Byer-Nichols Threat Brief for May 1-15 2026

The first half of May was relatively routine overall, with ransomware activity continuing to heavily impact small businesses, which accounted for 79.06% of victims. Construction, retail, and financial services emerged as the most targeted sectors, while the United States remained the primary victim location at 45.08%. One notable development was the sudden emergence of Bavacai as a new ransomware-as-a-service (RaaS) operation, rapidly entering the top five ransomware actors after posting roughly