Netmon Information Systems Ltd. - Blog ##Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMonNetmon Information Systems Ltd. - Blog ##Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMonhttps://www.netmon.asia/blogs/tag/bitdefender-bitdefender-threat-debrief-cybersecurity-ransomware-attacks-cybercriminals-netmonWed, 25 Mar 2026 08:33:00 -0700http://zoho.com/sites/<![CDATA[Bitdefender Threat Debrief | March 2026]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-march-2026
Ransomware Group AtomSilo Returns After 5 Year Absence
This edition of the Bitdefender Threat Debrief covers several developments in the threat landscape, including the reemergence of AtomSIlo, a surge in 0APT’s claimed attacks, a threat emerging as tensions in the Iran war escalate, and more.
As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time. 
For this month's report, we analyzed data from February 1 to February 28 and recorded a total of 1,194 claimed ransomware victims. Overall, the number of claimed attacks surged 43% compared to last month. This surge primarily reflects increased reports of 0APT victims that may not exist.
0APT claimed 458 victims in February, a significant leap from the 91 victims they claimed in January. However, their claims, as reported in the January Threat Debrief, are likely false and inflated due to a combination of factors: poor telemetry, filtering, and likely a “fake it until you make it” mentality. These numbers should not be considered accurate representations of the legitimate number of ransomware victims. Therefore, we do not believe that the total number of victims claimed in February 2026 (1,194) is a record. Instead, February 2025 remains ransomware’s biggest all-time month, with 1,079 legitimate victims (chart, above).
Featured Story: Ransomware Group AtomSilo Returns After 5 Year Absence
What Happened?
The AtomSilo ransomware group went dormant in 2021 and suddenly reappeared in February 2026. But is this revitalized iteration of AtomSilo connected to its 2021 predecessor?
AtomSilo Background
Before AtomSilo went dormant, we learned several things about the group. For one thing, its pattern of activity was linked to another state-sponsored adversary affiliated with China. The adversary, Cinnamon Tempest (or Bronze Starlight), was also active in 2021 and was known for exploiting CVEs to gain access to vulnerable systems, execute malware, and conduct espionage.
It’s likely AtomSilo descended from Cinnamon Tempest, and both threat actors were known to deploy ransomware and increase their profits via extortion. Their motives also align with nation-state APT motives, with attacks focused on reconnaissance and counterintelligence efforts.
AtomSilo’s re-emergence after five years is rare compared with other ransomware groups. It is far more common for ransomware groups to dissolve or rebrand within one to two years. As examples, consider former groups like Hive and Royal.
The Hive ransomware group emerged in early 2021 and rebranded to Hunter’s International in 2023 following the FBI’s seizure of their infrastructure. Less than a year and a half later, Hunter’s International rebranded to World Leaks, prioritizing data theft and data extortion over the use of encryptors to lock down systems.
Royal originally appeared under the moniker Zeon in early 2022. The group officially rebranded to Royal later that year. Then, in the second half of 2023, a group known as BlackSuit ransomware became active. More than a year later, Royal and BlackSuit ransomware were confirmed as variants within the same ransomware family, with some operators from the former Royal group sticking around for BlackSuit’s operations. In July 2025, a joint law enforcement investigation known as Operation Checkmate, culminated in the seizure of the BlackSuit site. However, this was not a long-term deterrent for BlackSuit, who rebranded under the name Chaos with some of their operations already in play prior to the 2025 law enforcement takedown.
Why do most ransomware groups re-invent themselves more quickly than AtomSilo did? It’s because a ransomware group’s long-term success often depends on affiliate relationships. Most affiliates or connected partners will not wait two or three years (or more) to regroup. Instead, they will jump ship to other leading groups.
There is also the issue of a ransomware group’s staff. Most groups that vanish for five years would face difficult challenges in rebuilding their brand and securing new staff. However, it’s worth noting that state-sponsored or affiliated groups are far more likely to receive help and resources to restart the business and grow their ranks, regardless of the group’s year-in, year-out profits.
What's Next?
Groups in a position like AtomSIlo face some heavy burdens. They reenter the ransomware ecosystem, where they face intense competition and typically must evolve their tactics. At the time of this release, AtomSilo has claimed a couple of victims based in Brazil and one victim based in Japan.
