warlock

The patches resolve a critical vulnerability in Android’s System component that could lead to privilege escalation. The post Android’s October 2026 Updates Patch 25 Vulnerabilities appeared first on SecurityWeek .

Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. "Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a

For the latest discoveries in cyber research for the week of 5th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Arizona’s state court system has suffered a phishing-led cyberattack after an employee clicked a malicious link. Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports dating back to 2010, exposing personal and case-related information belonging to current and former participants. Japanese car-sharing service Times Car has disclosed a data breach affecting approximately 6.6 million current and former accounts. Exposed information includes personal data, while identity-verification documents, including driver’s-license images, were exposed for about 1.6 million accounts. Payment card information was not affected. South Africa’s air navigation provider has suffered a ransomware attack affecting operational technology supporting aviation weather services. Preliminary findings identified suspicious activity in weather-related environments, while separate reporting cited possible data theft. The provider has sought independent digital forensics to determine the scope of the incident. Fakturownia, a Polish online invoicing platform used by more than 600,000 businesses, has disclosed a data breach after an attacker exploited a system vulnerability. Copied information included account and company data, password hashes, bank account details, authentication tokens, contractor information, and portions of invoices stored on the platform. AI THREATS Researchers observed autonomous AI agents attempting rudimentary hacking techniques while gathering public information from US and Canadian government websites. Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada. Officials reported no compromise, while the origin of the agents remains unconfirmed. Researchers demonstrated that malicious Custom GPTs hosted on ChatGPT were used in a ClickFix campaign to deliver remote access malware. Victims were redirected to a Google Sites page and tricked into running commands. Huntress investigated at least 40 related incidents, including two confirmed infections that began through Custom GPTs. Researchers outlined how JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals to automate cloud reconnaissance and destructive actions. The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway. Attackers have exploited the flaws to gain remote access, deploy web shells and tunneling malware, steal credentials, and move from exposed appliances into internal networks. Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager. The flaw allows an unauthenticated remote attacker to send crafted requests and gain administrator access. Cisco reported active exploitation and stated that no fixes are available. Check Point IPS provides protection against this threat (Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504)) Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs. Processing a malicious image or PDF can allow arbitrary code execution. Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases. GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9. Authenticated Duo Agent Platform users can escape the prompt-template sandbox and execute arbitrary commands on the AI Gateway host. THREAT INTELLIGENCE REPORTS Researchers documented Warlock ransomware attacks exploiting SharePoint ToolShell vulnerabilities against organizations in the utilities, telecom, government and education sectors. The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion. Researchers exposed a China-nexus espionage campaign tracked as UAT-11587 targeting government and policy organizations across Asia. The group deployed the Antino backdoor through spear-phishing and tailored decoy documents. Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution, and persistence. Researchers have uncovered TA419, a China-aligned espionage actor targeting US AI policy experts at think tanks, universities, and law firms. The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies. Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom. The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage activity against governments, NGOs, think tanks, and organizations connected to Ukraine. The post 5th October – Threat Intelligence Report appeared first on Check Point Research .

CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE. The post Exploitation Hits Rejetto HFS Vulnerability Discovered by AI  appeared first on SecurityWeek .

Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched. The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek .

The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. "In the

The bugs could lead to authentication bypass, shell command execution, and memory corruption. The post Fortra Patches Critical Vulnerabilities in BoKS appeared first on SecurityWeek .

The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]

The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team.

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025. The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks appeared first on SecurityWeek .

A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-45659 (CVSS score: 8.8), is a case of remote code execution arising from the deserialization of untrusted data. The issue was addressed by Microsoft in May 2026 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Microsoft noted that any authenticated attacker could trigger the vulnerability, and that it does not require admin or other elevated privileges. In a network-based attack, an authenticated attacker with a minimum of Site Member permissions (PR:L) could leverage it to execute code remotely on the SharePoint Server. "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network," CISA said. According to the Windows maker's advisory, the flaw has been tagged with an "Exploitation Less Likely" assessment. It's currently not known how the vulnerability is being exploited, who is behind the activity, and what the end goals of these efforts are. In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are advised to apply the fixes by July 4, 2026. Microsoft Uncovers Parallel Threat Activity from 2 Clusters Late last month, Microsoft revealed that a routine ransomware investigation uncovered two unrelated attackers operating simultaneously within the same network, while adopting deliberate techniques to establish persistent access and complicate incident response efforts. One set of attacks has been attributed to Storm-2603, a threat actor known for deploying Warlock ransomware often by exploiting known vulnerabilities in on-premises SharePoint servers since mid-2025. "In this case, initial access was likely attempted through a separate vulnerability, with requests for files like win.ini and web.config, indicating probing for local file inclusion," Microsoft said. Evidence points to it being CVE-2025-11371 (CVSS score: 9.1), a critical flaw impacting Gladinet Triofox. Upon gaining initial access, the threat actor is said to have deployed tools like Velociraptor to blend malicious activity with trusted administrative behavior, as well as established multiple remote access channels through Cloudflare tunneling, Zoho Assist, and Secure Shell (SSH) connections configured through Visual Studio Code. The attack also escalated privileges by creating new local and domain administrator accounts, while a vulnerable driver ("NSecKrnl.sys") acted as a conduit for tampering with endpoint security protections to help reduce their visibility. In tandem, Microsoft said it uncovered signs of a second, unrelated threat actor co-existing in the same environment using DLL side-loading and custom backdoors, thereby making attribution more challenging. Further investigation uncovered that the attackers had moved laterally beyond the first network and into a second organization, which confirmed they had been compromised by the same ransomware activity attributed to Storm-2603. "Together, these overlapping activity streams enabled sustained access while masking the full scope of the intrusion," the Microsoft Incident Response team said. "The blend of known ransomware tactics and hidden techniques allowed the threat actors to establish deep and lasting access." "What may appear to be a single ransomware incident can quickly expand into something more complex-spanning organizations, blending tactics, and even involving multiple threat actors operating in parallel. For security teams, the implication is clear: isolated signals rarely tell the full story." Update On August 11, 2026, CISA updated its KEV catalog to confirm that CVE-2026-45659 is being exploited by ransomware groups.

One of the most active ransomware gangs of 2026 has been handing its affiliates a ready-made toolkit for switching off victims' security software before the encryption begins. New analysis from ESET detailed the endpoint detection and response (EDR) killer suite of The Gentlemen, a ransomware-as-a-service operation (RaaS), built around an in-house framework the researchers named GentleKiller. GentleKiller's job is to disable endpoint protection. ESET found it targeting more than 400 processes across roughly 48 security products, from Microsoft Defender and CrowdStrike to Sophos and ESET's own tools, attempting to disable them at the kernel level so the ransomware could run unchecked. Borrowed Drivers, Kernel Power The method is called bring your own vulnerable driver (BYOVD). Each build loads a legitimately signed but flawed kernel driver, then abuses it to kill security processes from inside the kernel, beyond the reach of user-mode protections. ESET counted at least eight GentleKiller variants, each impersonating a different legitimate product, with names lifted from games and security brands such as Valorant, FACEIT and Kaspersky, and each abusing a different driver. To bypass inspection, the binaries carry fake version details, copied but invalid digital signatures and the icons of the vendors they mimic, often wrapped in commercial packers. A Suite, Not a Single Tool What makes Gentlemen unusual is that its operators, not its affiliates, build and maintain the EDR killers. ESET said most ransomware crews leave affiliates to find their own; only a handful, such as RansomHub, supply one. Gentlemen offers a whole portfolio: GentleKiller, the in-house framework, in at least eight variants HexKiller, previously tied to the Warlock gang ThrottleBlood, seen in MedusaLocker and DragonForce intrusions HavocKiller, which abuses a Huawei audio driver The three borrowed tools were each re-skinned with Gentlemen's shared evasion layer. GentleKiller itself moved faster still, with the operators turning newly disclosed driver exploits into working variants within days of release. Inside the Gentlemen Operation Gentlemen surfaced in late 2025, founded by a former Qilin affiliate, and lures affiliates with an unusually large 90% cut. ESET confirmed the operator-run model partly through a May data leak, in which the gang's leader openly discussed maintaining the EDR-killer packages. Unusually, it does not concentrate on US victims, picking targets across Southeast Asia, South America and Western Europe by their exposed FortiGate configurations. ESET said understanding how GentleKiller works helps defenders prepare even for variants not yet built. In practice, defenses against such BYOVD attacks center on blocking known-vulnerable drivers and alerting whenever a protected security process is suddenly shut down.

The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is centered around a framework that's known as GentleKiller. "They also incorporate third-party or leaked tools such as HexKiller, ThrottleBlood, and HavocKiller," ESET security researcher Jakub Souček said in a report shared with The Hacker News. "These tools are standardized through a shared defense-evasion layer, impersonating predominantly security vendors using fake version information, and copied legitimate certificates and icons." The Slovakian cybersecurity company also called out the ransomware crew for its ability to "unusually quickly operationalize" newly disclosed proof-of-concept (PoC) exploits related to an attack technique called bring your own vulnerable driver (BYOVD), in many cases within days of their public release. Since its emergence in March 2025, The Gentlemen has swiftly risen up the ranks and made a name for itself as one of the most active ransomware groups. Per data from Ransomware.live, the group has claimed 504 victims to date, with most of them located in Southeast Asia, South America, and Western Europe. Recent reports from cybersecurity journalist Brian Krebs and PRODAFT have revealed that a 36-year-old Russian national named Alexander Andreevich Yapaev (aka hastalamuerte) has been leading the operation, after acting as an affiliate for other ransomware schemes, including Qilin. ESET has described The Gentlemen as one of the most technically agile RaaS groups, using a set of techniques to ensure that the compiled EDR killer samples sidestep detection. This includes binary protection using Enigma or Themida and using file names that resemble well-known cybersecurity vendors, right down to their version information, digital signatures, and icons. The most prevalent of them is GentleKiller, which comes in eight different variants, each mimicking a different legitimate product and abusing a different vulnerable or malicious driver as part of the BYOVD attack. GentleKiller specifically looks for 400 processes associated with 48 distinct security programs from a number of vendors. The list of drivers exploited by each of the variants is as follows - Kaspersky ("eb.sys") FACEIT Anti-Cheat ("nseckrnl.sys") Valorant ("GameDriverX64.sys") Javelin ("stpm_old.sys" or "stpm_new.sys") WatchDog ("dmx.sys") Network Blocker ("360netmon_wfp.sys") Cleaner ("IMFForceDelete.sys") G11 ("PoisonX.sys") It's worth noting that the abuse of "PoisonX.sys" has been recorded in recent months in connection with two BYOVD attacks, one of which was used to kill CrowdStrike Falcon EDR. A second campaign, detailed by Huntress, involved an intrusion in which unknown threat actors leveraged BeyondTrust Remote Support to successfully deploy ransomware on the network, but not before terminating security tooling via "PoisonX.sys" and "hrwfpdrv.sys." BYOVD attacks like these typically involve introducing vulnerable legitimate drivers into target systems to gain unauthorized kernel-level access and exploit the weakness to perform malicious actions without detection. Most importantly, it requires an attacker to obtain administrative access to the target system. "Once the driver is running in the kernel, the attacker sends Input/Output Control (IOCTL) commands to it," according to Bitdefender. "They either exploit a bug (like a buffer overflow) to execute shellcode, gain arbitrary memory access (read/write), or use "insecure by design" features to manipulate system memory." Because the drivers are signed with a valid Microsoft certificate and run with elevated privileges, the technique abuses the driver trust model to execute arbitrary code at the kernel level and forcibly terminate the protected processes of antivirus and security solutions. "When abstracting away the impersonation layer and the specific drivers used, the underlying code reveals numerous structural and behavioral commonalities that strongly suggest the use of a shared development template," Souček said. "This design prioritizes ease of deployment and operational flexibility for affiliates, while minimizing development effort for the operators. It allows The Gentlemen operators to integrate abused drivers into their toolset very soon after an EDR killer PoC is disclosed." The third-party, BYOVD-based EDR killers employed by the group are below - HexKiller ("googleApiUtil64.sys"), a tool previously assumed to be exclusive to the Warlock ransomware gang ThrottleBlood ("ThrottleBlood.sys"), a tool observed in attacks mounted by MedusaLocker and DragonForce affiliates HavocKiller or HwAudKiller ("havoc.sys") ESET said it also detected a Rust-based credential stealer codenamed OxideHarvest (aka buildx641) that's capable of harvesting data from popular web browsers, including Google Chrome, Microsoft Edge, Torch, Comodo, Epic Privacy Browser, Vivaldi, Brave, Opera, OperaGX, Mozilla Firefox, Waterfox, BlackHawk, and IceCat. "While most ransomware gangs continue to delegate EDR killing to affiliates, Gentlemen has chosen to centralize this function by offering affiliates a ready-to-use, standardized EDR-killer suite," ESET said. "This decision makes Gentlemen an attractive operator for affiliates as it materially lowers the entry barrier for them, making their job consequently easier." The disclosure comes as the CERT Coordination Center (CERT/CC) issued an advisory about multiple vendor-signed UEFI applications being vulnerable to Secure Boot bypass via a BYOVD attack. ESET researcher Martin Smolár has been credited with researching and reporting the vulnerability. The impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill. "If a target system trusts the affected vendor's certificate, an attacker [with administrative privileges or physical access] can exploit these applications to execute arbitrary code during the early pre-boot phase before the operating system initializes," CERT/CC said. "To mitigate this risk, system administrators should apply updates to the UEFI Forbidden Signature Database (DBX) that revoke trust in the affected vendor-signed binaries, preventing these vulnerable applications from executing during the boot process." (The story was updated after publication to include additional details related to the BYOVD technique and its prerequisites.)

