Industry-wide Ransomware Victims

Manufacturing was the most affected industry, accounting for 35 ransomware victims (19.77%) of all reported ransomware attacks. Business Services followed with 20 victims (11.30%), while IT recorded 18 victims (10.17%). Healthcare accounted for 16 victims (9.04%), and Retail reported 13 victims (7.34%), highlighting the significant impact of ransomware across industrial, commercial, and technology-driven sectors.

Among the other significantly affected industries, Law Firms recorded 11 victims (6.21%), followed by Education with 10 victims (5.65%) and Transportation with 9 victims (5.08%). Finance, Media & Internet, and Hospitality each reported 7 victims (3.95%), demonstrating the continued presence of ransomware threats across professional services, financial institutions, and consumer-facing businesses.

Several industries experienced moderate ransomware activity, with Energy, Architecture, and Agriculture each recording 4 victims (2.26%). Construction and the Federal sector each accounted for 3 victims (1.69%), reflecting the continued exposure of infrastructure-related industries and government organisations to ransomware attacks.

Among the industries with lower victim counts, Real Estate and Telecommunications each reported 2 victims (1.13%). Insurance and Organisations recorded 1 victim each (0.56%). Although these sectors represented smaller shares of the overall ransomware activity, their inclusion demonstrates that ransomware threats extend across a wide range of industries.

The Seven Deadly Sins Ransomware

Group Overview

Red Piranha identifies The Seven Deadly Sins (7DS, TSDS) as a data-theft extortion crew, not an encrypting ransomware group. The operator says it does not use ransomware; no encryptor, note, extension or sample has been observed. [1][2][3][4]

Its business model, breaking into a cloud software supplier and walking through that supplier's connections into customers' Salesforce data, is the one the ShinyHunters extortion crews made their own. And its leak servers are laid out like theirs: stolen data sits under a folder called /pay_or_leak/, each victim folder holds a plain-text INFORMATION.txt describing what was taken, archives use the same 'should have paid the ransom' naming, and one mirror sits with the same Russian hosting provider (Prospero). Red Piranha assesses with MEDIUM confidence that the group reuses the ShinyHunters template and model; whether it is the same people or an imitator is UNKNOWN. [3][4][9]

The operator says it emails the target first and allows about a week to respond. The organisation is then placed on the leak site with a 48-to-72-hour countdown and a public proof sample, and an INFORMATION.txt on a separate archive server states what was taken and the deadline. After expiry the card stays 'notified, no response' or 'unreachable', or is marked 'SOLD, data sold to private buyer'; three of the seven current cards have shown that label in every capture since 15 October. The group says payment buys deletion. [3][4]

Technical Analysis

No malware sample or incident report exists for this group. The steps below come from the operator’s own leak-site text, what it told a journalist, and what two victims and one regulator confirmed. Nothing was encrypted. This is data theft followed by extortion.

Initial foothold

The group breaks into suppliers, not victims. It compromised the maker of a product-feedback tool that many companies connect to Salesforce and took the keys the tool uses to log in to each customer. Those keys opened each customer’s Salesforce directly. A second route is a company reporting dashboard (Metabase) left open to the internet, with the databases behind it.

Evidence: a victim and a regulator (424 organisations in Türkiye) confirm the Salesforce route, and two customer notices describe the stolen keys. The dashboard route is the operator’s claim, backed only by a hospital that found possible unauthorised access to a reporting system.

Access and persistence

No malware is involved. The stolen keys are the access, and they work until the supplier or the customer cancels them, which happened from 28 August. The operator also claims standing access to 300+ Jira and 50+ other business-tool accounts.

Evidence: the key theft and the cancellations are confirmed. The standing-access figures are the operator’s word only.

Discovery

Once inside, the group looks for what is worth selling. Its notes on victim pages list the contents of one reporting tool (161 users, 81 dashboards), database table names and cloud-storage file lists.

Evidence: taken from the operator’s own notes on its archive server, with no outside confirmation.

Collection and exfiltration

The group copies customer records, billing files and database tables, then packs each victim’s data into a 7z archive. The operator says it exported the confirmed victim’s Salesforce data on 26–28 August. It claims about 230 million rows and 3.8 TB in total.

Evidence: one victim confirmed only limited business-contact and contract data, and the hospital confirmed programme records only. The volumes are unverified.

Extortion

The group emails the victim, then posts a leak-site card with a 60- or 72-hour countdown and a proof sample. A card ends as expired, SOLD, or “session open” (negotiating). The operator says payment buys deletion. As of 22 October, the board shows 3 SOLD, 3 expired and 1 negotiating, and the onion site and its mirror went offline on 21–22 October for an unknown reason.

Evidence: the process is consistent across the leak site, the operator’s interview and tracker captures. No payment has been confirmed, and the claim of low-eight-figure ransoms is unverified.

MITRE ATT&CK Mapping

Only techniques evidenced by the group's own pages and statements, by a confirmed victim or regulator, or by public scans of the group's servers are mapped; where the only source is the operator, the row says so. [3][4][5][6][7][8]

Indicators and Contextual Observables

Every indicator below is specific to The Seven Deadly Sins: each was published by the group on its own pages or has been recorded by a tracker or a public scan serving those pages. Victim domains are not malicious infrastructure and are not listed. [1][2][3][10]

Leak-Site Captures

Crystal Eye CE 6.0 Mitigation and Remediation

The Seven Deadly Sins reaches its victims through software connections and exposed dashboards rather than through endpoints or phishing, so the Crystal Eye controls that matter most are the ones that find exposed services, map third-party access and catch data leaving.