There is also an anomaly that raises more questions about AtomSilo’s motives and capabilities. The group recently claimed a victim named A large bank in Asia. This tactic of refusing to name their victim directly could be a decision made to negotiate a ransom payment, or the claim could be fake. At this time, additional information on AtomSilo’s current tactics remains limited. However, given the group’s history and affiliation as a state-sponsored threat, AtomSilo’s activity could experience significant developments as they organize targeted espionage campaigns under the guise of a ransomware operation.
In the past year, there have also been increasing instances of ransomware groups modeling Advanced Persistent Threat or APT-like behavior by using techniques that differ from the common ransomware playbook. Extending the time they dwell within a victim’s environment is one example. This is not the only trend that has resurfaced; in the past year, some ransomware groups and syndicates have coordinated attacks with resources from nation-state APTs, with the most notable instances being ShinyHunters’ operations in August 2025 and Qilin’s Korean Leaks campaign supported by a North Korean threat actor.
While ransomware groups across the board tend to be financially motivated and have a pattern of attack that differs from APT’s, it’s important for organizations to recognize that a blending of these entities and their attacks may also occur. As a result, we recommend staying informed about ransomware and APT threat actors.
Proactive measures that may be taken to limit the likelihood of a successful attack, from either threat, include regularly collecting and reviewing threat intelligence on threat actor TTPs, reducing your attack surface, and monitoring network traffic for unusual activity. Furthermore, logging and retaining a wide range of security events to investigate an intrusion is critical alongside maintaining a rapid response capability equipped to isolate compromised assets and block malicious activities.
Other Notable Ransomware News
Now, let’s explore the notable news and findings since the last Threat Debrief.
The Gentlemen Surpasses Akira in the Top 10 Groups: In February, the ransomware group The Gentlemen claimed 88 victims, which was a stark increase from the 41victims they claimed in January. The group targets numerous industries; however, many of their victims from February were in the manufacturing, transportation, technology, and construction industries. The Gentlemen also claimed half of Thailand’s ransomware victims in February. Taking an aggressive approach to stealth, the group employs Bring Your Own Vulnerable Driver (BYOVD) tactics, including the use of the legitimate driver ThrottleStop.sys to kill EDR and anti-virus processes. Understanding how similar BYOVD attacks work is crucial to determining how to protect vulnerable systems. The Gentlemen has also implemented a strategic approach to purging artifacts, removing select data from Windows Defender logs, RDP logs, and Prefetch files.
The Iranian Conflict Galvanizes a Ransomware Group with Hacktivist Aims: The ransomware group BQTLock, also known as BaqiyatLock, is building their presence in the RaaS (ransomware as a service) ecosystem. At the end of January, the group posted an offer to provide their RaaS platform for free to hacktivists interested in contributing to their cause. BQTLock’s political attitude leans towards an ideology that supports Iranian and Palestinian interests. The group has attacked organizations in the United States and the United Arab Emirates, claiming victims in the technology and government sectors. This type of victimology indicates that they’re not primarily concerned with profits but instead are focused on executing campaigns designed to disrupt the US government ecosystem, and take down organizations based in the United Arab Emirates and other opposing regions like Israel.
ShadowByt3$ Twists the Narrative for the Ransomware Business Model: ShadowByt3$ emerged at the beginning of the year and is now reaching out for new recruits with penetration testing experience. The group describes themselves as a Wiper as a Service (WaaS) operation that does not execute ransomware. Based on their comments, it’s instead understood that the group operates by infiltrating an organization, stealing data, and then wiping or threatening to wipe it if the victim does not submit payment. This sabotage strategy underscores the importance of maintaining regular backups, kept isolated from critical environments. While other groups, such as Anubis and NightSpire, have incorporated malware with wiping modules into their campaigns, this designation of a threat as a WaaS group is unique.
Europol Announces the Takedown of the Stronghold LeakBase: LeakBase, a highly popular dark web forum dedicated to sharing infostealers, leaked databases, and other sensitive data, was taken down in a joint effort led by Europol, the  FBI and other law enforcement agencies. The fall of LeakBase, which had more than 140,000 users, is a pivotal moment in the fight against cybercrime that occurred just after another landmark event: the seizure of RAMP. Both takedowns leave a rift in the criminal ecosystem, with some cybercriminals moving to other reputable platforms with a rich history and strong userbase for ransomware and hacking groups such as XSS. More ransomware groups are also flocking to Telegram and Signal communities.