The Gentlemen ransomware-as-a-service (RaaS) is actively developing and maintaining a suite of endpoint detection and response (EDR) killers to help affiliates evade detection in attacks. The gang employs a collection of EDR-killing tools, most notably a utility that researchers dubbed GentleKiller. The tool has at least eight variants and impersonates various legitimate security products, including Kaspersky, Valorant, Javelin, and WatchDog. The gang is using a suite of EDR killers, the most frequently used being a custom tool that researchers named GentleKiller, which has at least eight variants impersonating various legitimate products. An EDR killer is typically used to disable defenses in the early phases of an attack, and in ransomware incidents, they ensure that data theft or encryption processes run unencumbered. These tools work by leveraging the 'bring your own vulnerable driver' (BYOVD) technique to elevate privileges and disable security engines. According to ESET researchers, each GentleKiller variant uses different vulnerable drivers to achieve kernel-level privileges. However, they all share common strings, identical code obfuscation techniques, and similar process-killing logic and targeting scope. The analysis of the variants indicates that the framework is designed to allow easy driver swaps or weaponization of newly disclosed flaws without requiring major code changes. ESET states that GentleKiller targets more than 400 processes associated with approximately 48 security vendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky. The binaries for the EDR killer tool are protected by the commercial Enigma and Themida packing and code-protection tools. ESET notes that the threat actor also uses stolen digital signatures from legitimate software, although they are invalid. Although GentleKiller is a standardized tool used in Gentlemen ransomware attacks, ESET reports that the threat group's collection of EDR killers also incorporates at least three external tools: HexKiller, previously used by the Warlock gang ThrottleBlood, linked to MesudaLocker and DragonForce attacks HavocKiller, also seen in ransomware operations Gentleman RaaS may have added them for redundancy, attribution complexity, or for use in specific cases where the effectiveness of GentleKiller might be limited. Additionally, ESET documented the use of OxideHarvest, a Rust-based credential-stealer tool that the researchers believe, based on the programming language choice, was developed externally. The researchers' analysis indicates that Gentlemen ransomware picks targets based on the configuration of their FortiGate endpoints. This is particularly interesting given the recent discovery of “FortiBleed,” a collection of nearly 74,000 FortiGate VPN credentials. The Gentlemen RaaS previously compromised the Romanian energy provider Oltenia and has been linked to a SystemBC proxy malware botnet with over 1,570 hosts, believed to be corporate victims. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

GentleKiller targets more than 400 security processes across 48 products Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its operators develop and maintain a set of tools for shutting down endpoint detection and response (EDR) products, then provide these tools directly to the affiliates who rent the gang’s encryptors. An internal data leak from the group in May 2026 confirmed the arrangement and exposed the gang’s leader discussing the supply of these EDR-killer packages. “While there have been multiple reports covering Gentlemen in recent months, they have not focused on a detailed analysis of the group’s EDR killers. Thanks to ESET’s continued incident-level visibility, we can provide a uniquely deep view into Gentlemen’s EDR-killer development practices. The internal data leak that Gentlemen suffered in May 2026 gave us more insight into the inner workings of the group,” said ESET researcher Jakub Souček. “The leak also allowed us to confirm the hypothesis we formed in February 2026: that Gentlemen operators actively develop and maintain a portfolio of EDR killers that they offer to affiliates, centered around their in-house framework, which we have named GentleKiller.” Gentlemen emerged in late 2025 and grew into one of the five most active ransomware gangs in the first quarter of 2026. The operation offers affiliates a 90% share of ransom payments. Group-IB traced its founding to a former Qilin affiliate. The gang practices double extortion, encrypting victim data and threatening to publish it when victims decline to pay. For encryption, the operators supply a Go-based variant for Windows, Linux, and other platforms, along with a C-based variant for ESXi. Targeting beyond the United States Many top-tier ransomware gangs draw close to half their announced victims from the United States. Gentlemen draws its victims from a wider spread of countries, with concentrations in Southeast Asia, South America, and Western Europe. Its target list reaches countries such as Thailand, Brazil, and France. The leaked data shows the operators sort through candidate organizations centrally and assign them to affiliates. Victim selection rests mainly on the configuration of a target’s FortiGate firewall. An in-house framework with eight variants The core of the suite is GentleKiller, first observed in a staging directory called GentlemenCollection. It is the most common EDR killer in Gentlemen intrusions and appears in at least eight variants, each one impersonating a different legitimate product and abusing a different vulnerable or malicious kernel driver. The variants carry names drawn from games and security products. Across variants, the code shares strings, a process-killing loop that runs on a timer, and the same obfuscation, which points to a reused development template. The general target set spans more than 400 process names linked to 48 security products. Gentlemen adapts newly published Bring Your Own Vulnerable Driver proofs-of-concept quickly. The operators folded two recently disclosed examples, tracked as UnknownKiller and PoisonKiller, into their tooling within days of release. Outside tools and a shared disguise The suite also carries three tools that Gentlemen obtained from outside sources. HexKiller had been tied to the Warlock gang. ThrottleBlood appeared in MedusaLocker and DragonForce intrusions, and Trend Micro connected it to Gentlemen in September 2025. HavocKiller surfaced publicly through Huntress on March 19, 2026, and ESET telemetry places its use in real intrusions back to at least January 23, 2026. Gentlemen acquired these tools through unknown channels and standardized them to match its own toolset. A shared evasion layer ties the portfolio together. The operators apply it to compiled binaries, which lets them protect tools whose source code they lack. Filenames mimic well-known security vendors. The executables carry fabricated version information, invalid digital signatures copied from legitimate software, and icons taken from the impersonated products. Many samples also receive commercial packing through Enigma or Themida, recorded in a filename suffix. What the model means for defenders RansomHub previously built one EDR killer in-house for its affiliates. Gentlemen keeps a varied portfolio that blends original code with adapted public research. The model lowers the entry barrier for affiliates, who gain a ready-to-use way to disable defenses. The shared vendor disguises across these tools complicate attribution when a single sample turns up on its own. Understanding how GentleKiller operates gives defenders a basis for spotting current builds and the variants that Gentlemen adds next. Download: Automating Pentest Delivery Guide

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver (BYOVD) technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have been found to deploy a malicious DLL named "msimg32.dll," which initiates a multi-stage infection chain to disable endpoint detection and response (EDR) solutions. The DLL, launched via DLL side-loading, is capable of terminating more than 300 EDR drivers from almost every security vendor in the market. "The first stage consists of a PE loader responsible for preparing the execution environment for the EDR killer component," Talos researchers Takahiro Takeda and Holger Unterbrink said. "This secondary payload is embedded within the loader in an encrypted form." The DLL loader implements an array of techniques to evade detection. It neutralizes user-mode hooks, suppresses Event Tracing for Windows (ETW) event logs, and takes steps to conceal control flow and API invocation patterns. As a result, it allows the main EDR killer payload to be decrypted, loaded, and executed entirely in memory while entirely flying under the radar. Once launched, the malware makes use of two drivers - rwdrv.sys, a renamed version of "ThrottleStop.sys" that's used to gain access to the system's physical memory and act as a kernel-mode hardware access layer. hlpdrv.sys, to terminate processes associated with over 300 different EDR drivers belonging to various security solutions. It's worth noting that both drivers have been used as part of BYOVD attacks carried out in conjunction with Akira and Makop ransomware intrusions. "Prior to loading the second driver, the EDR killer component unregisters monitoring callbacks established by the EDR, ensuring that process termination can proceed without interference," Talos said. "It demonstrates the sophisticated tricks the malware is employing to circumvent or completely disable modern EDR protection features on compromised systems." According to statistics compiled by CYFIRMA and Cynet, Qilin has emerged as the most active ransomware group in recent months, claiming hundreds of victims. The group has been linked to 22 out of 134 ransomware incidents that were reported in Japan in 2025, representing 16.4% of all attacks. "Qilin primarily relies on stolen credentials to gain initial access," Talos said. "After successfully breaching a target environment, the group places considerable emphasis on post-compromise activities, allowing it to methodically expand its control and maximize impact." The cybersecurity vendor also noted that ransomware execution occurred on average roughly six days after the initial compromise, highlighting the need for organizations to detect malicious activity at the earliest possible stage and to prevent the deployment of ransomware. The disclosure comes as the Warlock (aka Water Manaul) ransomware group continues to exploit unpatched Microsoft SharePoint servers, while updating its toolset for enhanced persistence, lateral movement, and defense evasion.This includes the use of TightVNC for persistent control and a legitimate-but-vulnerable NSec driver ("NSecKrnl.sys") in a BYOVD attack to terminate security products at the kernel level, replacing the "googleApiUtil64.sys" driver used in prior campaigns. Also observed during the course of the Warlock attack in January 2026 were the following tools - PsExec, for lateral movement. RDP Patcher, for facilitating concurrent RDP sessions. Velociraptor, for command-and-control (C2). Visual Studio Code and Cloudflare Tunnel, for tunneling C2 communications. Yuze, for intranet penetration and establishing a reverse proxy connection to the attacker's C2 server across HTTP (port 80), HTTPS (port 443), and DNS (port 53). Rclone, for data exfiltration. To counter BYOVD threats, it's recommendedto only allow signed drivers from explicitly trusted publishers, monitor driver installation events, and maintain a rigorous patch management schedule for updating security software, specifically those with driver-based components that could be exploited. "Warlock's reliance on vulnerable drivers to disable security controls requires a multilayered defense focused on kernel integrity," Trend Micro said. "Thus, organizations must upgrade from basic endpoint protection to enforcing strict driver governance and real-time monitoring of kernel-level activities."

A new analysis of endpoint detection and response (EDR) killers has revealed that 54 of them leverage a technique known as bring your own vulnerable driver (BYOVD) by abusing a total of 35 vulnerable drivers. EDR killer programs have been a common presence in ransomware intrusions as they offer a way for affiliates to neutralize security software before deploying file-encrypting malware. This is done so in an attempt to evade detection. "Ransomware gangs, especially those with ransomware-as-a-service (RaaS) programs, frequently produce new builds of their encryptors, and ensuring that each new build is reliably undetected can be time-consuming," ESET researcher Jakub Souček said in a report shared with The Hacker News. "More importantly, encryptors are inherently very noisy (as they inherently need to modify a large number of files in a short period); making such malware undetected is rather challenging." EDR killers act as a specialized, external component that's run to disable security controls before executing the lockers themselves, thereby keeping the latter simple, stable, and easy to rebuild. That's not to say there have not been instances where EDR termination and ransomware modules have been fused into one single binary. Reynolds ransomware is a case in point. A majority of the EDR killers rely on legitimate yet vulnerable drivers to gain elevated privileges and achieve their goals. Among the nearly 90 EDR killer tools detected by the Slovakian cybersecurity company, more than half of them utilize the well-known BYOVD tactic simply because it's reliable. "The goal of a BYOVD attack is to gain kernel-mode privileges, often called Ring 0," Bitdefender explains. "At this level, code has unrestricted access to system memory and hardware. Since an attacker cannot load an unsigned malicious driver, they 'bring' a driver signed by a reputable vendor (such as a hardware manufacturer or an old antivirus version) that has a known vulnerability." Armed with the kernel access, threat actors can terminate EDR processes, disable security tools, tamper with kernel callbacks, and undermine endpoint protections. The result is an abuse of Microsoft's driver trust model to evade defenses, taking advantage of the fact that the vulnerable driver is legitimate and signed. The BYOVD-based EDR killers are primarily developed by three types of threat actors - Closed ransomware groups like DeadLock and Warlock that do not rely on affiliates Attackers forking and tweaking existing proof-of-concept code (e.g., SmilingKiller and TfSysMon-Killer) Cybercriminals marketing such tools on underground marketplaces as a service (e.g., DemoKiller aka Бафомет, ABYSSWORKER, and CardSpaceKiller) ESET said it also identified script-based tools that make use of built-in administrative commands like taskkill, net stop, or sc delete to interfere with the regular functioning of security product processes and services. Select variants have also been found to combine scripting with Windows Safe Mode. "Since Safe Mode loads only a minimal subset of the operating system, and security solutions typically aren’t included, malware has a higher chance of disabling protection," the company noted. "At the same time, such activity is very noisy, as it requires a reboot, which is risky and unreliable in unknown environments. Therefore, it is seen only rarely in the wild." The third category of EDR killers are anti-rootkits, which include legitimate utilities such as GMER, HRSword, and PC Hunter, that offer an intuitive user interface to terminate protected processes or services. A fourth, emerging class is a set of driverless EDR killers like EDRSilencer and EDR-Freeze that block outbound traffic from EDR solutions and cause the programs to enter a "coma" like state. "Attackers aren’t putting much effort into making their encryptors undetected," ESET said. "Rather, all the sophisticated defense-evasion techniques have shifted to the user-mode components of EDR killers. This trend is most visible in commercial EDR killers, which often incorporate mature anti-analysis and anti-detection capabilities." To combat ransomware and EDR killers, blocking commonly misused drivers from loading is a necessary defense mechanism. However, given that EDR killers are executed only at the last stage and just before launching the encryptor, a failure at this stage means the threat actor can easily switch to another tool to accomplish the same task. The implication is that organizations need layered defenses and detection strategies in place to proactively monitor, flag, contain, and remediate the threat at each every stage of the attack lifecycle. "EDR killers endure because they're cheap, consistent, and decoupled from the encryptor – a perfect fit for both encryptor developers, who don’t need to focus on making their encryptors undetectable, and affiliates, who possess an easy-to-use, powerful utility to disrupt defenses prior to encryption," ESET said.

EDR killers are now standard equipment in ransomware attacks Ransomware attackers routinely deploy tools designed to disable endpoint detection and response software before launching encryptors. These tools, known as EDR killers, have become a standard component of ransomware intrusions. ESET Research tracked nearly 90 EDR killers actively used in the wild. The workflow is consistent across groups: an attacker gains high privileges, deploys an EDR killer to disrupt security software, then runs the encryptor. Affiliates prefer this approach because it gives them a brief, reliable window to complete encryption without needing to continuously modify payloads to evade detection. Affiliates pick the tools, operators supply the encryptor In ransomware-as-a-service operations, operators typically provide the encryptor and supporting infrastructure. EDR killer selection falls to affiliates. The result, according to ESET researcher Jakub Souček, is that larger affiliate pools produce greater diversity in EDR killer tooling. That division of labor also means defenders face a wider range of tools from a single ransomware brand, depending on which affiliate carried out a given attack. Bring Your Own Vulnerable Driver dominates, with alternatives gaining ground The Bring Your Own Vulnerable Driver technique remains the most common method. An attacker drops a legitimate but vulnerable driver onto a victim machine, installs it, then runs malware that exploits the driver’s vulnerability to gain kernel-level access. The technique is reliable, widely documented, and requires relatively little development effort. A smaller and growing category of EDR killers achieves similar results without touching the kernel. These tools interfere with EDR communication or suspend processes in place, bypassing the need to exploit a driver entirely. The simplest EDR killers rely on built-in administrative tools and commands, requiring no specialized driver or kernel access at all. Blocking vulnerable drivers is necessary but not sufficient Preventing vulnerable drivers from loading is an important defensive step, though several bypass techniques exist. The practical implication is that organizations need controls capable of disrupting EDR killers before they have the opportunity to load a driver in the first place. AI-assisted development is entering the picture At least some recently observed EDR killers show signs of AI-assisted code generation, according to ESET’s assessment. No definitive forensic marker reliably distinguishes AI-generated code from human-written code, particularly when attackers obfuscate or post-process their output. One concrete example comes from a tool deployed by the Warlock ransomware gang. The tool includes a code section that prints a list of possible fixes, a pattern associated with AI-generated boilerplate. It also implements a trial-and-error mechanism that cycles through several unrelated, commonly abused device names until it finds one that works on the target system, rather than exploiting a single specific driver. Souček noted that vibe coding is making the threat landscape more complicated to track and attribute. Ransomware intrusions require a different defensive approach Phishing campaigns and commodity malware stop once security solutions neutralize them. Ransomware intrusions do not follow that pattern. They are interactive, human-driven operations where attackers continuously adapt to detections, tool failures, and environmental conditions. That distinction matters for how defenders prioritize resources and design detection strategies. EDR killer activity in particular requires proactive monitoring at the privilege escalation and driver installation stages, well before an encryptor is ever deployed.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability list is as follows - CVE-2021-22054 (CVSS score: 7.5) - A server-side request forgery (SSRF) vulnerability in Omnissa Workspace One UEM (formerly VMware Workspace One UEM) that could allow a malicious actor with network access to UEM to send requests without authentication and to gain access to sensitive information. CVE-2025-26399 (CVSS score: 9.8) - A deserialization of untrusted data vulnerability in the AjaxProxy component of SolarWinds Web Help Desk that could allow an attacker to run commands on the host machine. CVE-2026-1603 (CVSS score: 8.6) - An authentication bypass using an alternate path or channel vulnerability in Ivanti Endpoint Manager that could allow a remote unauthenticated attacker to leak specific stored credential data. The addition of CVE-2025-26399 comes in the wake of reports from Microsoft and Huntress that threat actors are exploiting security flaws in SolarWinds Web Help Desk to obtain initial access. The activity is believed to be the work of the Warlock ransomware crew. CVE-2021-22054, on the other hand, was flagged by GreyNoise in March 2025 as being exploited in conjunction with several other SSRF vulnerabilities in other products as part of a coordinated campaign. There are currently no details on how CVE-2026-1603 is being weaponized in the wild, although Defused Cyber noted in a post on X last month that it's seeing active exploitation efforts targeting the flaw. The attack originated from the IP address 103.69.224[.]98. As of writing, Ivanti's security bulletin has not been updated to reflect the exploitation status. The company said it's not aware of any customers being exploited by the vulnerability. To counter the risk posed by active threats, Federal Civilian Executive Branch (FCEB) agencies have been ordered to apply the fix for SolarWinds Web Help Desk by March 12, 2026, and the remaining two by March 23, 2026. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA said.

