sectors identified were health care and professional services, while technology also appeared in the broader set of victims.

¿Qué se informó sobre COINBASECARTEL?

COINBASECARTEL reported four new victims in a five-day window, according to Security Arsenal, and Sweet Water Holdings and Serruya private equity were among the U.S. cases cited. The tracking placed those victims in a broader group that also included agriculture and food production, as well as professional services and manufacturing.

¿Qué se sabe del lote publicado por XPL0ITRS?

XPL0ITRS listed RapidFort as a victim in a batch of three cases, and Security Arsenal classified it in the technology sector in the United States. The finding rounds out a brief stretch in which different groups posted confirmed victims in the same country and across sectors ranging from health care and services to technology, agriculture and manufacturing.

¿Qué dice el panorama de Check Point sobre EE. UU.?

Check Point Research said in its ransomware review for the second quarter of 2026 that the U.S. share of victims fell from 50% to 42% quarter over quarter. That figure provides context for the recent victim-posting activity, although the available material does not include deep technical TTPs from an independent primary source.