Ransomware Groups Exploit a Critical BeyondTrust Vulnerability: CVE-2026-1731 is a vulnerability that allows unauthenticated attackers to perform remote code execution. The vulnerability affects Remote Support (RS) versions 25.3.1 and older and Privileged Remote Access (PRS) versions 24.3.4 and older. Organizations using BeyondTrust to facilitate remote support and other privileged remote access activities are advised to apply the RS patch BT26-02-RS and the PRS patch BT26-02-PRA and ensure that both products are current.
Scammer Masquerading as Russian intelligence Officer Outwits Conti: A report from a Russian news outlet revealed an interesting reversal of roles. During September 2022, Ruslan Satuchin, a Russian nationalist, posed as a Federal Security Service (FSB) officer. Satuchin was able to acquire contacts in the aftermath of the Conti Leaks matter, where an insider leaked Conti chats and identities. He then contacted Conti staff and offered them protection from the Russian government he said was investigating them, in exchange for money. Satuchin was detained by Russian law enforcement in October 2025. He was recently charged and is waiting for a trial date. Satuchin faces a prison sentence of ten years for impersonating an FSB officer; a $13,000 fine is also associated with his offense.
Top 10 Ransomware Families
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method captures the number of victims claimed, not the actual financial impact of these attacks. Here are the Top 10 ransomware groups.
Top 10 Most Attacked Regions
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. In many cases, this means focusing on developed countries with higher projected growth rates. Threat actors may also execute strategic attacks that unfold during geopolitical conflicts or periods of social unrest. Let’s see the top 10 regions that took the biggest hit from ransomware attacks.
Top 10 Most Attacked Industries
Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to consumers, or attack organizations that fall into both categories. Understanding the trends and ramifications of specific industries , and how specialized services and clientele are affected, is crucial for assessing risk. Here are the Top 10 industries affected by ransomware attacks.
Note: The Top 10 Industries Most Affected by Ransomware graphic (above) includes significant increases, highlighted in February, that show changes in several industries impacted by ransomware. These increases are most apparent, particularly in the manufacturing, healthcare, and government industries. It’s important to note that the 0APT ransomware group accounted for these increases.
Data on targeted industries must be assessed with great scrutiny as a result. While the manufacturing industry would persist as a top industry affected by ransomware, regardless of the victims claimed by 0APT, it's likely that the government sector ranked below the top 10. It typically ranks 12 or 13 on the list of most attacked industries, however, the 0APT group has skewed these results.
MDR Threat Insights
Threat trends shift quickly, and the Bitdefender MDR (managed detection and response) team sees them in real time. The following insights consolidate key findings captured from real-world incidents.
In February 2026, our MDR teams found that hallmarks of threat actor activity included:
- A focus on identity-first compromise, including the theft of VPN credentials
- Remote registry hive access
- The use and installation of legitimate RMM tools for persistence
- Firewall and RDP enablement modifications
- Fileless attacks and in-memory code execution
The MDR team also raised an important point this month: an increasing number of incidents do not involve malware. Attackers are increasingly leveraging legitimate admin tools and operating quietly.
The Bitdefender MDR + EDR technology:
- Detects and interrupts domain-level compromise before it becomes an outage
- Detects the malicious use of trusted tools
Explore the power of MDR and read the Bitdefender Ransomware white paper (frequently updated) for more information on protecting against ransomware.
About Bitdefender Threat Debrief
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on Twitter. You can find all previous debriefs here.
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 200 technology brands license Bitdefender technology as part of their product or service offerings. This vast OEM ecosystem complements the telemetry data already collected from Bitdefender business and consumer solutions. Overall, Bitdefender Labs discovers more than 1,000 new cyberthreats each minute and validates 50 billion threat queries each day. This gives us one of the industry’s most extensive real-time views of the threat landscape.
We would like to thank Bitdefenders Stefan Hanu, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Nikki Salas for their help with putting this report together.  