Flare researchers monitoring underground Telegram channels and cybercrime forums have observed threat actors rapidly sharing proof-of-concept exploits, offensive tools, and stolen administrator credentials related to recently disclosed SmarterMail vulnerabilities, providing insight into how quickly attackers weaponize new security flaws. The activity occurred within days of the vulnerabilities being disclosed, with threat actors sharing and selling exploit code and compromised access tied to CVE-2026-24423 and CVE-2026-23760, critical flaws that enable remote code execution and authentication bypass on exposed email servers. These vulnerabilities have since been confirmed in real-world attacks, including ransomware campaigns, highlighting how attackers increasingly target email infrastructure as an initial access point into corporate networks, allowing them to move laterally and establish persistent footholds. CVE-2026-24423 and CVE-2026-23760: Critical RCE and Auth Bypass Flaws Multiple recently disclosed SmarterMail vulnerabilities created a perfect storm that made the platform highly attractive to attackers. Among them, CVE-2026-24423 stands out as a critical unauthenticated remote code execution flaw affecting versions prior to Build 9511. With a CVSS score of 9.3 and no user interaction required, the flaw is particularly suited for automation, large-scale scanning, and mass exploitation campaigns. In parallel, additional vulnerabilities CVE-2026-23760 (CVSS 9.3) include authentication bypass and password reset logic flaws. It allows attackers to reset administrator credentials or gain privileged access to the platform. Research also shows that attackers were quickly reverse-engineering patches to identify and weaponize these weaknesses within days of release. When combined, these issues enabled full server takeover scenarios, where attackers could move from application-level access to operating system control and potentially domain-level compromise in connected environments. From an attacker’s perspective, this combination is ideal: SmarterMail is a network-exposed service, often holds a high trust position inside enterprise environments, and in many cases is monitored less aggressively than endpoint systems protected by EDR. Once proof-of-concept exploit code becomes available, exploitation can be rapidly operationalized - meaning the timeline from vulnerability disclosure to ransomware deployment can shrink to days. SmarterTools Breached by Own Product Flaw, Ransomware Groups Follow Recent incidents demonstrate exactly how this pipeline plays out. According to a SmarterTools report, SmarterTools was breached in January 2026 after attackers exploited an unpatched SmarterMail server running on an internal VM that was exposed inside their network. The compromised environment included office and lab networks and a data-center segment connected through Active Directory, where attackers moved laterally and impacted around a dozen Windows servers. The company shut down the affected infrastructure, restored systems from backup, rotated credentials, and removed some Windows/AD dependencies. Having said that, it was reported that core customer services and data were unaffected. Attackers gained an internal network foothold and attempted typical ransomware-style post-exploitation actions; it wasn't successful, thanks to network segmentation. In another investigation published by Bleeping Computer, ransomware operators gained initial access through SmarterMail vulnerabilities and waited before triggering encryption payloads, a classic affiliate behavior pattern. This pattern is important: Initial access via email server vulnerability Credential harvesting or token extraction Lateral movement via Active Directory Persistence via scheduled tasks or DFIR tool abuse Ransomware deployment after staging period Some campaigns have been linked to the Warlock ransomware group, with overlaps observed with nation-state-aligned activity clusters. Flare monitors underground forums and Telegram channels where threat actors share PoCs, exploits, and compromised credentials within hours of disclosure. Get early warning when your infrastructure is discussed or targeted by ransomware operators. Start Free Trial Email Servers: Identity Infrastructure Attackers Target First Email servers sit at a unique intersection of trust and visibility. They often provide: Domain authentication tokens Password reset capabilities External communication channels Access to internal contact graphs Integration with identity and directory services Attackers understand that email ecosystems rely on multi-component authentication chains where a single weak link can break overall trust. Compromise the email infrastructure and you effectively compromise identity. 1,200+ Vulnerable Servers Identified on Shodan We found ~34,000 servers on Shodan with indications of running SmarterMail. Out of the 34,000, there were 17,754 unique servers. A further inspection of these servers shows that 1,185 are vulnerable to authentication bypass or RCE flaws. Other publications talk about ~6,000 vulnerable servers. A geo-location analysis of these 1,185 servers shows US dominance: A further analysis of the ISPs and Organizations shows a very diverse distribution of open SmarterMail servers, many self-hosted admin panels, shared hosting, VPS providers, and general-purpose cloud networks, typical of deployment by individuals rather than organizations. This may indicate that after the strong security hype over the past weeks, organizations were quick to react and block this attack surface. Underground Forums Share Exploits Within Days of Disclosure The underground ecosystems are fast to react to such publications. The CVEs were published around the beginning of January, and on the same day, there were mentions and references to these vulnerabilities. To date, we’ve seen dozens of publications and references to these vulnerabilities. This is normal underground behavior when it comes to critical vulnerabilities. We have also seen some more malicious references. A few days after the first publication, there were references to Proof of Concept or exploit of the vulnerabilities. For instance, an Arabic-speaking Telegram channel shows PoC. You can also see how the threat actor is showing proof of concept: And another threat actor is showing a proof of concept to this vulnerability: In a Spanish-speaking Telegram group, we saw references to an Offensive Security Tool: On another Telegram group, we saw a data dump of admin credentials highlighted as it comes from a compromised SmarterMail server: When accessing one of the links, you can indeed see a long list of admin credentials and the domains (or login) to which they belong. CISA Confirms Active Exploitation in Ransomware Campaigns These vulnerabilities were published in the beginning of 2026, CISA added CVE-2026-24423 to the Known Exploited Vulnerabilities catalog in the beginning of February 2026, after confirming active ransomware exploitation. This confirms that attackers are quick to exploit newly discovered critical RCE- related vulnerabilities: Vulnerability disclosure PoC written and released Mass scanning operation Weaponization: Data exfiltration, Ransomware etc. Timeline shrinking from months/weeks to days. How to Protect Email Infrastructure From Ransomware Access Many organizations still treat email servers as “ONLY application infrastructure”. Well, they are not! They are identity infrastructures that enable many follow-up attack vectors, as well as containing secrets and business logic. Defensive priorities should include: Patch Urgency: Critical email server vulnerabilities should be treated like domain controller vulnerabilities. Identity Telemetry: Organizations should monitor these environments for: - Admin password resets - API calls to external hosts - Unexpected outbound HTTP from mail servers Network Segmentation: Email infrastructure should never have unrestricted access to internal networks. Threat Hunting Practice: - API abuse patterns - Scheduled task persistence - Unexpected tooling like DFIR frameworks or remote admin tools Email Servers Are Identity Infrastructure—Secure Them Accordingly The SmarterMail cases show once again how modern cybercrime operations are quick to add newly discovered initial access to their ongoing operation. It also re-emphasizes the critical role email servers take in the modern organization: Identity brokers Trust anchors Business logic Invaluable reconnaissance data for follow-up cybercrime Organizations that continue treating them as just “messaging systems” will remain vulnerable to this new generation of intrusion pipelines. Sponsored and written by Flare.

Cybersecurity researchers have disclosed details of an emergent ransomware family dubbed Reynolds that comes embedded with a built-in bring your own vulnerable driver (BYOVD) component for defense evasion purposes within the ransomware payload itself. BYOVD refers to an adversarial technique that abuses legitimate but flawed driver software to escalate privileges and disable Endpoint Detection and Response (EDR) solutions so that malicious activities go unnoticed. The strategy has been adopted by many ransomware groups over the years. "Normally, the BYOVD defense evasion component of an attack would involve a distinct tool that would be deployed on the system prior to the ransomware payload in order to disable security software," the Symantec and Carbon Black Threat Hunter Team said in a report shared with The Hacker News. "However, in this attack, the vulnerable driver (an NsecSoft NSecKrnl driver) was bundled with the ransomware itself." Broadcom's cybersecurity teams noted that this tactic of bundling a defense evasion component within the ransomware payload is not novel, and that it has been observed in a Ryuk ransomware attack in 2020 and in an incident involving a lesser-known ransomware family called Obscura in late August 2025. In the Reynolds campaign, the ransomware is designed to drop a vulnerable NsecSoft NSecKrnl driver and terminate processes associated with various security programs from Avast, CrowdStrike Falcon, Palo Alto Networks Cortex XDR, Sophos (along with HitmanPro.Alert), and Symantec Endpoint Protection, among others. In a statement shared with The Hacker News over email, cybersecurity vendor Sophos said it "has had protective blocking protection against this driver since November 2025 and proactive [safeguards] against the payload for multiple years." It's worth noting that the NSecKrnl driver is susceptible to a known security flaw (CVE-2025-68947, CVSS score: 5.7) that could be exploited to terminate arbitrary processes. Notably, the driver has been put to use by a threat actor known as Silver Fox in attacks designed to kill endpoint security tools prior to delivering ValleyRAT. Over the past year, the hacking group has previously wielded multiple legitimate but flawed drivers – including truesight.sys and amsdk.sys – as part of BYOVD attacks to disarm security programs. By bringing together defense evasion and ransomware capabilities into one component, it makes it harder for defenders to stop the attack, not to mention obviating the need for an affiliate to separately incorporate this step into their modus operandi. "Also of note in this attack campaign was the presence of a suspicious side-loaded loader on the target's network several weeks prior to the ransomware being deployed," Symantec and Carbon Black said. "Also of note in this attack campaign was the presence of a suspicious side-loaded loader on the target's network several weeks prior to the ransomware being deployed." Another tool deployed on the target network a day after the ransomware deployment was the GotoHTTP remote access program, indicating that the attackers may be looking to maintain persistent access to the compromised hosts. "BYOVD is popular with attackers due to its effectiveness and reliance on legitimate, signed files, which are less likely to raise red flags," the company said. "The advantages of wrapping the defense evasion capability in with the ransomware payload, and the reason ransomware actors might do this, may include the fact that packaging the defense evasion binary and the ransomware payload together is 'quieter,' with no separate external file dropped on the victim network." Sophos also noted that the use of the NSecKrnl driver was previously observed in two ransomware incidents involving LockBit/Warlock and Nitrogen, and that these incidents were "stopped by process-independent ransomware protection that remains effective regardless of BYOVD termination attempts." Furthermore, the company pointed out that there are both pros and cons when it comes to merging BYOVD with ransomware encryption into one payload, adding it risks breaking the entire execution chain once the driver is detected by security software, putting them at a tactical disadvantage. "Combining BYOVD-based EDR termination with ransomware encryption in a single binary can be particularly effective against solutions with two architectural weaknesses: infrequently updated Vulnerable Driver Blocklists, and threat protection relying solely on user-mode services that only detect locally executed ransomware (which fails against remote encryption)," it explained. "However, consolidating defense evasion and impact into a single execution chain increases behavioral density, raising detection likelihood for solutions with comprehensive behavioral monitoring. Whether that detection results in prevention depends on the endpoint protection architecture and whether protection mechanisms can intervene inline before impact occurs." The finding coincides with various ransomware-related developments in recent weeks - A high-volume phishing campaign has used emails with Windows shortcut (LNK) attachments to run PowerShell code that fetches a Phorpiex dropper, which is then used to deliver the GLOBAL GROUP ransomware. The ransomware is notable for carrying out all activity locally on the compromised system, making it compatible with air‑gapped environments. It also conducts no data exfiltration. Attacks mounted by WantToCry have abused virtual machines (VMs) provisioned by ISPsystem, a legitimate virtual infrastructure management provider, to host and deliver malicious payloads at scale. Some of the hostnames have been identified in the infrastructure of multiple ransomware operators, including LockBit, Qilin, Conti, BlackCat, and Ursnif, as well as various malware campaigns involving NetSupport RAT, PureRAT, Lampion, Lumma Stealer, and RedLine Stealer. It's assessed that bulletproof hosting providers are leasing ISPsystem virtual machines to other criminal actors for use in ransomware operations and malware delivery by exploiting a design weakness in VMmanager's default Windows templates that reuse the same static hostname and system identifiers every time they are deployed. This, in turn, allows threat actors to set up thousands of VMs with the same hostname and complicate takedown efforts. DragonForce has created a "Company Data Audit" service to support affiliates during extortion campaigns as part of the continued professionalization of ransomware operations. "The audit includes a detailed risk report, prepared communication materials, such as call scripts and executive-level letters, and strategic guidance designed to influence negotiations," LevelBlue said. DragonForce operates as a cartel that allows affiliates to create their own brands while operating under its umbrella and gaining access to its resources and services. The latest iteration of LockBit, LockBit 5.0, has been found to use ChaCha20 cipher to encrypt files and data across Windows, Linux, and ESXi environments, a shift from the AES-based encryption approach in LockBit 2.0 and LockBit 3.0. In addition, the new version features a wiper component, an option to delay execution prior to encryption, track status of encryption using a progress bar, improved anti-analysis techniques to evade detection, and enhanced in-memory execution to minimize disk traces. The Interlock ransomware group has continued its assault on U.K.- and U.S.-based organizations, particularly in the education sector, in one case leveraging a zero-day vulnerability in the "GameDriverx64.sys" gaming anti-cheat driver (CVE-2025-61155, CVSS score: 5.5) to disable security tools in a BYOVD attack. The attack is also characterized by the deployment of NodeSnake/Interlock RAT (aka CORNFLAKE) to steal sensitive data, while initial access is said to have originated from a MintLoader infection. Ransomware operators have been observed increasingly shifting their focus from traditional on-premises targets to cloud storage services, especially misconfigured S3 buckets used by Amazon Web Services (AWS), with the attacks leaning on native cloud features to delete or overwrite data, suspend access, or extract sensitive content, while simultaneously staying under the radar. According to data from Cyble, GLOBAL GROUP is one of the many ransomware crews that sprang forth in 2025, the others being Devman, DireWolf, NOVA, J group, Warlock, BEAST, Sinobi, NightSpire, and The Gentlemen. In Q4 2025 alone, Sinobi's data leak site listings increased 306%, making it the third-most active ransomware group after Qilin and Akira, per ReliaQuest. "Meanwhile, the return of LockBit 5.0 was one of Q4's biggest shifts, driven by a late-quarter spike that saw the group list 110 organizations in December alone," researcher Gautham Ashok said. "This output signals a group that can scale execution quickly, convert intrusions into impact, and sustain an affiliate pipeline capable of operating at volume." The emergence of new players, combined with partnerships forged between existing groups, has led to a spike in ransomware activity. Ransomware actors claimed a total of 4,737 attacks during 2025, up from 4,701 in 2024. The number of attacks that don't involve encryption and instead rely purely on data theft as a means to exert pressure reached 6,182 during the same period, a 23% increase from 2024. As for the average ransom payment, the figure stood at $591,988 in Q4 2025, a 57% jump from Q3 2025, driven by a small number of "outsized settlements," Coveware said in its quarterly report last week, adding threat actors may return to their "data encryption roots" for more effective leverage to extract ransoms from victims. (The story was updated after publication to include additional insights from Sophos.)

