Trellix Records 124 Active Ransomware Groups—Defense Shifts to Identity Controls

The market fragmented while the attack pattern converged

Trellix recorded 124 active ransomware groups in its November 2026 CyberThreat Report, including 55 newcomers responsible for 22% of 5,505 victim posts over six months. The operational finding matters more than the group count: the most common tools were legitimate utilities including Windows Command Shell, PowerShell, PsExec, Net and Mimikatz. Data Encrypted for Impact appeared in 96% of Trellix ransomware detections.

The implication for enterprise buyers is direct. Relying on threat-intelligence signatures for named ransomware families is materially weaker than controls that detect credential theft, lateral movement, PowerShell abuse and remote administration. A product claiming "ransomware protection" without demonstrating visibility into these native tools does not address the observed attack pattern.

This favors platforms with behavioral EDR/XDR, identity analytics, privileged-access controls and attack-path detection—Trellix, Microsoft Defender, CrowdStrike, SentinelOne and Palo Alto Networks—over narrowly focused ransomware blockers. Enterprises should budget for broader endpoint and identity telemetry, with particular scrutiny of coverage for PowerShell, PsExec, administrative shares and credential-dumping activity.

Huntress targets attacks launched from unprotected systems

Huntress announced Remote Ransomware Attack Disruption for Managed EDR, scheduled for general availability November 30, 2026. The company says nearly 30% of ransomware cases it observed in 2026 originated from an unprotected system, which attackers then used to perform reconnaissance and attack protected endpoints.

The feature uses ransomware canaries and automatically blocks communication between protected systems and the compromised, unmanaged system when it detects the attack pattern. Huntress says the capability will activate automatically on systems with the required telemetry and will identify when coverage is unavailable.

The approach competes with conventional endpoint-only EDR from CrowdStrike, SentinelOne, Microsoft and Sophos by addressing unmanaged or out-of-band attack paths. It also overlaps with network detection, NAC and segmentation products from Cisco, Fortinet and Palo Alto Networks.

Enterprises should ask whether endpoint products can detect ransomware propagation from devices they do not manage, including legacy servers, contractors' machines, unmanaged laptops and poorly covered Linux systems. Buyers may need to pair EDR with network segmentation or NAC rather than assume every endpoint is enrolled. Huntress did not disclose pricing, so the immediate purchasing question is coverage scope: which operating systems, network sensors and telemetry sources are included, and whether automatic blocking requires a higher-tier subscription.

Acronis and NCC Group highlight Linux, ESXi and control-plane exposure

Acronis released its inaugural TRU Cyber Pulse 2026 report November 9, saying attackers are deliberately disabling security controls and logging to create blind spots, while ransomware activity is reaching deeper into Linux and VMware ESXi infrastructure. The release did not provide a ransomware-specific price, customer count or independently validated prevention benchmark, making it thin as a product-buying announcement. Its practical value is the infrastructure emphasis: protecting Windows endpoints alone does not cover virtualization hosts, Linux workloads or the control plane used to restore enterprise services.

NCC Group's Q3 2026 review recorded 2,865 ransomware victim claims, up from 2,325 in Q2, a 23% increase. North America and Europe accounted for the largest share. Public leak-site counts are an imperfect proxy because they can include duplicates, delayed disclosures and unverified claims, but the increase strengthens the case for managed detection and response, immutable backups, identity protection and rapid incident response.

Enterprises should verify that backup and recovery products protect ESXi management interfaces, Linux workloads and backup credentials, and that security controls remain observable after an attacker tampers with agents or logging. A ransomware-resilience budget should distinguish endpoint prevention from recoverability of the virtualization layer. A backup product that cannot isolate or rapidly restore hypervisor infrastructure leaves a major operational gap. The issue puts Acronis in competition with VMware-focused recovery and security tools, hypervisor monitoring, workload protection and backup vendors such as Veeam, Rubrik, Cohesity, Commvault and Microsoft.

What to watch

The clearest purchasing shift is from "Which ransomware families does this product block?" to "Can it stop credential-driven lateral movement across managed and unmanaged systems, and can the organization restore Linux and virtualization infrastructure?" Trellix's 124-group, 5,505-post dataset supports behavior-based detection. Huntress's nearly-30% unmanaged-origin figure supports investment in network-aware containment and asset-coverage validation.

Security leaders should use the NCC Group increase to pressure-test ransomware budgets, recovery-time objectives and cyber-insurance controls. The relevant procurement metrics are tested restoration time, percentage of critical assets covered, privileged-account exposure and time to contain lateral movement—not simply the number of blocked malware samples. Vendor-specific playbooks have a short shelf life because the ecosystem is unusually fragmented. Controls should be mapped to behaviors such as credential access, remote execution and mass encryption.