Read More
https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-march-2026 
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
]]>Wed, 11 Mar 2026 10:14:11 +0000<![CDATA[Bitdefender Threat Debrief | February 2026 ]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-february-2026
The 0APT Ransomware Hoax: A New Threat Sounds a False Alarm
This edition of the Bitdefender Threat Debrief covers the latest developments in the threat landscape, including the rising group 0APT, the Notepad++ compromise, a recent healthcare breach, and more.
As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time.
For this month's report, we analyzed data from January 1 to January 31 and recorded a total of 831 claimed ransomware victims. This is a growth rate of nearly 10% compared to the victims claimed in January 2025.
Featured Story: The 0APT Ransomware Hoax: A New Threat Sounds a False Alarm
What Happened?
0APT is a ransomware group that was unheard of before 2026. We’ve now tracked a significant spike in the group's activity as published victims rapidly piled up. In fact, 0APT claimed a total of 91 victims in just two days, with the majority of their victims falling into the transportation, technology, and financial services industries. The number of victims claimed far exceeds the total anticipated for not only an emerging ransomware group, but also for a leading ransomware group like Qilin. Even under the best circumstances, at the peak of their operations, Qilin could claim 24+ victims in one day. When considering these aspects, 0APT's bold entry into the threat landscape appears highly suspicious and perhaps baseless. At the time of this release, 0APT's victims reported thus far in February have also climbed within the first week to allegedly reach 90+ victims.
Is 0APT an APT or Ransomware Group?
Currently, there is no evidence to support that 0APT is an advanced persistent threat (APT). 0APT markets themselves as a ransomware group and lists a RaaS program page on their data leak site, encouraging interested penetration testers to apply for access. However, there is something unusual here: the cost to join the alleged RaaS is free, which creates further suspicion. RaaS programs tend to have an entry fee, and some groups set this price based on a subscription model whereas others have a fixed price. Visitors who wish to apply are redirected to a secure channel to start a chat with an admin.
Figure 1: Messaging on the 0APT data leak site that promotes free membership.
0APT describes themselves as “a politically neutral underground syndicate,” which in spite of any hidden motives, clashes with the geopolitical motivations often associated with advanced persistent threats. 
Interestingly, 0APT's posts include not just threats to leak victim data, but also repeated, overt language targeted towards discrediting the integrity of victim organizations, typically claiming they’ve violated some ethical boundary or guidance surrounding data protection.
The group offers victims who contact them to submit payment, a decryptor, and an agreement to delete the stolen files. However, this aspect should be assessed with great caution as no decryption tool may exist to begin with; the victims claimed are unsubstantiated, and there's little evidence to support that a working, tested decryptor is available. There are also no screenshots or video recordings listed, which demonstrate the effectiveness of such a tool, a practice which has been observed with several ransomware groups.
What's the Catalyst for These Significant Victim Claims?
In the past, Bitdefender Labs tracked multiple catalysts for rising victim claims, including revictimization, scraping an organization's data from open-source sites, and simply put: ransom via scare tactics (when a threat actor states they have access but have not yet infiltrated an environment).
However, the most likely explanation for 0APT’s sudden uptick in ransomware victims per day points to inaccurate polling of infections from sandbox environments. Sandboxing is a technique that allows defenders and researchers to load malware in an isolated environment to analyze the sample and determine how it behaves in real time without putting other systems at risk. Once executed, the malware may call back to the attacker's infrastructure, flagging that it has in fact been executed to infect a host, even though the target system is not an actual victim, but a clean environment set up to perform testing and analysis.
Is This Just a Mishap or a Timely Recruitment Strategy?
0APT's claimed victims continue to rise, making some researchers deem 0APT's actions intentional and rather pompous; their aim might be to gain more exposure and fame. This strategy, however, is a foolish endeavor. Any incompetencies linked to a threat actor can position them for failure and even disbandment as they could become a future target for larger threat groups wishing to eliminate them from the ecosystem entirely.
Trust and evidence of a group’s capabilities are essential when establishing partnerships. Zero times zero is still zero. If many of the reported 0APT victims are false victims, then there's still nothing gained and the burden lies on 0APT to prove themselves in the near future if they wish for other threat actors making a name for themselves to join their ranks.