Unpatched SolarWinds WHD instances under active attack Internet‑exposed and vulnerable SolarWinds Web Help Desk (WHD) instances are under attack by threat actors looking to gain an initial foothold into target organizations’ networks, Microsoft and Huntress researchers have warned. ƒ Once inside, the attackers are deploying legitimate remote access and digital forensics and incident response tools, using living-off-the-land techniques, setting up a reverse SSH shell, and stealing sensitive data. Attack details The initial access vector is known: SolarWinds WHD vulnerabilities. What’s unknown is which one, exactly, the attackers are leveraging. “Since the attacks occurred in December 2025 and on machines vulnerable to both the old and new set of CVEs at the same time, we cannot reliably confirm the exact CVE used to gain an initial foothold,” Microsoft said on Friday. Upon successful exploitation, the attackers downloaded and installed a legitimate Zoho Assist (remote access/support) agent and use it for “hands-on” work on the compromised system. They proceeded to enumerate domain-joined machines and users (including domain admins) and deploy an old, vulnerable version of the legitimate Velociraptor DFIR tool. “While Velociraptor is designed to help defenders with endpoint monitoring and artifact collection, its capabilities, such as remote command execution, file retrieval, and process execution via VQL queries, make it equally effective as a C2 framework when pointed at attacker-controlled infrastructure,” Huntress researchers explained. “The Velociraptor server URL, https://auth.qgtxtebl.workers[.]dev/, utilizes a Cloudflare Worker from the same Cloudflare account we have seen before across multiple intrusions involving ToolShell exploitation, and Warlock ransomware deployment, identified by the shared per-account identifier component of the subdomain: qgtxtebl.” They used Velociraptor to execure a series of PowerShell commands. Thus, they established an additional tunnel-based C2 channel; collected system information and sent it to an Elastic Cloud instance, and disabled security controls (Windows firewall, Windows Defender, etc.) by modifying the system registry. Finally, they created scheduled tasks that use a QEMU virtual machine to open an SSH backdoor as an additional persistence mechanism. The timeline of the attacker’s activities (Source: Huntress) What to do? While Huntress analysts spotted the attacks on February 7, there are indications that the attacks started in mid-January, and possibly earlier. Huntress researchers have observed threat actors exploiting SolarWinds Web Help Desk vulnerability across 3 of its 78 customers that use the solution. Microsoft did not say how many victims they are aware of. It’s currently unknown whether these intrusions are part of a cyber espionage mission or a precursor to financially-motivated attacks. In either case, they are unwelcome. Enterprise defenders are advised to apply the latest SolarWinds WHD patch (version 2026.1 or later), totate credentials for service and admin accounts reachable from WHD, and remove public internet access to admin paths for WHD. “Review WHD hosts for unauthorized remote access tools (Zoho Assist, Velociraptor, Cloudflared, VS Code tunnels), unexpected services, encoded PowerShell execution, and silent MSI installations spawned by the WHD service process (java.exe / wrapper.exe),” Huntress researchers urged. Both companies have also shared threat hunting rules. UPDATE (March 9, 2026, 01:25 p.m. ET): CVE-2025-26399 has been added to CISA’s Known Exploited Vulnerabilities catalog. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

SmarterTools confirmed last week that the Warlock (aka Storm-2603) ransomware gang breached its network by exploiting an unpatched SmarterMail instance. The incident took place on January 29, 2026, when a mail server that was not updated to the latest version was compromised, the company's Chief Commercial Officer, Derek Curtis, said. "Prior to the breach, we had approximately 30 servers/VMs with SmarterMail installed throughout our network," Curtis explained. "Unfortunately, we were unaware of one VM, set up by an employee, that was not being updated. As a result, that mail server was compromised, which led to the breach." However, SmarterTools emphasized that the breach did not affect its website, shopping cart, My Account portal, and several other services, and that no business applications or account data were affected or compromised. About 12 Windows servers on the company's office network, as well as a secondary data center used for quality control (QC) tests, are confirmed to be affected. According to its CEO, Tim Uzzanti, the "attempted ransomware attack" also impacted hosted customers using SmarterTrack. "Hosted customers using SmarterTrack were the most affected," Uzzanti said in a different Community Portal threat. "This was not due to any issue within SmarterTrack itself, but rather because that environment was more easily accessible than others once they breached our network." Furthermore, SmarterTools acknowledged that the Warlock group waited for a couple of days after gaining initial access to take control of the Active Directory server and create new users, followed by dropping additional payloads like Velociraptor and the locker to encrypt files. "Once these bad actors gain access, they typically install files and wait approximately 6–7 days before taking further action," Curtis said. "This explains why some customers experienced a compromise even after updating -- the initial breach occurred prior to the update, but malicious activity was triggered later." It's currently not clear which SmarterMail vulnerability was weaponized by attackers, but it's worth noting that multiple flaws in the email software – CVE-2025-52691 (CVSS score: 10.0), CVE-2026-23760, and CVE-2026-24423 (CVSS scores: 9.3) – have come under active exploitation in the wild. CVE-2026-23760 is an authentication bypass flaw that could allow any user to reset the SmarterMail system administrator password by sending a specially crafted HTTP request. CVE-2026-24423, on the other hand, exploits a weakness in the ConnectToHub API method to achieve unauthenticated remote code execution (RCE). The vulnerabilities were addressed by SmarterTools in build 9511. Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that CVE-2026-24423 was being exploited in ransomware attacks. In a report published Monday, cybersecurity company ReliaQuest said it identified activity likely linked to Warlock that involved the abuse of CVE-2026-23760 to bypass authentication and stage the ransomware payload on internet-facing systems. The attack also leverages the initial access to download a malicious MSI installer ("v4.msi") from Supabase, a legitimate cloud-based backend platform, to install Velociraptor. "While this vulnerability allows attackers to bypass authentication and reset administrator passwords, Storm-2603 chains this access with the software's built-in 'Volume Mount' feature to gain full system control," security researcher Alexa Feminella said. "Upon entry, the group installs Velociraptor, a legitimate digital forensics tool it has used in previous campaigns, to maintain access and set the stage for ransomware." The security outfit also noted that the two vulnerabilities have the same net result: while CVE-2026-23760 grants unauthenticated administrative access via the password reset API, which can then be combined with the mounting logic to attain code execution, CVE-2026-24423 offers a more direct path to code execution through an API path. The fact that the attackers are pursuing the former method is an indication that it likely allows the malicious activity to blend in with typical administrative workflows, helping them avoid detection. "By abusing legitimate features (password resets and drive mounting) instead of relying solely on a single 'noisy' exploit primitive, operators may reduce the effectiveness of detections tuned specifically for known RCE patterns," Feminella added. "This pace of weaponization is consistent with ransomware operators rapidly analyzing vendor fixes and developing working tradecraft shortly after release." When reached for comment about the Warlock ransomware activity targeting SmarterTools, ReliaQuest told The Hacker News that it observed the attackers exploiting CVE-2026-23760 on unpatched systems running versions prior to Build 9511 shortly after the patch was released. "We confirmed this specific vulnerability was used because we observed successful password reset requests containing specific input designed to take over the built-in system administrator account," the company said in an emailed statement. "We also saw API calls consistent with probing for the second vulnerability, CVE-2026-24423, during the same window. However, the successful password reset activity confirms that CVE-2026-23760 was the method used to gain initial access." Users of SmarterMail are advised to upgrade to the latest version (Build 9526) with immediate effect for optimal protection, and isolate mail servers to block lateral movement attempts used to deploy ransomware. Observed Activity Exploiting CVE-2026-24423 In a statement shared via email, watchTowr's Head of Threat Intelligence, Ryan Dewhurst, told The Hacker News that mass exploitation of CVE-2026-24423 began on January 28, 2026, and that it has observed more than 1,000 exploitation attempts originating from about 60 unique attacker IP addresses. The cybersecurity company said it also identified multiple hubAddress URLs used for out-of-band callbacks. "This is the vulnerable (POST) parameter that allows the threat actor to call an external address. The attacker's external address then responds with arbitrary commands to execute," Dewhurst said. "A consistent marker in these requests is the nodeName field, often set to victim-$unix_epoch. It appears to be a simple yet effective way for attackers to label victims and link callbacks—nothing fancy, but it works." Furthermore, watchTowr pointed out that the exploitation has remained consistently steady since it was first observed, with weekends being one major exception. "Activity drops sharply and then quickly picks up again at the start of the workweek," Dewhurst said. "It appears mostly driven by operators during business hours. Either way, exploitation is ongoing, repeatable, and remains predictable. If you're not already patched, you should probably assume you've been compromised. Even the vendor itself was caught off guard with an out-of-date server getting hit. If the people shipping the fix can miss it, nobody gets a free pass." SmarterTools Confirms the Warlock Attack Involved CVE-2026-24423 When reached for comment, Curtis told The Hacker News over email that the threat actors exploited CVE-2026-24423 to gain access to the SmarterMail instance. "The issue involved an older SmarterMail server on one of our networks that we were unaware of, and it had not been updated by our IT department," Curtis added. "The specific vulnerability was CVE-2026-24423. As mentioned in our community post, our network architecture now looks very different than it did before." (The story was updated after publication to include a response from watchTowr and SmarterTools.)

