We have updated the Virtual Routes Ransomware Countermeasures Tracker with 24 additional entries. Twenty cover developments from July to September 2026; four add previously unrecorded developments from April and May. The update includes announcements published through 1 October, including the operation against KillSec carried out on 30 September.
In one of our previous updates, we highlighted action against supporting infrastructure, cross-border cooperation and European enforcement. These remain relevant. The latest additions also draw attention to what happens after an arrest, how authorities respond to extortion involving stolen data, and how different countermeasures address different parts of a criminal operation.
We would like to highlight three insights.
1. Judicial follow-through is a substantial part of the update
Ten of the 24 additions fall under the tracker’s conviction category: nine sentencing developments and one guilty plea. This makes judicial follow-through a prominent feature of this update, although it does not by itself establish that prosecutions are becoming more frequent overall.
In July, a UK court sentenced Thalha Jubair and Owen Flowers to five years and six months each following their guilty pleas over the Transport for London attack. In August, Ransom Cartel creator and administrator Maksim Silnikau received a 16-year sentence in the United States, following his earlier arrest and extradition. September brought sentencing developments involving Conti and Ryuk participants.
These entries make the longer timescale of counter-ransomware enforcement more visible. An arrest, extradition, guilty plea and sentence can occur years apart. Each is a distinct development, even when it concerns the same person or investigation.
That distinction matters when reading the tracker. Additional entries do not necessarily represent additional criminal groups disrupted. They can instead document authorities carrying an existing case through successive stages. The earlier sentencing developments added in this update help fill gaps in that record.
2. Stolen data is central to both extortion and the response
Several additions concern coercion through stolen information, whether or not files are encrypted. The May FBI advisory on Silent Ransom Group, included retrospectively, describes criminals impersonating IT support to obtain access, steal data and threaten its disclosure. The FBI explicitly notes that these operations do not depend on traditional ransomware encryption.
The TeamPCP entries show another route to data extortion. A July advisory described compromises of trusted software tools and the theft of sensitive information. In August, US authorities announced an indictment and an arrest in Australia, alleging compromised software-enabled data theft from downstream customers, followed by ransom demands. These remain allegations, rather than findings of guilt.
The response to exposed data also extends beyond criminal investigation. In September, Berlin established a central coordination unit after stolen administration data was published. Its responsibilities included coordinating assessment of the data and supporting notification and advice for affected people and organisations.
3. Countermeasures reach across people, services and infrastructure
The July sanctions illustrate the continued focus on enabling services. In a package coordinated with the UK, the EU designated Media Land, ML.Cloud and associated individuals, alongside developers of LummaC2 and an individual involved in Trickbot and Conti. The Council identified Media Land’s hosting services as facilitating malicious activity, including ransomware. The wider package also covered activity unrelated to ransomware.
Operation KillSwitch, carried out on 30 September and announced on 1 October, shows how several measures can be combined within one investigation. German-led authorities took control of KillSec’s leak site, secured at least 110 terabytes of stolen data and provisionally arrested three suspects. The operation involved authorities from ten countries, with Europol and Eurojust support.