It is advised that organizations added as published victims evaluate claims of a 0APT compromise with caution and assess their digital footprint for potential data exposure as well as the environment their security teams manage for security research and analysis to identify and correct any gaps in need of remediation.
Other Notable Ransomware News
Now, let's explore the notable news and findings since the last Threat Debrief.
Clop returns to the Top 10 Groups:
Clop claimed 90 victims in January, claiming their third largest number of victims claimed per month to date. Nearly half of their victims were comprised of organizations from the construction, technology, and financial services industries. The ransomware group is known for executing campaigns that leverage the timely exploitation of zero-day vulnerabilities. As a result, organizations are encouraged to adopt a proactive, structured approach to patch management and vulnerability treatment practices.
RAMP falls after FBI-led takedown:
RAMP infrastructure is no longer active following a joint law enforcement investigation. The RAMP forum, over four years old, was instrumental in allowing Russian networks to communicate and grow their ransomware operations. Now that RAMP has suffered the same fate as its predecessors, the XSS and Exploit forums, more questions have been raised surrounding its potential replacement or an evolution of the forum that may emerge in the near future. As law enforcement efforts to crack down on ransomware operations ramp up, OPSEC and defense evasion persist as critical parts of the cybercrime equation that can either make or break career criminals.
Critical Notepad++ software updates are compromised:
Recent reports establish that a threat actor has leveraged the compromise of Notepad++ to attack organizations in Asia and Central America. The threat actor, likely a state-sponsored group aligned with Chinese interests, executes these exploitation attempts to gain access to victim systems, conduct espionage, and deploy malware that disrupts business operations. The Notepad++ compromise may date back to June 2025, impacting versions of the software that precede version 8.9.1. Organizations using Notepad++ are advised to update it to the latest release. It's strongly advised that these organizations enable firewall and IDS logging and implement auditing measures to monitor and assess Notepad++ activity. Bitdefender's threat researchers and MDR teams regularly update GravityZone endpoint detection based on current and newly discovered signatures.
FulCrumSec claims responsibility for major healthcare breach:
FulCrumSec is a ransomware group focused on data extortion. The group was involved in leaking data from multiple victims around December 2025. FulCrumSec claims that a recent healthcare breach is one of “the most disturbing we've encountered, impacting 160,000+ ID-linked individuals and close to a million exposed patients.” The data leak resulted in the exposure of patient data, including photos documenting treatment, PII, and patient diagnoses. According to FulCrumSec, security flaws, including a failure to secure configuration files linked to hubs where patient data was stored and a lack of encryption, shaped the opportunity to attack. At the time of this release, FulCrumSec has claimed a total of 15 victims.
Nitrogen ransomware faces decryption challenge:
Nitrogen was recently exposed for a reported error in the decryption tool they provide to victims to reverse the encryption process. The error results from the use of a faulty public key derived from an overwriting process instead of a private key. The public key is generated for encryption that is performed on ESXi hosts. Once encrypted, victim files cannot be decrypted with the Nitrogen decryptor that references an invalid public key. Nitrogen's blunder underscores a vital lesson: Ransomware groups cannot be trusted. Do not pay for decryptors. These criminals are not bound to ethics or some moral code. There's no guarantee that a group will refuse to leak your sensitive data once they’re paid. And, the group may not even have the appropriate tools to reverse the damage done.
Top 10 Ransomware Families
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. Here are the Top 10 ransomware groups.
Top 10 Most Attacked Regions
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. In many cases, this means focusing on developed countries with higher projected growth rates. Threat actors may also execute strategic attacks that unfold during geopolitical conflicts or periods of social unrest.
Taiwan and Malaysia joined the Top 10 Regions in January, surpassing Asian regions previously represented in the Top 10, such as Japan and Singapore. The ransomware groups Qilin and The Gentlemen targeted both Taiwan and Malaysia. And, Direwolf claimed multiple victims in Malaysia. The majority of the affected victims in Taiwan and Malaysia were organizations in the manufacturing industry. Here are the top 10 regions that took the biggest hit from ransomware attacks.
Top 10 Most Attacked Industries
Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to consumers, or attack organizations that fall into both categories. Understanding the trends and ramifications associated with specific industries, and how specialized services and clientele are impacted is crucial for assessing risk. Here are the Top 10 industries affected by ransomware attacks.