SmarterTools confirmed last week that the Warlock ransomware gang breached its network after compromising an email system, but it did not impact business applications or account data. The company's Chief Commercial Officer, Derek Curtis, says that the intrusion occurred on January 29, via a single SmarterMail virtual machine (VM) set up by an employee. "Prior to the breach, we had approximately 30 servers/VMs with SmarterMail installed throughout our network," Curtis explained. “Unfortunately, we were unaware of one VM, set up by an employee, that was not being updated. As a result, that mail server was compromised, which led to the breach.” Although SmarterTools assures that customer data wasn’t directly impacted by this breach, 12 Windows servers on the company’s office network, as well as a secondary data center used for laboratory tests, quality control, and hosting, were confirmed to have been compromised. The attackers moved laterally from that one vulnerable VM via Active Directory, using Windows-centric tooling and persistence methods. Linux servers, which constitute the majority of the company’s infrastructure, were not compromised by this attack. The vulnerability exploited in the attack to gain access is CVE-2026-23760, an authentication bypass flaw in SmarterMail before Build 9518, which allows resetting administrator passwords and obtaining full privileges. SmarterTools reports that the attacks were conducted by the Warlock ransomware group, which has also impacted customer machines using a similar activity. The ransomware operators waited roughly a week after gaining initial access, the final stage being encryption of all reachable machines. However, in this case, Sentinel One security products reportedly stopped the final payload from performing encryption, the impacted systems were isolated, and data was restored from fresh backups. Tools used in the attacks include Velociraptor, SimpleHelp, and vulnerable versions of WinRAR, while startup items and scheduled tasks were also used for persistence, according to the company. Cisco Talos reported in the past that the threat actors were abusing the open-source DFIR tool Velociraptor. In October 2025, Halcyon cybersecurity company linked the Warlcok ransomware gang to a Chinese nation-state actor tracked as Storm-2603. ReliaQuest published a report earlier today confirming that the activity is linked to Storm-2603, with moderate-to-high confidence. “While this vulnerability allows attackers to bypass authentication and reset administrator passwords, Storm-2603 chains this access with the software’s built-in 'Volume Mount' feature to gain full system control,” ReliaQuest said. “Upon entry, the group installs Velociraptor, a legitimate digital forensics tool it has used in previous campaigns, to maintain access and set the stage for ransomware.” ReliaQuest also saw probes for CVE-2026-24423, another SmarterMail flaw flagged by CISA as actively exploited by ransomware actors last week, although the primary vector was CVE-2026-23760. The researchers note that CVE-2026-24423 provides a more direct API path to achieve remote code execution, but CVE-2026-23760 can be less noisy, blending into legitimate administrative activity, which is why Storm-2603 might have opted for that one instead. To address all recent flaws in the SmarterMail product, administrators are recommended to upgrade to Build 9511 or later as soon as possible. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Ransomware group breached SmarterTools via flaw in its SmarterMail deployment SmarterTools, the company behind the popular Microsoft Exchange alternative SmarterMail, has been breached by a ransomware-wielding group that leveraged a recently fixed vulnerability in that solution. How did the SmarterTools breach happen? Derek Curtis, the firm’s Chief Operating Officer, said that the breach happened on January 29, 2026. “Prior to the breach, we had approximately 30 servers/VMs with SmarterMail installed throughout our network. Unfortunately, we were unaware of one VM, set up by an employee, that was not being updated. As a result, that mail server was compromised, which led to the breach,” he shared last week. The attack ended up affecting the company’s office network and a network at a datacenter hosting labs for quality control work. “At the data center, we hosted our Portal as well as our Hosted SmarterTrack network, which was connected via Active Directory. We didn’t see much affected there and, out of an abundance of caution, we restored some of those servers from the most recent backup, which was six hours old,” he added. “Because we are primarily a Linux company now, only about 12 Windows servers looked to be compromised and on those servers, our virus scanners blocked most efforts. None of the Linux servers were affected. None of our business applications or account data were affected or compromised.” In the aftermath of the attack, the company eliminated Windows from their networks, stopped using Active Directory services, and have changed passwords throughout their network. The attackers’ TTPs Curtis did not share which vulnerability was exploited by the attackers, but CVE-2026-24423 seems like a likely candidate: the flaw was added to CISA’s Known Exploited Vulnerabilities catalog on February 5, 2026, and marked as “Exploited in ransomware attacks“. (Two other SmarterMail vulnerabilities were added to the same catalog in late January, but those are not known to be leveraged in ransomware attacks.) What he did share is that the group behind the “hit” is the Warlock group (aka Gold Salem, aka Storm-2603), which has been targeting a wide variety of organizations, mostly in North America, Europe, and South America. The group uses the Warlock ransomware and double extortion tactics. “Once these bad actors gain access, they typically install files and wait approximately 6–7 days before taking further action. This explains why some customers experienced a compromise even after updating—the initial breach occurred prior to the update, but malicious activity was triggered later,” Curtis explained. “They often attempt to take control of the Active Directory server and create new users. From there, they distribute files across Windows machines and attempt to execute files that encrypt data.” Curtis shared other tactics, techniques, and procedures (TTPs) used by the group: common file names and folders, and common programs leveraged (e.g., Velociraptor, SimpleHelp, WinRAR, etc.) “It is also important to note that CVEs are being discovered across many different products. Some groups install legitimate-looking applications on servers and later exploit. For example, the Warlock Group frequently targets CVE’s in SharePoint and Veeam and has now targeted SmarterMail. Recent Notepad++ update vulnerabilities are another example of how trusted applications can be leveraged to further exploit systems, servers, and desktops,” he added. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Microsoft has revealed that it observed a multi‑stage intrusion that involved the threat actors exploiting internet‑exposed SolarWinds Web Help Desk (WHD) instances to obtain initial access and move laterally across the organization's network to other high-value assets. That said, the Microsoft Defender Security Research Team said it's not clear whether the activity weaponized recently disclosed flaws (CVE-2025-40551, CVSS score: 9.8, and CVE-2025-40536, CVSS score: 8.1), or a previously patched vulnerability (CVE-2025-26399, CVSS score: 9.8). "Since the attacks occurred in December 2025 and on machines vulnerable to both the old and new set of CVEs at the same time, we cannot reliably confirm the exact CVE used to gain an initial foothold," the company said in a report published last week. While CVE-2025-40536 is a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality, CVE-2025-40551 and CVE-2025-26399 both refer to untrusted data deserialization vulnerabilities that could lead to remote code execution. Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-40551 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. Federal Civilian Executive Branch (FCEB) agencies were ordered to apply the fixes for the flaw by February 6, 2026. In the attacks detected by Microsoft, successful exploitation of the exposed SolarWinds WHD instance allowed the attackers to achieve unauthenticated remote code execution and run arbitrary commands within the WHD application context. "Upon successful exploitation, the compromised service of a WHD instance spawned PowerShell to leverage BITS [Background Intelligent Transfer Service] for payload download and execution," researchers Sagar Patil, Hardik Suri, Eric Hopper, and Kajhon Soyini noted. In the next stage, the threat actors downloaded legitimate components associated with Zoho ManageEngine, a legitimate remote monitoring and management (RMM) solution, to enable persistent remote control over the infected system. The attackers followed it up with a series of actions - Enumerated sensitive domain users and groups, including Domain Admins. Established persistence via reverse SSH and RDP access, with the attackers also attempting to create a scheduled task to launch a QEMU virtual machine under the SYSTEM account at system startup to cover up the tracks within a virtualized environment while exposing SSH access via port forwarding. Used DLL side-loading on some hosts by using "wab.exe," a legitimate system executable associated with the Windows Address Book, to launch a rogue DLL ("sspicli.dll") to dump the contents of LSASS memory and conduct credential theft. In at least one case, Microsoft said the threat actors conducted a DCSync attack, where a Domain Controller (DC) is simulated to request password hashes and other sensitive information from an Active Directory (AD) database. To counter the threat, users are advised to keep the WHD instances up-to-date, find and remove any unauthorized RMM tools, rotate service and admin accounts, and isolate compromised machines to limit the breach. "This activity reflects a common but high-impact pattern: a single exposed application can provide a path to full domain compromise when vulnerabilities are unpatched or insufficiently monitored," the Windows maker said. "In this intrusion, attackers relied heavily on living-off-the-land techniques, legitimate administrative tools, and low-noise persistence mechanisms. These tradecraft choices reinforce the importance of defense in depth, timely patching of internet-facing services, and behavior-based detection across identity, endpoint, and network layers." Update In a report published on February 8, 2026, cybersecurity company Huntress said it investigated a case of SolarWinds WHD exploitation, in which the threat actor rapidly deployed Zoho Meetings and Cloudflare tunnels for persistence, as well as a legitimate forensics tool called Velociraptor for command-and-control (C2). The incident occurred on February 7, 2026. The following sequence of post-exploitation actions describes how the attack unfolded - Launched "cmd.exe" to install a remote MSI payload associated with Zoho ManageEngine RMM and established remote access by configuring the Zoho Assist agent for unattended access and registering the compromised host to a Zoho Assist account tied to a Proton Mail address "esmahyft@proton[.]me." Executed Active Directory discovery commands to enumerate domain-joined machines for reconnaissance. Leveraged the Zoho Assist remote session to deploy Velociraptor version 0.73.4, an outdated version with a known privilege escalation vulnerability (CVE-2025-6264). Used the Velociraptor agent to execute PowerShell commands to check for the presence of "code.exe," a Visual Studio Code binary with the likely intent of establishing a remote tunnel. Installed Cloudflared to establish an additional tunnel-based channel for redundant access to the compromised host. Executed a PowerShell script that collects comprehensive system information and transmits it directly to an attacker-controlled Elastic Cloud instance. Disabled Windows Defender and Windows Firewall via Registry modifications. Executed a script that implements a live C2 failover mechanism for the Velociraptor agent to connect it to a different server ("v2-api.mooo[.]com") if the original Cloudflare workers[.]dev domain has been detected. It achieves this by sending a request to the failover server and checking the HTTP response code. If the status is 406 Not Acceptable, the Velociraptor is reconfigured to talk to the new server. Created scheduled tasks that use QEMU to open an SSH backdoor as a persistence mechanism. "The Velociraptor server URL, https://auth.qgtxtebl.workers[.]dev/, utilizes a Cloudflare Worker from the same Cloudflare account we have seen before across multiple intrusions involving ToolShell exploitation, and Warlock ransomware deployment, identified by the shared per-account identifier component of the subdomain: qgtxtebl," Huntress researchers noted. When asked if the latest set of attacks could also be the work of the Warlock ransomware crew, given the indicators of compromise, Jamie Levy, director of adversary tactics at Huntress, told The Hacker News in an email that "there are definitely some similarities that show that this recent campaign of attacks is from the same threat actor group." This includes the "usage of the same tools and tactics post compromise," along with reused infrastructure observed in prior campaigns. "We also saw one customer come on after they had been compromised and ransomed, cementing our suspicions even further," Levy added. Threat Actor Abuses Elastic Cloud SIEM Free Trial According to a follow-up analysis published by Huntress on March 6, 2026, the aforementioned attack chain involved the threat actor exfiltrating system information to a free trial instance of Elastic Cloud security information and event management (SIEM) named "systeminfo" under their control by means of a PowerShell script. "While we have previously seen threat actors leveraging Velociraptor and other DFIR-focused tools for command and control, this was the first time we observed an adversary use Elastic Cloud for exfiltration," the company said. "The attacker prepared their own Elastic Cloud free trial, using legitimate Elastic infrastructure, using it as a repository for stolen data across intrusions. They could then triage their victims and compromised endpoints, literally using SIEM technology." The Elastic Cloud deployment was created by the threat actor on January 28, 2026, by registering their trial account with a throwaway email address likely generated using firstmail[.]ltd, a Russia-based disposable mail service. In all, the threat actor is estimated to have spent approximately 249 minutes between January 28 and February 4, 2026, running queries against victim data through the Discover interface of Kibana, an open-source data visualization and exploration tool designed for Elasticsearch. Administrative login sessions to the Elastic Cloud instance originated from the following two IP addresses - 154.26.156[.]181 51.161.152[.]26 It's worth noting that the IP address 51.161.152[.]26, an exit node associated with the Safing Privacy Network (SPN), was also flagged by Palo Alto Networks Unit 42 in July 2025 in connection with a ToolShell campaign aimed at vulnerable Microsoft SharePoint servers. The Elastic Cloud instance has been found to contain about 216 unique victim hosts that span a wide range of sectors, including government agencies, higher education institutions, financial services, religious and nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail, and construction. On top of that, evidence has emerged that the threat actor has been conducting opportunistic attacks against vulnerable Gladinet CentreStack, SmarterTools SmarterMail, and Microsoft SharePoint instances as well, per Lumen Technologies Black Lotus Labs. Elastic has since taken down the instance. (The story was updated after publication to include a response from Huntress.)

IT management software company SmarterTools fell victim to a ransomware attack through an unpatched instance of its SmarterMail email server. The incident occurred on January 29 and impacted the company’s office network and a data center hosting quality control testing systems, SmarterTools’ portal, and its Hosted SmarterTrack network. The company’s website, shopping cart, My Account portal, and other services were not affected, as they were hosted on a different network. The point of entrance, SmarterTools CCO Derek Curtis has revealed, was a VM running an unpatched instance of the company’s SmarterMail product. Hackers compromised the mail server and moved laterally to the Windows servers they could find on the data center, compromising 12 of them. “When we first noticed the breach, we instantly shut off all servers at the two locations and we disabled all internet until we completely evaluated all aspects of the breach and either eliminated servers and/or restored servers to be safe,” Curtis explained. Because the hackers only targeted Windows systems, SmarterTools eliminated as many as it could and removed Active Directory services from its environment, while resetting passwords across the network. The attack, Curtis said, was perpetrated by a ransomware group known as Warlock, which emerged in June 2025 and is believed to be operating out of China. The hackers likely exploited CVE-2026-24423 (CVSS score of 9.3), an unauthenticated remote code execution (RCE) vulnerability that was patched on January 15 along with two other exploited flaws, namely CVE-2026-23760 and CVE-2025-52691. Last week, the US cybersecurity agency CISA warned that CVE-2026-24423 had been exploited in ransomware attacks, without detailing the observed exploitation. With SmarterTools saying that the Warlock gang has compromised some of its customers as well, it is likely that these were the ransomware attacks CISA was referring to. Customers are advised to update to the latest version of SmarterMail as soon as possible. Curtis pointed out that, while the exploited security defects were addressed on January 15 in build 9518, SmarterMail build 9526 was released on January 22 to complement the fixes with additional improvements. “It remains challenging to ensure all customers keep their installations up to date. Every build we release has significance. Even smaller security updates can help prevent issues such as denial-of-service attacks that might otherwise consume excessive server memory or CPU,” Curtis notes. Related: Fresh SolarWinds Vulnerability Exploited in Attacks Related: Critical React Native Vulnerability Exploited in the Wild Related: Ivanti Patches Exploited EPMM Zero-Days Related: Fortinet Patches Exploited FortiCloud SSO Authentication Bypass

Cybersecurity researchers have disclosed details of a new ransomware family called Osiris that targeted a major food service franchisee operator in Southeast Asia in November 2025. The attack leveraged a malicious driver called POORTRY as part of a known technique referred to as bring your own vulnerable driver (BYOVD) to disarm security software, the Symantec and Carbon Black Threat Hunter Team said. It's worth noting that Osiris is assessed to be a brand-new ransomware strain, sharing no similarities with another variant of the same name that emerged in December 2016 as an iteration of the Locky ransomware. It's currently not known who the developers of the locker are, or if it's advertised as a ransomware-as-a-service (RaaS). However, the Broadcom-owned cybersecurity division said it identified clues that suggest the threat actors who deployed the ransomware may have been previously associated with INC ransomware (aka Warble). "A wide range of living off the land and dual-use tools were used in this attack, as was a malicious POORTRY driver, which was likely used as part of a bring your own vulnerable driver (BYOVD) attack to disable security software," the company said in a report shared with The Hacker News. "The exfiltration of data by the attackers to Wasabi buckets, and the use of a version of Mimikatz that was previously used, with the same filename (kaz.exe), by attackers deploying the INC ransomware, point to potential links between this attack and some attacks involving INC." Described as an "effective encryption payload" that's likely wielded by experienced attackers, Osiris makes use of a hybrid encryption scheme and a unique encryption key for each file. It's also flexible in that it can stop services, specify which folders and extensions need to be encrypted, terminate processes, and drop a ransom note. By default, it's designed to kill a long list of processes and services related to Microsoft Office, Exchange, Mozilla Firefox, WordPad, Notepad, Volume Shadow Copy, and Veeam, among others. First signs of malicious activity on the target's network involved the exfiltration of sensitive data using Rclone to a Wasabi cloud storage bucket prior to the ransomware deployment. Also utilized in the attack were a number of dual-use tools like Netscan, Netexec, and MeshAgent, as well as a custom version of the Rustdesk remote desktop software. POORTRY is a little different from traditional BYOVD attacks in that it uses a bespoke driver expressly designed for elevating privileges and terminating security tools, as opposed to deploying a legitimate-but-vulnerable driver to the target network. "KillAV, which is a tool used to deploy vulnerable drivers for terminating security processes, was also deployed on the target's network," the Symantec and Carbon Black Threat Hunter Team noted. "RDP was also enabled on the network, likely to provide the attackers with remote access." The development comes as ransomware remains a significant enterprise threat, with the landscape constantly shifting as some groups close their doors and others quickly rise from their ashes or move in to take their place. According to an analysis of data leak sites by Symantec and Carbon Black, ransomware actors claimed a total of 4,737 attacks during 2025, up from 4,701 in 2024, a 0.8% increase. The most active players during the past year were Akira (aka Darter or Howling Scorpius), Qilin (aka Stinkbug or Water Galura), Play (aka Balloonfly), INC, SafePay, RansomHub (aka Greenbottle), DragonForce (aka Hackledorb), Sinobi, Rhysida, and CACTUS. Some of the other notable developments in the space are listed below - Threat actors using the Akira ransomware have leveraged a vulnerable Throttlestop driver, along with the Windows CardSpace User Interface Agent and Microsoft Media Foundation Protected Pipeline, to sideload the Bumblebee loader in attacks observed in mid-to-late 2025. Akira ransomware campaigns have also exploited SonicWall SSL VPNs to breach small- to medium-sized business environments during mergers and acquisitions and ultimately obtain access to the bigger, acquiring enterprises. Another Akira attack has been found to leverage ClickFix-style CAPTCHA verification lures to drop a .NET remote access trojan called SectopRAT, which serves as a conduit for remote control and ransomware delivery. LockBit (aka Syrphid), which partnered with DragonForce and Qilin in October 2025, has continued to maintain its infrastructure despite a law enforcement operation to shut down its operations in early 2024. It has also released variants of LockBit 5.0 targeting multiple operating systems and virtualization platforms. A significant update to LockBit 5.0 is the introduction of a two-stage ransomware deployment model that separates the loader from the main payload, while simultaneously maximizing evasion, modularity, and destructive impact. A new RaaS operation dubbed Sicarii has claimed only one victim since it first surfaced in late 2025. While the group explicitly identifies itself as Israeli/Jewish, analysis has uncovered that underground online activity is primarily carried out in Russian and that the Hebrew content shared by the threat actor contains grammatical and semantic errors. This has raised the possibility of a false flag operation. Sicarii's primary operator has used the Telegram account "@Skibcum," posing as its communications lead to promote the ransomware, while claiming that the group focuses on small businesses and that it's intentionally maintaining a lower profile "for now." The threat actor known as Storm-2603 (aka CL-CRI-1040 or Gold Salem) has been observed leveraging the legitimate Velociraptor digital forensics and incident response (DFIR) tool as part of precursor activity leading to the deployment of Warlock, LockBit, and Babuk ransomware. The attacks have also utilized two drivers ("rsndispot.sys" and "kl.sys") along with "vmtools.exe" to disable security solutions using a BYOVD attack. Entities in India, Brazil, and Germany have been targeted by Makop ransomware attacks that exploit exposed and insecure RDP systems to stage tools for network scanning, privilege escalation, disabling security software, credential dumping, and ransomware deployment. The attacks, besides using "hlpdrv.sys" and "ThrottleStop.sys" drivers for BYOVD attacks, also deploy GuLoader to deliver the ransomware payload. This is the first documented case of Makop being distributed via a loader. Ransomware attacks have also obtained initial access using already-compromised RDP credentials to perform reconnaissance, privilege escalation, lateral movement via RDP, followed by exfiltrating data to temp[.]sh on day six of the intrusion and deploying Lynx ransomware three days later. A security flaw in the encryption process associated with the Obscura ransomware has been found to render large files unrecoverable. "When it encrypts large files, it fails to write the encrypted temporary key to the file's footer," Coveware said. "For files over 1GB, that footer is never created at all — which means the key needed for decryption is lost. These files are permanently unrecoverable." A new ransomware family named 01flip has targeted a limited set of victims in the Asia-Pacific region. Written in Rust, the ransomware can target both Windows and Linux systems. Attack chains involve the exploitation of known security vulnerabilities (e.g., CVE-2019-11580) to obtain a foothold into target networks. It has been attributed to a financially motivated threat actor known as CL-CRI-1036. To protect against targeted attacks, organizations are advised to monitor the use of dual-use tools, restrict access to RDP services, enforce multi-factor authentication (2FA), use application allowlisting where applicable, and implement off-site storage of backup copies. "While attacks involving encrypting ransomware remain as prevalent as ever and still pose a threat, the advent of new types of encryptionless attacks adds another degree of risk, creating a wider extortion ecosystem of which ransomware may become just one component," Symantec and Carbon Black said.

