The NJCCIC has recently received multiple reports of ransomware incidents affecting public and private organizations in New Jersey. The activity has been attributed to established ransomware operations, including Qilin, INC Ransom, and SafePay, as well as emerging groups such as Booba Project and Dark Project. The incidents encompassed file and server encryption, data exfiltration, and threats to publicly release stolen information if ransoms are not paid. Notably, some incidents featured data theft and extortion without observed encryption.
The trends identified in recent incidents in New Jersey are consistent with activity observed more broadly across the ransomware landscape. In 2026, the ransomware ecosystem has become increasingly fragmented with the rapid emergence and turnover of smaller ransomware groups. Additionally, the adoption of artificial intelligence (AI), paired with the availability of established criminal tools and services, lowers barriers to entry, enabling threat actors to develop capabilities and establish operations more rapidly. As a result, newer groups can affect organizations much more quickly. At the same time, limited information may be available about their capabilities and infrastructure. When combined with the continued activity of more mature operations, these developments complicate threat monitoring and reinforce the importance of defending against common ransomware intrusion methods and behaviors.
Recommendations:
- Implement MFA for all accounts, particularly those associated with remote access services and administrative privileges. Disable unnecessary remote access services and regularly review account permissions.
- Prioritize patching known vulnerabilities, particularly those affecting internet-facing systems and remote access services.
- Implement endpoint detection and response (EDR) solutions and monitor for suspicious authentication activity, unauthorized administrative access, and other indicators of ransomware-related activity.
- Segment networks and restrict administrative privileges to limit lateral movement and reduce the potential impact of a successful compromise.
- Restrict access to sensitive information and monitor for unusual data transfers, bulk file access, and other indicators of potential data exfiltration.
- Maintain regularly tested, offline or otherwise isolated backups of critical systems and data to support recovery following a ransomware attack.
- Develop and regularly test incident response plans that address system encryption, data theft, and extortion.