MDR Ransomware Insights
Bitdefender's MDR Insights consolidates key findings each month captured from real-world incidents.
In January 2026, our MDR teams found that threat actor activity:
Reinforces a clear reality:
Modern ransomware is credential-led and tool-driven. Most critical attacks aren't “malware-first" anymore—they're credential-first. MDR detects and intercepts credential dumping and privilege escalation before domain-wide compromises.
Bitdefender MDR + EDR technology: 
Detects and interrupts credential dumping and privilege escalation before domain-wide compromises. And MDR also detects the other behaviors attackers rely on—lateral movement, remote tool abuse, and ransomware staging. 
Visit MDR and read the Bitdefender Ransomware white paper for more information on how to protect against ransomware.
About Bitdefender Threat Debrief
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on X. You can find all previous debriefs here. 
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed Bitdefender technology and added it to their product or service offerings. This vast OEM ecosystem complements telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discover 400+ new threats each minute and validate 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape. 
We would like to thank Bitdefenders Stefan Hanu, Mihai Leonte, Gabriel Macovei, and Andrei Mogage for their help putting this report together.  
Read More
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
]]>Wed, 25 Feb 2026 08:59:54 +0000<![CDATA[Bitdefender Threat Debrief | January 2026]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-january-2026
LockBit Is Back! 
This edition of the Bitdefender Threat Debrief covers the latest developments in the ransomware threat landscape, including an update on LockBit’s move to the Top 10, the Coinbase Cartel’s recent activities, a thwarted BreachForums comeback, and more. 
As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time.
For this month's report, we analyzed data from December 1 to December 31 and recorded a total of 839 claimed ransomware victims, which was the second largest number of claimed victims of any month in 2025.
Featured Story: LockBit is Back 
What Happened? 
LockBit returned to the list of Top 10 Ransomware Groups in December, claiming 112 victims. This was a significant milestone for LockBit, which suddenly fell from the Top 10 list in October 2024 and failed to claim any victims at all from June to November 2025. This period of inactivity may be due to changes in infrastructure or allowing time to expand the internal team and affiliate network.
The group’s victims were hit with the LockBit5 ransomware variant, and the main industry targets in December included manufacturing, technology, and construction. The group also targeted other industries like transportation, financial services, and healthcare.
LockBit’s Reputation Roller Coaster
LockBit’s reputation has been both up and down over the years. It took a significant hit following Operation Cronos, which disrupted the group’s operations in 2024. LockBit tried to rebuild its reputation by announcing a 2025 collaboration with the Qilin and DragonForce ransomware groups. However, this may have been more talk than action, and many security researchers remain skeptical that this was a legitimate ransomware alliance amongst the three groups.
And while ransomware groups frequently compromise organizations, they are sometimes targeted themselves, and LockBit is no exception. Details on LockBit’s infrastructure, including their domains and an IP address, have already been leaked. That’s why some security researchers are questioning the longevity of the group’s return and the effectiveness of their operations, which are marked by a history of OPSEC (operational security) deficits. 
One helpful development for defenders is that one of the tools  LockBit incorporates into its attacks has been identified. The tool, SmokeLoader,  has been used by groups like Qilin and ALPHV for several years. This suggests that LockBit lacks the resources needed to incorporate (and develop) a broader range of toolsets into attacks.
What Aspects of LockBit5's Activity Are Most Concerning to Organizations? 
Like other ransomware, LockBit5 has iterations to use against different hosts, including Windows, Linux, and VMware ESXi servers. As groups such as LockBit continue to prioritize hypervisors specifically, it is important to ensure that security practices to protect against such threat actors are implemented. The most essential practices include updating hypervisor and related management platforms, implementing a tested, quality backup and recovery plan, and adopting an attack surface reduction solution to identify and mitigate threats as they move across the environment in real time. 
Other Notable Ransomware News 
Now, let’s explore some other notable news and findings since the last Threat Debrief. 
Qilin’s Claimed Victims Decline After Korean Leaks Campaign
Qilin claimed 183 victims in December, more than any active group for the month. While the ransomware group’s greatest victim population has been organizations based in the United States, over the last few months , Qilin's breaches targeted organizations based in East and Southeast Asia. In December, both Malaysia and the Philippines were among the Southeast Asia regions affected by Qilin's attacks. 