Ransomware activity never dies, it multiplies Ransomware attacks kept climbing through 2025, even as major criminal groups collapsed and reformed. A new study conducted by the Symantec and Carbon Black Threat Hunter Team shows that disruption inside the ransomware economy slowed activity only briefly, while extortion methods expanded and diversified. Claimed ransomware attacks by actors operating data leak sites, 2022–2025 (Source: Symantec and Carbon Black) Record activity despite major takedowns Ransomware actors claimed 4,737 attacks in 2025, the highest annual total recorded in the dataset. Monthly activity rose steadily through the year, with one sharp dip in April after the sudden shutdown of RansomHub, which had been the most active operation at the time. The pause did not last long. Former RansomHub affiliates shifted quickly to other groups, and attack volumes returned to earlier levels within weeks. August showed another decline, consistent with seasonal slowdowns observed in prior years. New leaders replace fallen operations Two dominant ransomware operations disappeared during the year. LockBit, tracked in the report as Syrphid, failed to recover after law enforcement actions in late 2024. RansomHub, also known as Greenbottle, shut down abruptly in April 2025. Other groups gained ground as a result. Akira and Qilin each accounted for 16% of claimed attacks in 2025. Inc and Safepay followed at 6% each, while DragonForce emerged as a new entrant responsible for 5% of claims. The reshuffling highlights how affiliates move fluidly between ransomware services. Access brokers, tooling, and payment structures continued to circulate among groups, which helped sustain overall activity levels. Extortion expands beyond encryption One of the most significant findings in the study involves extortion campaigns that do not rely on encryption. These attacks focus on stealing data and threatening to publish it, skipping the deployment of ransomware entirely. Encryption based attacks remained just above 4,700 incidents annually. When data theft extortion is included, total extortion incidents reached 6,182 in 2025. That represents a 23% increase compared with 2024. Snakefly, which runs the Cl0p ransomware operation, played a major role in this shift. These actors exploited vulnerabilities in widely used enterprise software to extract data at scale. Victims included large organizations in government and industry, with some campaigns affecting hundreds of companies through a single flaw. Researchers linked several of these operations to shared tooling and leak infrastructure, suggesting coordination among loosely affiliated actors who specialize in data theft and public pressure. “While attacks involving encrypting ransomware remain as prevalent as ever and still pose a threat, the advent of new types of encryptionless attacks adds another degree of risk, creating a wider extortion ecosystem of which ransomware may become just one component,” said the Symantec and Carbon Black Threat Hunter Team. Social engineering as primary access path The research documents a rise in attacks driven by social engineering, particularly against cloud platforms and identity systems. Groups associated with ShinyHunters and Scattered Spider used phone based impersonation, credential harvesting, and abuse of OAuth workflows to gain access to enterprise environments. In several campaigns, attackers convinced employees to authorize malicious applications or share authentication codes under the guise of IT support. Once access was established, the actors exported large volumes of data and issued extortion demands. These techniques reduced reliance on malware and complicated detection in environments with heavy legitimate cloud usage. Ransomware activity tied to older espionage tooling A newer ransomware strain tracked as Warlock drew attention due to its tooling and infrastructure. First observed in mid 2025, Warlock attacks exploited a zero day vulnerability in Microsoft SharePoint and used DLL sideloading for payload delivery. Analysis linked Warlock to tooling previously associated with Chinese espionage activity, including signed drivers and custom command frameworks. Some ransomware payloads appeared to be modified versions of leaked LockBit code, combined with older malware components. The study notes overlaps between ransomware activity and long running espionage campaigns, where ransomware deployment may serve operational or financial goals within broader intrusion efforts. Shared techniques dominate attack chains Researchers found that ransomware attack chains remained consistent. Actors relied on living off the land techniques, using built in administrative tools for discovery, lateral movement, and credential access. PowerShell appeared most frequently, supported by remote management software, backup utilities, and credential dumping tools. Malware often appeared late in the intrusion, close to data theft or encryption stages. These shared methods reduced the need for custom tooling and allowed attackers to adapt quickly when defenders blocked specific techniques.

Analysis of the tradecraft evolution across 6 months and 11 incidents

For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous students, alumni, donors, staff, faculty, employees, and suppliers at Phoenix were impacted. The Cl0p ransomware gang is likely responsible, as part of a broader campaign. Check Point IPS, Threat Emulation and Harmony Endpoint provide protection against this threat (Oracle Multiple Products Remote Code Execution; Ransomware.Win.Clop; Ransomware.Wins.Clop; Ransomware.Wins.Clop.ta.*) Financial software provider Marquis Software Solutions has disclosed a data breach that impacted over 74 banks and credit unions across the US and exposed sensitive data of more than 400,000 customers. The Akira ransomware gang is possibly responsible for the attack, which exploited vulnerabilities in SonicWall firewalls to gain network access. Check Point Threat Emulation provides protection against this threat (Ransomware.Wins.Akira.ta.*; Ransomware.Wins.Akira) American pharmaceutical firm Inotiv has reported on a ransomware attack that occurred in August 2025. The Qilin ransomware group claimed responsibility, leaking personal information from over 9,500 individuals, including current and former employees and their family members. Check Point Threat Emulation and Harmony Endpoint provide protection against this threat South Korean retail giant Coupang has confirmed a data breach that resulted in the exposure of personal information belonging to nearly 34 million clients, including full names, phone numbers, email addresses, and more. No payment details or account passwords were leaked in the incident. YouTube app for Android TV, SmartTube, has been targeted in an attack that resulted in the compromise of its developer signing keys and the distribution of a malicious update containing hidden malware. The incident impacted Android TV, Fire TV Stick, and similar device users. Belgian postal and package delivery service, Bpost, has suffered a data breach that resulted in the exfiltration of 5,140 files totaling about 30.46GB from a third-party exchange platform. The stolen data reportedly includes personal and business information of some customers of the affected department. The ransomware group TridentLocker has claimed responsibility for the attack. Canadian wireless telecommunications provider, Freedom Mobile, has experienced a data breach that resulted in attackers gaining unauthorized access to its customer account management platform and stealing personal information, including names, addresses, dates of birth, phone numbers, and account numbers. The company has not disclosed the exact number of affected customers. VULNERABILITIES AND PATCHES Check Point has elaborated on the critical React2Shell vulnerability, CVE-2025-55182, that affects React 19.x and related server-side frameworks such as Next.js 15.x/16.x. The vulnerability enables unauthenticated remote code execution via malicious HTTP requests targeting the server’s decoding process. Exploitation allows attackers to gain full control over application servers, intercept sensitive data, inject false transactions, and potentially pivot deeper into enterprise environments. Check Point IPS provides protection against this threat (React Server Components Remote Code Execution (CVE-2025-55182)) Check Point Research revealed a vulnerability in OpenAI Codex CLI that allowed attackers to achieve remote code execution via malicious project-local configuration files (MCP entries) executed without user prompts. OpenAI released a patch in version 0.23.0 to address the automatic execution risk. Check Point Research shared details of a critical exploit in Yearn Finance’s yETH pool, where an attacker abused a smart contract flaw to mint trillions of tokens with a minuscule deposit, resulting in the theft of approximately $9 million in assets from the Ethereum-based DeFi protocol. THREAT INTELLIGENCE REPORTS Check Point summarizes a multiyear Salt Typhoon cyber-espionage campaign that compromised 80 telecom providers worldwide and a US state Army National Guard network, chaining SIM-based credential theft, network scans, Ivanti/PAN-OS/Cisco CVEs and GTP/GTPDOOR abuses to exfiltrate sensitive communications and configuration data. US and Canadian cybersecurity agencies outlined BRICKSTORM, a stealthy backdoor used by Chinese affiliated hackers to infiltrate VMware vSphere environments and maintain long-term access. The campaign targeted government services and IT, stealing credentials via VM snapshots and creating hidden machines. The ShadyPanda threat actor ran a seven-year campaign weaponizing verified Chrome and Edge extensions to infect over 4.3 million devices with spyware for remote code execution, payload delivery, traffic redirection, credential and cookie theft, browser fingerprinting, HTTPS credential interception, and behavioral biometrics exfiltration. Researchers identified a campaign weaponizing Velociraptor, a digital forensics tool, to establish stealthy command channels and maintain persistence in enterprise environments. Attackers exploited SharePoint’s “ToolShell” chain using CVE-2025-49706 and CVE-2025-49704, linked to Storm-2603, and in confirmed cases delivered Warlock ransomware. Albiriox, a new Android banking trojan sold as Malware-as-a-Service (MaaS), targets over 400 financial and crypto apps using VNC-style remote control, accessibility abuse, overlays, and black-screen masking for on-device fraud. The malware is spread via smishing, WhatsApp lures, and fake apps with droppers over unencrypted TCP C2 channels using structured JSON messages.

How a noisy ransomware intrusion exposed a long-term espionage foothold Getting breached by two separate and likely unconnected cyber attack groups is a nightmare scenario for any organization, but can result in an unexpected silver lining: the noisier intrusion can draw attention to a far stealthier threat that might otherwise linger undetected for months. A double whammy In a recently published report, threat researchers at Positive Technologies have detailed the findings of their investigation into two incidents at Russian companies, which they have tied to: QuietCrabs, a threat actor believed to be of Asian origin and concentrating on cyber espionage, and Thor, a threat group that has been targetting Russian companies with LockBit and Babuk ransomware. Both groups exploited publicly known vulnerabilities in Microsoft Sharepoint Server (CVE-2025-53770) and Ivanti’s solutions (CVE-2024-21887, CVE-2025-4427, CVE-2025-4428, CVE-2023-38035) to achieve initial access. QuietCrabs attack flow (Source: Positive Technologies) QuietCrabs leveraged an ASPX web shell, the KrustyLoader (loader) malware, and the Sliver command & control implant. Thor, on the other hand, uses well-known and widely used tools: The ADRecon utility (for Active Directory domain reconnaissance) The GodPotato tool (for privilege escalation) Secretsdump and Mimikatz (for data extraction) Tactical RMM and MeshAgent (for persistence), and Rclone (for data exfiltration.) In this case, though, Thor’s presence was detected early enough to foil the deployment of ransomware. “QuietCrabs and the presumed Thor group operated in almost the same time period. The gap between their malicious activities was only a few days,” the threat researchers noted (though didn’t mention when the attacks actually happened). “It is also important that the investigation began at the point where Thor activity was first registered. In other words, QuietCrabs could have remained inside the infrastructure for much longer if not for Thor. According to Mandiant’s investigations, QuietCrabs’ average dwell time in victim infrastructure is 393 days.” The researchers are almost entirely certain that one of the intrusions was by QuietCrabs, as the KrustyLoader is unique malware that’s associated with that group. “Some vendors describe KrustyLoader exclusively as Linux malware. In our case, however, all incident artifacts were Windows samples,” they shared. The other, more noisy activity has been attributed to Thor based on indicators of compromise that matched a previous attack report by another Russian cybersecurity company. Thor attack flow (Source: Positive Technologies) ToolShell: A magnet for various threat actors In July 2025, after reports of CVE-2025-53770 (aka ToolShell) having been exploited as a zero-day by Chinese threat actors Linen Typhoon and Violet Typhoon against organizations worldwide, Microsoft confirmed that a financially motivated China-based threat actor (Storm 2603) has also been using the vulnerability to achieve access and deploy Warlock ransomware. “We cannot confidently state that QuietCrabs is collaborating with Thor. In this case, the overlap is most likely coincidental, as both QuietCrabs and Thor conduct broad scans of organizations for subsequent compromise,” the PT researchers opined. While they say that QuietCrabs has been targeting organizations in the US, UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countries, Thor’s victims appear to be mostly Russian orgs. “We were able to identify around 110 Russian companies as potential victims. The affected organizations varied greatly both in economic sector and in the potential profit they offered the attackers,” they concluded. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Bad actors are leveraging browser notifications as a vector for phishing attacks to distribute malicious links by means of a new command-and-control (C2) platform called Matrix Push C2. "This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target victims across operating systems," Blackfog researcher Brenda Robb said in a Thursday report. In these attacks, prospective targets are tricked into allowing browser notifications through social engineering on malicious or legitimate-but-compromised websites. Once a user agrees to receive notifications from the site, the attackers take advantage of the web push notification mechanism built into the web browser to send alerts that look like they have been sent by the operating system or the browser itself, leveraging trusted branding, familiar logos, and convincing language to maintain the ruse. These include alerts about, say, suspicious logins or browser updates, along with a handy "Verify" or "Update" button that, when clicked, takes the victim to a bogus site. What makes this a clever technique is that the entire process takes place through the browser without the need for first infecting the victim's system through some other means. In a way, the attack is like ClickFix in that users are lured into following certain instructions to compromise their own systems, thereby effectively bypassing traditional security controls. That's not all. Since the attack plays out via the web browser, it's also a cross-platform threat. This essentially turns any browser application on any platform that subscribes to the malicious notifications to be enlisted to the pool of clients, giving adversaries a persistent communication channel. Matrix Push C2 is offered as a malware-as-a-service (MaaS) kit to other threat actors. It's sold directly through crimeware channels, typically via Telegram and cybercrime forums, under a tiered subscription model: about $150 for one month, $405 for three months, $765 for six months, and $1,500 for a full year. "Payments are accepted in cryptocurrency, and buyers communicate directly with the operator for access," Dr. Darren Williams, founder and CEO of BlackFog, told The Hacker News. "Matrix Push was first observed at the beginning of October and has been active since then. There’s no evidence of older versions, earlier branding, or long-standing infrastructure. Everything indicates this is a newly launched kit." The tool is accessible as a web-based dashboard, allowing users to send notifications, track each victim in real-time, determine which notifications the victims interacted with, create shortened links using a built-in URL shortening service, and even record installed browser extensions, including cryptocurrency wallets. "The core of the attack is social engineering, and Matrix Push C2 comes loaded with configurable templates to maximize the credibility of its fake messages," Robb explained. "Attackers can easily theme their phishing notifications and landing pages to impersonate well-known companies and services." Some of the supported notification verification templates are associated with well-known brands like MetaMask, Netflix, Cloudflare, PayPal, and TikTok. The platform also includes an "Analytics & Reports" section that allows its customers to measure the effectiveness of their campaigns and refine them as required. "Matrix Push C2 shows us a shift in how attackers gain initial access and attempt to exploit users," BlackFog said. "Once a user's endpoint (computer or mobile device) is under this kind of influence, the attacker can gradually escalate the attack." "They might deliver additional phishing messages to steal credentials, trick the user into installing a more persistent malware, or even leverage browser exploits to get deeper control of the system. Ultimately, the end goal is often to steal data or monetize the access, for example, by draining cryptocurrency wallets or exfiltrating personal information." Attacks Misusing Velociraptor on the Rise The development comes as Huntress said it observed a "significant uptick" in attacks weaponizing the legitimate Velociraptor digital forensics and incident response (DFIR) tool over the past three months. On November 12, 2025, the cybersecurity vendor said threat actors deployed Velociraptor after obtaining initial access through exploitation of a flaw in Windows Server Update Services (CVE-2025-59287, CVSS score: 9.8), which was patched by Microsoft late last month. Subsequently, the attackers are said to have launched discovery queries with the goal of conducting reconnaissance and gathering details about users, running services, and configurations. The attack was contained before it could progress further, Huntress added. The cybersecurity company said it also detected three disparate incidents between September 9 and November 5, 2025, two of which involved the exploitation of the ToolShell SharePoint flaw to deliver Velociraptor and establish a foothold on compromised networks. The access was then used to set up a Cloudflare or Visual Studio Code tunnel. The initial access vector used in the third incident is currently not known, but the investigation has revealed that the threat actor managed to install Velociraptor on multiple endpoints to enable remote command execution and set up Cloudflare and VS Code tunnels. The attack led to the successful deployment of Warlock ransomware. To counter the threat, organizations are recommended to validate the legitimacy of any Velociraptor instances in their environment and monitor for any unauthorized software in their environments. The discovery shows that threat actors are not just using custom C2 frameworks, but are also employing readily available offensive cybersecurity and incident response tools to their advantage. "We've seen threat actors use legitimate tools long enough to know that Velociraptor won't be the first dual-use, open-source tool that will pop up in attacks – nor will it be the last," Huntress researchers said. (The story was updated after publication on December 9, 2025, to include additional details of Velociraptor abuse.)