·       Find and close exposed dashboards and consoles - Install Vulnerability Scanning from the Marketplace (Compliance Controls > Vulnerability Scanning) and run overnight network and host scans so that business-intelligence tools, database front-ends and administrative panels reachable from the internet are flagged; then use Advanced Firewall custom security zones that block everything except approved connections, with the built-in VPN options (SD-WAN WireGuard or SSL VPN) for remote staff, so those services are reachable only from inside the Crystal Eye network.

·       Keep a register of third-party connections - Use Risk Auditing (the CIS Controls v8.1 basic-hygiene IG-1 checklist, recording Software and Data assets) together with Network Map device tagging to record every SaaS integration that holds standing access to CRM, ticketing or data-warehouse platforms, and reassess them on a schedule rather than at onboarding only.

·       Watch identity and application changes - Where the tenant uses Microsoft 365, use the Entra ID dashboards in M365 Risk and Compliance and Azure Threat Hunting in the Threat Hunt Dashboard to review new application registrations, consent grants and role changes, since a connected application that gains administrator rights is the Microsoft 365 equivalent of the Salesforce connected-app abuse seen here; the CRM and ticketing platforms themselves must be reviewed in their own admin consoles.

·       Alert on structured data leaving the network - Run Data Loss Protection in Alert or Reject mode for files carrying card numbers, government identifiers and other structured personal data; note that exports from a cloud CRM to an attacker do not cross the gateway, so this control covers on-premises data stores and the dashboards in front of them.

Known Intelligence Gaps

Two of the nine listed organisations have confirmed an incident, and each confirmed less than the operator claims: a third-party route and a limited data set in one case, an internal reporting system holding programme records rather than the general patient base in the other. No full archive has been observed served, no bundle has been downloaded to test the stated row counts, and the one stock-exchange-listed organisation on the board has filed no US securities breach disclosure (SEC Form 8-K Item 1.05). Victim names are withheld from this report by policy and held in the analyst collection record. [1][5][8]

No vendor incident-response report exists. Every operator quotation trace to a single interview, which also contains an internal inconsistency (data exported on 26 to 28 August from a vendor said to have been attacked on 28 August). How the SaaS vendor itself was entered and what 'exposed Metabase' means in practice are undocumented. [4][7]

No ransom demand, wallet, payment or buyer is public; the 'low-8-figure' statement and the 'SOLD to private buyer' labels are operator claims; the SOLD cards carry a 23 September deadline stamp, and when the label was applied between 24 September and 15 October is not known. The ShinyHunters template overlap is an observation from public scans and the operator's own file names; no vendor has published an attribution either way. [3][4][9]

The infrastructure changed during the window without explanation: the onion and the live mirror became unreachable on 21 to 22 October, while one other address still served the September board on 22 October and a third had served it to a public scan the day before. URLhaus and MalwareBazaar checks were not completed. [2][3]

Source References

[1] Ransomware.live: The Seven Deadly Sins (7DS) group page, API victim records and leak-site captures. https://www.ransomware.live/group/the%20seven%20deadly%20sins

[2] RansomLook: The Seven Deadly Sins group page, locations and archived board captures of 20 to 22 October 2026. https://www.ransomlook.io/group/the%20seven%20deadly%20sins

[3] urlscan.io public scans of the group's clearnet mirrors and archive index, 16 to 21 October 2026, with Red Piranha analyst retrievals of the identity page (20 October) and the static September mirror (22 October) held on request. https://urlscan.io/result/01a15f2a-ba81-720c-9666-094fd2778e66/

[4] DataBreaches.net: interview with The Seven Deadly Sins spokesperson on the SaaS-vendor Salesforce breach and its other affected customers, 23 September 2026 (updated 26 September). https://databreaches.net/2026/09/23/canva-hacked-via-vendors-salesforce-instance-other-customers-affected-as-well/

[5] Cyber Daily: Australian software company confirms third-party data incident claimed by The Seven Deadly Sins, 19 October 2026. https://www.cyberdaily.au/security/14317-exclusive-aussie-software-giant-canva-confirms-third-party-data-incident

[6] KVKK (Türkiye Personal Data Protection Authority): public announcement on the data-breach notification, decision 2026/2037 of 16 September 2026. https://www.kvkk.gov.tr/Icerik/8961/kamuoyu-duyurusu-veri-ihlali-bildirimi-canva-pty-ltd

[7] Customer security notice on the third-party feedback vendor breach (API keys, integration credentials and hashed passwords retrieved; access terminated 28 August), 6 October 2026. https://discuss.circleci.com/t/security-notice-beware-of-spear-phishing/54903

[8] IT Forum (Brazil): hospital confirms unauthorised access to an internal reporting system identified on 21 September 2026 and notifies the ANPD and Federal Police, 16 October 2026. https://itforum.com.br/noticias/hospital-sirio-libanes-ataque-cibernetico/

[9] The Hunter's Ledger: ShinyHunters data leak site at 91.215.85[.]22, infrastructure, victims and attribution, 17 April 2026 (revised 16 October 2026). https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/

[10] VirusTotal domain and IP address reports for the leak-site onion, the four clearnet addresses and gumruk[.]info, and AlienVault OTX pulse 6ad1a663cd6ca4db5040ea34, 20 to 22 October 2026. https://www.virustotal.com/gui/ip-address/37.77.150.177