Clop Falls from the Top 10 Groups
While Clop claimed 14 victims in October and 98 victims in November, the group had a rapid decline in activity in December, claiming only one victim. This could indicate a break, or perhaps the group is prioritizing recruitment efforts or vulnerability research initiatives before launching a new campaign. Clop had a similar pattern of reduced activity from April to August 2025 following the group’s record-breaking surge in attacks which totaled over 300 victims in March. 
Coinbase Cartel Strikes United Arab Emirates Healthcare Organizations
Coinbase Cartel, a ransomware group initially known for their focus on data theft and data brokering, claimed 11 healthcare victims in December, which represented 50% of their victim demographic. Healthcare continues to be a targeted industry due to its critical services, interactions with multiple sensitive datasets, and common use of legacy or vulnerable systems in various fleets that may interact with the network, IoT devices, and other medical equipment. 
Orion Claims LockBit Victims and Publishes Their Leaks
Orion, also known as Orion Leaks, is a group that emerged in the shadow of LockBit’s recent Top 10 milestone. When examining Orion’s data leak site, it’s apparent that they are listing the same victims associated with LockBit as well as LockBit’s leaks. This strategy of claiming victims from attacks orchestrated by other ransomware groups was observed in early 2025 with the group Bjorka, making plausible the theory that Bjorka was rebranding or evolving.
BreachForums Revival and Disruption
BreachForums, a site marketed to cybercriminals to acquire goods and purchase hacking and other services, dates back to 2023. Earlier this year, law enforcement seized two iterations of the BreachForums site: one in June and another in October. Both were associated with ShinyHunters, particularly the collective Scattered LAPSUS$ Hunters. The site that emerged in December is likely a version of a past instance. However, ShinyHunters recently leaked a BreachForums database file containing the names of thousands of users registered on the forums and unique IP addresses associated with users. The leaked data shared on a ShinyHunters site was posted by the user James. This compromise shows the struggle and competing forces at play between BreachForum’s current staff and the ShinyHunters group to determine who will manage future infrastructure.
BBQLL Ransomware Group Recruits Affiliates
BBQLL is a ransomware group that is actively seeking out those with experience in AD (Active Directory) penetration testing, cloud penetration testing, and container penetration testing to join their operations. The group is offering affiliates 90% of profits and boasts features such as tooling written in Rust, a self-deleting executable, swift encryption, and support for BYOVD attacks. BBQLL has even offered affiliate candidates the opportunity to submit their interest and contact information for the chance to trial its RaaS platform. These claims from a lesser-known ransomware group are striking and likely indicate that we’ll be hearing much more about this group’s victims in the future.
Top 10 Ransomware Families 
Here are the top 10 most active ransomware groups:
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. 
 Top 10 Most Attacked Countries 
Here are the top 10 countries where ransomware groups victimized organizations:
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. In many cases, this means focusing on developed countries with higher projected growth rates. Threat actors may also execute strategic attacks that unfold during geopolitical conflicts or periods of social unrest. 
Top 10 Most Attacked Industries
Here are the Top 10 industries affected by ransomware attacks. Manufacturing was hardest hit:
Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to consumers, or attack organizations that fall into both categories. Understanding the trends and ramifications associated with specific industries, and how specialized services and clientele are impacted is crucial for assessing risk. 
About Bitdefender Threat Debrief
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on X.. You can find all previous debriefs here. 
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed Bitdefender technology and added it to their product or service offerings. This vast OEM ecosystem complements telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discover 400+ new threats each minute and validate 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape. 
We would like to thank Bitdefenders Stefan Hanu, Mihai Leonte, Gabriel Macovei, and Andrei Mogage for their help putting this report together.  
Read More
https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-january-2026
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
]]>Tue, 27 Jan 2026 09:59:04 +0000<![CDATA[Bitdefender Threat Debrief | December 2025]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-december-2025
Growing RaaS Partners and Affiliates Spark Divide on Perceived Connections 
This edition of the Bitdefender Threat Debrief features key events, including updates on RaaS alliances, Qilin’s activity following Korean Leaks, the React2Shell vulnerability, Akria’s potential targets, and more. 