Key Findings Record fragmentation and decentralization: The number of active extortion groups in Q3 2025 rose to a record of 85 groups, the highest number observed to date. The top 10 groups accounted only for 56% of all published victims, down from 71% in Q1. Stable high activity: Ransomware victim postings stabilized at an average of 535 victims per month, up from 420 year-over-year (YoY) in Q2–Q3 2024, but below the Q1 2025 peak. LockBit’s return: Lockbit’s reappearance with the release of LockBit 5.0 in September 2025 potentially signals affiliate re-centralization under a major brand Emerging dominance: Qilin became the most active group, averaging 75 victims per month, followed by Akira, INC Ransom, and Play. Regional concentration shifts: South Korea entered the top 10 list of most attacked countries following a focused campaign by Qilin targeting its financial sector. Sector impact: Manufacturing and business services remained the most affected sectors. Healthcare held steady at 8% of total victims, despite selective avoidance by major actors like Play. Ransomware in Q3 2025: RaaS fragmentation increases and Lockbit is back During the third quarter of 2025, we monitored more than 85 active data leak sites (DLS) that collectively listed 1,592 new victims. Compared to the 1,607 victims reported in Q2 2025, the publication rate remained stable though it is still notably higher than the 1,270 victims recorded in Q3 2024 (a 25% increase YoY). Overall, there are approximately 520 to 540 new victims per month, indicating that ransomware activity has plateaued albeit at historically high levels. Figure 1 – Total Number of Reported Ransomware Victims in DLS, per month. Despite the termination of several prominent ransomware groups, the overall number of active threat actors continues to grow, with new ones appearing every month. During Q3 2025, we observed a steady expansion of double-extortion activity, driven mostly by small and emerging operators. Of the 85 data leak sites tracked this quarter, 47 groups published fewer than ten victims, suggesting a growing number of affiliates moving beyond established ransomware-as-a-service (RaaS) programs to conduct attacks independently. This fragmentation follows the closure or dormancy of several major RaaS brands during the year, including RansomHub, 8Base, BianLian, Cactus, and others. In Q3 alone, 14 new groups began publishing victims, bringing the total number of newly observed actors in 2025 to 45. In Q1, the ten most active groups accounted for 71% of all DLS postings. In Q2, their share fell to 63%, and by Q3, to just 56%. These findings illustrate the limited long-term impact of law-enforcement operations on the overall number of ransomware victims. Despite several high-profile takedowns during the past year—most of them directed at large RaaS operations such as LockBit, 8Base, and Blacksuit—the total volume of attacks did not significantly decline. Instead, the attacks continue a gradual upward trend, from an average of approximately 420 victims per month in Q2–Q3 2024 to about 535 per month in the same period of 2025. This limited effect appears to stem from the focus of enforcement efforts: takedown operations primarily target RaaS infrastructure and administrators, which does not affect the affiliate operators who conduct the intrusions and drive the operational execution. When a major RaaS platform is disrupted, these affiliates typically migrate to alternative programs or establish their own data-leak sites, resulting in only short-term interruptions to overall activity levels. The effects of affiliate mobility are evident both in the proliferation of new leak sites and in the rising activity of existing groups. Qilin, the most active actor in Q3 2025—and one of the most aggressive in recruiting former RansomHub affiliates—averaged around 75 victims per month, up from 36 in Q1 prior to RansomHub’s closure in April. INC Ransomware increased its monthly total from 23 to 39 victims, and Play went from 28 to 33 during the same period. This ongoing fragmentation of the ecosystem may further erode ransomware operators’ reliability. Victims traditionally rely on attackers reputation to supply decryption keys after payment. Large RaaS brands have a commercial incentive to maintain credibility and provide the keys, but smaller, short-lived groups do not, leading to reduced payment rates which are currently estimated at 25–40% of total attacks. In this context, the re-centralization of affiliates around major, recognizable brands remains strategically significant. Large RaaS programs preserve their market advantage through stability, reputation, and structured affiliate infrastructure. The re-emergence of LockBit, discussed in the following section, may represent precisely such a re-consolidation of affiliates under a stable and trusted brand identity. Figure 2 – Ransomware Groups by Publicly Claimed Victims – Q3 2025. Qilin, Akira, INC Ransom, Play, and Safepay maintained their positions among the most active groups in Q3. Warlock and The Gentlemen emerged more recently, both demonstrating rapid early activity: Warlock began posting victims in June 2025 and reached 43 total listings in Q3, while The Gentlemen claimed 38 victims during a single month of operation in September 2025. Lockbit 5.0 is here – is LockBit truly back? Until its disruption during Operation Cronos in early 2024, LockBit dominated the RaaS ecosystem, accounting for 20–30% of all published victims. Following the takedown, several arrests were announced, and successor groups — first RansomHub, then Qilin — attempted to inherit its affiliate base. However, the group’s core administrator, known as LockBitSupp, was never apprehended and in underground forums continued to hint at an eventual comeback. The release of LockBit 5.0 in September 2025 marks the group’s return to active operations, reigniting questions about whether the RaaS landscape may again consolidate around this long-standing brand. Figure 3 – LockBit’s share of all DLS-published victims. LockBit had long promised a comeback. In May 2025, following the latest in a series of public setbacks, the group’s administrator, LockBitSupp, responded on the RAMP underground forum, declaring that they would “always rise up after being hacked.” Figure 4 – LockBit administrator vowing to return on the RAMP forum. Figure 5 – LockBit administrator announcing the group’s return on RAMP chat. The XSS Russian-language cybercriminal forum previously banned LockBitSupp following a dispute with another user and reaffirmed that “explicit advertising of RaaS will remain prohibited.” RaaS programs depend on affiliate recruitment for their business model and maintaining visibility on prominent criminal forums such as XSS or RAMP is essential to their work. By early September, the XSS administrator reported that LockBitSupp requested to be reinstated and opened the decision to a community vote. Figure 6 – XSS forum administrator polling members on whether to reinstate LockBitSupp. Despite this effort, the vote ultimately failed, and LockBit remains banned from XSS. Figure 7 – Voting results on LockBitSupp’s proposed return to XSS. In early September 2025, LockBit announced on RAMP the official launch of LockBit 5.0, coinciding with the sixth anniversary of the operation. New affiliates were asked to provide a Bitcoin deposit of roughly US $500 for access to a new encryptor and an updated control panel. Figure 8 – LockBit 5.0 affiliate registration screen. Since that announcement, we identified more than 15 distinct victims affected by LockBit 5.0, which replaced the earlier 4.0 builds that were still active until April 2025. LockBit continues to enforce strict operational security: all affiliate interfaces require individualized credentials, and no victims have been publicly listed on the group’s data-leak site. Figure 9 – LockBit 5.0 ransom note from an attack in mid-September 2025 Updated ransom notes now explicitly identify themselves as “LockBit 5.0” and include a unique personal identifier that allows each victim to access a private negotiation portal. Victims are typically granted a 30-day grace period before the stolen data is published. Figure 10 – Screenshot of LockBit 5.0 negotiations with a victim, mid-September 2025. Analysis of the initial campaign shows that approximately 65 percent of identified attacks targeted organizations in the United States, with the remainder affecting Mexico, Indonesia, and several European countries. LockBit 5.0 represents an upgraded evolution of the previous 4.0 version, incorporating Windows, Linux, and ESXi variants. The new build introduces enhanced evasion and anti-analysis mechanisms, faster encryption routines, and the use of a randomized 16-character file extension to disrupt signature-based detection. Most confirmed infections were deployed on Windows systems, while roughly 20 percent targeted ESXi virtual infrastructure. Historically, LockBit has been among the most active and disruptive RaaS programs. With its extensive experience and the lower entry barrier for new affiliates, the re-emergence of the group poses a renewed risk to organizations across many sectors. The actions observed in September likely represent only the leading edge of a larger campaign, and the October victim postings on LockBit’s data-leak site are expected to confirm its full operational return. DragonForce’s marketing efforts DragonForce distinguishes itself among emerging ransomware groups through its heavy emphasis on public relations and coalition branding, frequently issuing high-profile statements and partnership claims on criminal forums. In September 2025, it announced on RAMP a supposed “coalition” with Qilin and LockBit, presented as a unified affiliate initiative. However, these declarations appear largely symbolic, with no verified evidence of shared infrastructure or joint operations. The announcements likely serve to attract affiliates and project influence within a fragmented RaaS market. This reflects DragonForce’s broader strategy to maintain visibility and credibility in an increasingly competitive underground ecosystem. Figure 11 – DragonForce announcing updates and coalition with LockBit and Qilin. DragonForce roughly tripled its monthly victim count since the shutdown of RansomHub and claimed 56 victims in Q3 2025. This is still fewer than Qilin and Akira but shows steady growth. DragonForce continues to actively recruit affiliates and promote new features in its RaaS program and recently announced on RAMP a data-driven extortion service that offers affiliates tailored analysis of stolen data to maximize ransom leverage. Figure 12 – DragonForce’s “data audit” services. Under this model, an affiliate that accessed a large dataset (typically over 300 GB) from a company with annual revenues above US $15 million can submit it for analysis and maximize the extortion impact. In a recent showcased example, DragonForce reviewed stolen files from a gold mining company and highlighted the most valuable commercial and financial information, accompanied by a customized extortion letter. Figure 13 – DragonForce Audit example. Qilin – The Dominant RaaS Operation of 2025 Qilin remains the most active ransomware group in 2025, increasing its monthly victim rate to an average of 75 victims in Q3, up from 36 in Q1. Although the group presents itself as ideologically motivated, its operations appear entirely financially driven. In a June 2024 interview published on its WikiLeaksV2 blog, Qilin’s operators described themselves as “idealists who love our country.” This statement, however, contrasts sharply with the group’s broad and opportunistic targeting across sectors and geographies. Figure 14 – Qilin interview from June 2024 on their official blog. In a separate interview on SuspectFile, a Qilin affiliate characterized the program as profit-focused and flexible, with affiliates responsible for intrusion and exfiltration while Qilin manages infrastructure, leak-site operations, and negotiations. Reported affiliate share ranges between 80% and 85%, which is among the highest in the market. This has attracted numerous operators previously active under RansomHub and BianLian. Qilin’s open affiliate framework accommodates actors with diverse motivations and capabilities. In one recent case, the group’s data-leak site briefly listed Israel’s Shamir Medical Center among its victims. Figure 15 – Shamir Medical Center announcement on Qilin’s DLS. According to Israeli researcher Erez Dassa, the responsible affiliate was likely an Iranian-linked threat actor. Dassa reported that following direct communication, Qilin’s administrators agreed that public association with terrorism or politically motivated activity could expose the group to additional pressure and subsequently removed the listing. Figure 16- Erez Dassa’s Telegram post explaining the Shamir incident. This incident illustrates the range of motivations operating within large RaaS ecosystems. While affiliates enjoy broad autonomy, Qilin demonstrates a degree of central oversight and reputational management, removing politically sensitive cases that may jeopardize its long-term operations. The group continues to balance open recruitment and strategic control, maintaining its position as a leading and resilient RaaS brand. Geographic Distribution of Victims – Q3 2025 The geographic distribution of ransomware victims in Q3 2025 continues to follow established trends in the global ransomware ecosystem. The United States accounted for roughly half of all reported cases, reaffirming its position as the primary target for financially motivated threat actors. Most publicly listed victims remain concentrated in Western, developed economies, where organizations are perceived as having greater financial resources and a higher likelihood of paying ransom. Figure 14- Publicly Claimed Victims by Countries, Q3 2025. An unusual concentration of attacks in South Korea elevated the country to seventh place on the list of most affected nations this quarter. This spike is linked almost entirely to Qilin, which listed 30 South Korean victims, 28 of them between August and September 2025. Of these, 23 belonged to the financial services sector. While the cause of this focused campaign remains uncertain, the Korea Herald newspaper attributed it to a compromised cloud server operated by an IT contractor serving multiple mid-sized private equity funds. Safepay maintained a strong focus on Germany and the United Kingdom, with each accounting for approximately 10% of its total victims in Q3. Together with INC Ransom, which also recorded 11 British victims, these two groups were the most active in the UK, followed closely by Qilin with 10. Twenty percent of DragonForce’s victims were based in Germany, making it the most active ransomware group in the country. INC Ransom reported a notably high proportion of Canadian victims (8%), the largest share of any group targeting Canadian organizations this quarter. Figure 15- Canadian Victims by Actor, Q3 2025. Ransomware Attacks by Industry – Q3 2025 Analysis The industry distribution of ransomware victims in Q3 2025 shows a consistent cross-sector impact, largely unchanged from previous quarters. Profit-oriented organizations with high downtime costs, such as industrial manufacturing, and those holding sensitive or regulated data, such as business services, remained the most targeted sectors, each representing approximately 10% of all extortion attempts. Healthcare and medical organizations continue to face steady targeting due to the critical nature of their operations and the sensitivity of stored information. Interestingly, threat actors view these victims as high-risk targets because of the attention such incidents attract from law enforcement. In Q2 2025, healthcare accounted for approximately 8% of all publicly listed victims, a figure that remained stable through Q3. While some groups, such as Play Ransomware, appear to enforce an internal policy against attacking healthcare institutions, others such as Qilin, INC Ransomware, and KillSec continue to list healthcare providers among their victims, disregarding the informal ethical boundaries observed by larger RaaS brands. Figure 16 – Ransomware Victims by Industry, Q3 2025. Conclusion The ransomware ecosystem in Q3 2025 remains highly active and structurally fragmented, while at the same time increasingly adaptive. The dissolution of major RaaS programs did not reduce the overall volume of attacks but instead redistributed the load among numerous smaller and more agile actors. Groups such as Qilin and DragonForce have capitalized on this trend, expanding through aggressive affiliate recruitment and service innovation. LockBit’s re-emergence signals a potential trend toward re-centralization around trusted brands. Despite periodic law-enforcement disruptions, the fundamental dynamics of the ransomware market, using affiliate-driven operations, data extortion models, and cross-platform tooling, remain intact. Continued monitoring of affiliate migration patterns and emerging extortion techniques are essential to understanding how this decentralized ecosystem evolves through the remainder of 2025.

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: iOS 26 deletes spyware infection evidence Mobile security firm iVerify reported that Apple’s new iOS 26 is overwriting the ‘shutdown.log’ file on every device reboot. This file is critical as it can hold evidence of Pegasus and Predator spyware infections, and iOS 26 is deleting that potential evidence on every iPhone reboot. “This development poses a serious challenge for forensic investigators and individuals seeking to determine if their devices have been compromised at a time when spyware attacks are becoming more common,” iVerify noted. Critical flaws remain unpatched in EfficientLab employee monitoring software SEC Consult has discovered several vulnerabilities in EfficientLab’s WorkExaminer Professional employee monitoring software, including flaws that can allow an attacker on the network to take control of the system and collect screenshots or keystrokes. SEC Consult says the vulnerabilities have likely not been patched after the vendor told it that they are not in scope of its bug bounty program. The security firm did not receive any further response after informing EfficientLab that the goal was to get the vulnerabilities fixed, not to receive a bug bounty. Scouting America launches AI and cybersecurity merit badges This fall, new merit badges in artificial intelligence (AI) and cybersecurity allow Scouts to build future-ready skills with guidance through the Scouts BSA program. The AI badge is earned not only for the use of AI, but also for learning to spot deepfakes and critical thinking regarding the ethical questions surrounding AI. The cybersecurity badge is earned for learning to identify cyber threats and using security solutions. CrowdStrike publishes APJ cybercrime report CrowdStrike has released its 2025 APJ eCrime Landscape Report, which focuses on the Asia-Pacific and Japan region. The report details how anonymized underground markets such as Huione Guarantee processed over $27 billion in illegal trades, and how AI-enhanced ransomware groups such as KillSec and Funklocker are driving a sharp rise in Big Game Hunting ransomware campaigns. Everest group takes credit for Collins Aerospace hack The Everest ransomware group has listed Collins Aerospace on its website, threatening to leak stolen data unless a ransom is paid. The attack on Collins Aerospace caused significant disruptions at major airports in Europe. Everest claims to have stolen over 50 GB of information, including 1.5 million personal information records. The hackers claim they did not deploy file-encrypting malware on Collins systems. It was previously reported that the attack was linked to an obscure piece of ransomware named HardBit. Maryland launches vulnerability disclosure program Maryland has announced a statewide vulnerability disclosure program (VDP) to make it easier for security researchers to report vulnerabilities in systems owned, operated or managed by the state. Maryland also announced that its Information Sharing and Analysis Center (MD-ISAC) is now open to all state agencies, local governments, critical infrastructure, and industry partners. Warlock ransomware and new ToolShell attacks linked to China The Symantec and Carbon Black Threat Hunter Team has published separate reports on the Warlock ransomware and recent ToolShell attacks, both linked to China. In the case of the ToolShell attacks, the researchers have seen post-patch exploitation against a Middle East telecom firm, multiple African and South American government networks, and a US university. The threat actors behind the Warlock ransomware, which were also caught exploiting ToolShell, are also believed to be based in China and the researchers have found evidence that it may not be a new group, linking it to malicious activity dating as far back as 2019. Ex-L3Harris cyber executive accused of selling secrets to Russia The US Justice Department has unveiled charges against Peter Williams, a former executive of Trenchant, the cyber unit of defense contractor L3Harris, for allegedly stealing trade secrets and selling them to a Russian buyer for $1.3 million. The indictment does not name any of the companies from which data was stolen and it’s unclear who the buyer was. Gamers targeted with red teaming tool and RAT Netskope this week published two reports describing threats targeting gamers. According to the company, a red teaming tool named RedTiger has been used in attacks aimed at gamers and Discord accounts. RedTiger can steal information such as passwords, cookies, download and browsing history, files, cryptocurrency data, Discord data, payment information, and webcam captures. The second report describes a new Python RAT that poses as legitimate Minecraft software. It also enables attackers to steal sensitive information from gamers’ devices. Vast amounts of data exposed to Shadow Escape attack Operant AI researchers have discovered Shadow Escape, a stealthy zero-click attack that affects organizations using MCP with any AI assistant. Shadow Escape exploits the inherent trust in AI agent/MCP connections to secretly exfiltrate vast amounts of sensitive user data from within a network. Because it leverages standard MCP setups and default permissions, the potential scale of data exfiltration is estimated to be massive (in the trillions of records, according to Operant). Related: In Other News: CrowdStrike Vulnerabilities, CISA Layoffs, Mango Data Breach

The ToolShell exploit, affecting on-premises Microsoft SharePoint servers, has driven a rise in threat actors exploiting public-facing applications for initial access. In the last quarter, this tactic appeared in over 60% Cisco Talos Incident Response (Talos IR) engagements, an increase from 10% in the previous quarter. Almost 40% of all engagements involved ToolShell activity, majorly contributing to this tactic’s rise in popularity, Cisco Talos explained in a recent report. The ToolShell exploit chain was first made public in mid-July 2025. The attack sees CVE-2025-53770 and CVE-2025-53771, two critical and high-severity vulnerabilities in internet-facing SharePoint servers, exploited. In July 2025, Microsoft warned that Chinese-based threat groups, Linen Typhoon and Violet Typhoon, were actively targeting the SharePoint vulnerabilities. This is likely part of a strategic campaign to gain initial access to targets across government, defense, academia and NGOs. Active exploitation of the ToolShell vulnerabilities was first observed in the wild on July 18, a day before Microsoft issued its emergency advisory. “Almost all Talos IR engagements responding to ToolShell activity kicked off within the following 10 days,” Cisco explained in its Quarterly Trends report, published on October 23. Network Segmentation Crucial The cybersecurity firm highlighted the need for network segmentation to prevent these attacks enabling threat actors to laterally move within an organization. In one engagement by the Talos IR, the firm said the victim organization was impacted by ToolShell exploitation against a SharePoint server, then experienced a ransomware attack a few weeks later. In the ransomware attack, Talos IR analysis indicated the actors transferred credential stealing malware from the affected public-facing SharePoint server to a SharePoint database server on the victim’s internal network. This, Talos IR said, demonstrates how they leveraged the trusted relationship between the two servers to expand their foothold. Ransomware Remains a Persistent Threat Other findings in the Cisco Talos update showed that ransomware incidents made up around 20% of engagements in the third quarter of 2025, down from 50% in the previous quarter. Talos IR responded to Warlock, Babuk and Kraken ransomware variants for the first time, while also responding to previously seen families Qilin and LockBit. The company responded to a ransomware engagement in Q3 that it assessed with moderate confidence was attributable to the Storm-2603 threat group based on overlapping techniques, tactics and procedures (TTPs), such as the deployment of both LockBit and Warlock ransomware. The Qilin ransomware group were also particularly active, and Cisco Talos said it will very likely continue to be a top ransomware threat through at least the remainder of 2025, pending any disruption or intervention. Image credit: PhotoGranary02 / Shutterstock.com

ToolShell bug used by Chinese attackers against governments in Africa, South America Incident responders have identified breaches at government agencies, telecoms and universities in several countries that began with the ToolShell vulnerability identified in July. Experts at the Symantec and Carbon Black Threat Hunter Team tracked multiple compromises involving CVE-2025-53770 — a vulnerability that caused alarm this summer when Microsoft warned its on-premises SharePoint customers that three separate China-based groups were exploiting it. Hundreds of governments and prominent businesses use SharePoint, particularly for maintaining their intranets. Symantec and Carbon Black said they identified incidents at a telecom company in the Middle East soon after the bug was announced by Microsoft in July. The team subsequently saw two government departments in an African country breached through the bug. The incident responders also found compromises at two government agencies in South America and at a U.S. university. Other evidence “suggests that a state technology agency in an African country, a government department in the Middle East and a finance company in a European country were also compromised by the same attackers,” the team said. Symantec and Carbon Black declined to name the specific countries where each compromise took place. The researchers said they found troves of evidence confirming Microsoft’s initial assessment that Chinese threat actors were heavily exploiting the bug. Familiar malware Once access was gained, hackers used an array of malware previously deployed by Chinese groups, including Zingdoor, ShadowPad, KrustyLoader and more. The researchers found Zingdoor on the networks of three victims. It’s a backdoor previously used by well-known China-based threat actors Famous Sparrow and Earth Estries. The tool allows hackers to collect system information, upload files and take further actions on a compromised network. Google incident responders tied the use of KrustyLoader in April to a Chinese group seen exploiting vulnerabilities in products from IT company Ivanti. The threat actors were also seen using legitimate tools like Sliver, Certutil, GoGo scanner and more during compromises “The large number of apparent victims of this activity is also notable. This may indicate that the attackers were carrying out an element of mass scanning for the ToolShell vulnerability, before then carrying out further activity only on networks of interest,” the Threat Hunter Team said. “The activity carried out on targeted networks indicates that the attackers were interested in stealing credentials and in establishing persistent and stealthy access to victim networks, likely for the purpose of espionage.” Microsoft said in July that two confirmed Chinese state-backed actors — labeled Linen Typhoon and Violet Typhoon — were involved in exploiting the ToolShell bug. Both groups have spent more than a decade conducting espionage attacks and intellectual property theft. Netherlands-based cybersecurity firm Eye Security, which is credited with initially discovering the bug, told Reuters and Bloomberg this summer that threat actors likely used it to breach at least 400 governments and businesses around the world. A Cybersecurity and Infrastructure Security Agency (CISA) official told Recorded Future News in July that federal agencies as well as state entities may have been affected by the campaign. The National Nuclear Security Administration, National Institutes of Health and Department of Homeland Security all confirmed being impacted by the ToolShell campaign. Researchers at ESET said at the time that Chinese government-backed groups were seizing on the bug and the company’s telemetry showed “the victims of the ToolShell attacks include several high-value government organizations that have been long-standing targets of these groups.” Warlock ransomware In July, Microsoft said that in addition to the identified state-backed Chinese actors, a third Chinese group was launching attacks using ToolShell. The previously unidentified threat actor was seen deploying the Warlock ransomware after exploiting CVE-2025-49706. Alongside the analysis of the ToolShell campaign, Symantec and Carbon Black examined the Warlock ransomware, noting that it first appeared in June 2025 and was first used on July 19, 2025. “Warlock is an unusual threat. Unlike many ransomware operations, which are headquartered in Russia or other countries in the Commonwealth of Independent States, Warlock appears to be used by a group based in China. And, while its name is new, its origins appear to date back much further, with links to a diverse range of activity,” the researchers said. The ransomware has experts split on its origins. Data from some attacks indicate it may be a rebrand of the AnyLock ransomware and others found potential ties to LockBit and Black Basta. Some of the tools and tactics used by attackers deploying the Warlock ransomware date back to 2022, suggesting the actors behind it have “been active for a lot longer than previously known.” “Although the toolset used by this group has evolved over time, the links to earlier attacks suggest that some, if not all the actors, behind Warlock may have been active since 2019,” the researchers said. “The diverse range of attacks the group has been involved in suggests they may be contractors, willing to sell their services to entities involved in espionage but also not above generating additional income from ransomware attacks. Indeed, its involvement in ransomware may at times be useful to obfuscate or cover up espionage activities.” Over the last year, U.S. authorities have made a concerted effort to outline the large web of private companies hired by the Chinese government to conduct cyberattacks in other countries. Multiple companies have warned that Chinese actors deployed ransomware as a cover for espionage activity or data theft. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Threat actors with ties to China exploited the ToolShell security vulnerability in Microsoft SharePoint to breach a telecommunications company in the Middle East after it was publicly disclosed and patched in July 2025. Also targeted were government departments in an African country, as well as government agencies in South America, a university in the U.S., as well as likely a state technology agency in an African country, a government department in the Middle East, and a finance company in a European country. According to Broadcom's Symantec Threat Hunter Team, the attacks involved the exploitation of CVE-2025-53770, a now-patched security flaw in on-premise SharePoint servers that could be used to bypass authentication and achieve remote code execution. CVE-2025-53770, assessed to be a patch bypass for CVE-2025-49704 and CVE-2025-49706, has been weaponized as a zero-day by three Chinese threat groups, including Linen Typhoon (aka Budworm), Violet Typhoon (aka Sheathminer), and Storm-2603, the latter of which is linked to the deployment of Warlock, LockBit, and Babuk ransomware families in recent months. However, the latest findings from Symantec indicate that a much wider range of Chinese threat actors have abused the vulnerability. This includes the Salt Typhoon (aka Glowworm) hacking group, which is said to have leveraged the ToolShell flaw to deploy tools like Zingdoor, ShadowPad, and KrustyLoader against the telecom entity and the two government bodies in Africa. KrustyLoader, first detailed by Synacktiv in January 2024, is a Rust-based loader previously put to use by a China-nexus espionage group dubbed UNC5221 in attacks exploiting flaws in Ivanti Endpoint Manager Mobile (EPMM) and SAP NetWeaver. The attacks aimed at government agencies in South America and a university in the U.S., on the other hand, involved the use of unspecified vulnerabilities to obtain initial access, followed by the exploitation of SQL servers and Apache HTTP servers running the Adobe ColdFusion software to deliver the malicious payloads using DLL side-loading techniques. In some of the incidents, the attackers have been observed executing an exploit for CVE-2021-36942 (aka PetitPotam) for privilege escalation and domain compromise, along with a number of readily available and living-off-the-land (LotL) tools to facilitate scanning, file download, and credential theft on the infected systems. "There is some overlap in the types of victims and some of the tools used between this activity and activity previously attributed to Glowworm," Symantec said. "However, we do not have sufficient evidence to conclusively attribute this activity to one specific group, though we can say that all evidence points to those behind it being China-based threat actors." "The activity carried out on targeted networks indicates that the attackers were interested in stealing credentials and in establishing persistent and stealthy access to victim networks, likely for the purpose of espionage."

Hackers believed to be associated with China have leveraged the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint in attacks targeting government agencies, universities, telecommunication service providers, and finance organizations. The security flaw affects on-premise SharePoint servers and was disclosed as an actively exploited zero-day on July 20, after multiple hacking groups tied to China leveraged it in widespread attacks. Microsoft released emergency updates the following day. The issue is a bypass for CVE-2025-49706 and CVE-2025-49704, two flaws that Viettel Cyber Security researchers had demonstrated at the Pwn2Own Berlin hacking competition in May, and can be leveraged remotely without authentication for code execution and full access to the file system. Microsoft previously said that ToolShell was exploited by three Chinese threat groups, Budworm/Linen Typhoon, Sheathminer/Violet Typhoon, and Storm-2603/Warlock ransomware. In a report today, cybersecurity company Symantec, part of Broadcom, says that ToolShell was used to compromise various organizations in the Middle East, South America, the U.S., and Africa, and the campaigns leveraged malware typically associated with the Salt Typhoon Chinese hackers: A telecommunications service provider in the Middle East Two government departments in an African country Two government agencies in South America A university in the United States A state technology agency in Africa A Middle Eastern government department A European finance company The activity on the telecommunications firm, which is the focus of Symantec’s report, started on July 21 with CVE-2025-53770 being exploited to plant webshells that enable persistent access. This was followed by DLL side-loading a Go-based backdoor named Zingdoor, which can collect system info, perform file operations, and also facilitate remote command execution. Then, another side-loading step launched "what appears to be the ShadowPad Trojan," the researchers said, adding that the action was followed by dropping the Rust-based KrustyLoader tool, which eventually deployed the Sliver open-source post-exploitation framework. Notably, the side-loading steps were conducted using legitimate Trend Micro and BitDefender executables. For the attacks in South America, the threat actors used a file resembling Symantec’s name. Next, the attackers proceeded to perform credential dumping via ProcDump, Minidump, and LsassDumper, and leveraged PetitPotam (CVE-2021-36942) for domain compromise. The researchers note that the list of publicly available and living-off-the-land tools used in the attacks included Certutil utility from Microsoft, the GoGo Scanner (a red-team scanning engine), and the Revsocks utility that allows data exfiltration, command-and-control, and persistence on the compromised device. Symantec says that its findings indicate that the ToolShell vulnerability was exploited by a larger set of Chinese threat actors than was previously known. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report