As ransomware continues to evolve, our goal with the monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time. 
For this month's report, we analyzed data from November 1 to November 30 and recorded a total of 717 claimed ransomware victims. 
Featured Story: Growing RaaS Partners and Affiliates Spark Divide on Perceived Connections 
What happened?
From October through December, several ransomware groups announced new alliances. One of those alleged alliances emerged between Stormous, Devman, Coinbase Cartel, Nova, Radar, Desolator and Kryptos. In October Stormous posted about version 5 of their RaaS and a strategic partnership with the six groups. However, many in the research community questioned the validity of this alliance due to the number of groups involved, clashes in operational models, and the lack of communication that followed the announcement. There was no confirmation of mutual involvement or agreement between these groups. 
Leaker Exposes Nova Ransomware Group Data
Another recent ransomware ecosystem development involves Nova, a group that launched their own RaaS, and sought out affiliate recruits this past summer. Another group exposed Nova’s inner workings in early December. A group named CBSecurity leaked the names and roles associated with Nova staff and multiple IP addresses tied to their infrastructure. 
There’s a high likelihood that this exposure was orchestrated by an angry Nova affiliate or a competitor. According to one source, some with ties to Nova’s may have been upset that the group targeted victims in education along with non-profits. This is a possible variable used to justify exposing the group. Our threat researchers are monitoring the situation to see if additional leaks occur in the days ahead. 
Ransomware Groups Developing Insider Threats at Organizations 
An additional development that shows a change in how ransomware groups are operating is the gradual shift in the types of ranks that are incorporated into the cybercriminal hierarchy. Ransomware groups are moving beyond a reliance on the ranks of external software developers, penetration testers, and initial access brokers. An increasing number of groups are now developing in-house expertise and creating and managing their own RaaS platforms. 
They’re also expanding recruitment efforts to reach employees at target organizations. This is evident with the group Kryptos, who encouraged corporate insiders to join the Kryptos initiative. Kryptos defined a system and a tiered approach to profit-sharing that insiders can benefit from. This expands beyond the traditional 85-90% profit margin we’ve observed in more typical RaaS models. 
Kryptos’ multi-tiered system for insiders at their target organizations invites IT admins, executive assistants, and third-party vendors to give away access to corporate networks via VPN, MFA, SSH, etc. The payoff for those willing to become an insider threat runs from thousands of dollars all the way up to millions of dollars. Organizations should be aware that ransomware operators are increasingly trying to recruit their employees to increase the odds of a successful attack. This approach removes the need for resources that other groups prioritize, such as EDR and AV killers, along with InfoStealers. 
ShinyHunters Releases ShinySo1d3r RaaS 
The ShinySp1d3r RaaS was announced just before the publicized fall of Scattered LAPSUS$ Hunters in August. The RaaS release features information on the Windows encryptor and its capabilities, including the encryptor’s ability to hook EtwEventWrite to offset the writing of data into Windows Event Viewer, its ability to force kill open processes, and also run malware locally via actions such as deployViaSCM and deployViaWMI. ShinyHunters has taken credit for the release of the ShinySp1d3r RaaS; yet, the group stated that the platform will be managed under the brand of their former coalition. Whether this is a PR stunt to garner more recognition for Scattered Spiders and LAPSUS$ after law enforcement’s seizure of BreachForums remains unclear. However, Scattered Spider’s (and by extension ShinyHunters’) creation of their own encryptors and dedicated platform may serve as a model for more groups to follow, helping them to break away from affiliate relationships. 
Other Notable Ransomware News 
Now, let’s explore the notable news and findings since the last Threat Debrief release. 
Qilin’s claimed victims decline after Korean Leaks Campaign: Qilin claimed 122 victims in November, which is a stark contrast from the 205 victims reported in the previous month. From August to October, Qilin, assisted by another threat actor (likely Moonstone Sleet), leveraged the compromise of an MSP ecosystem to leak data from more than 30 organizations based in South Korea. While the group has secured the first rank in our Top 10 again, their victims are far lower than anticipated and do not feature organizations from East Asian regions.
Clop Climbs to Second Place: Clop claimed 102 victims, surpassing Akira and reclaiming a position in the Top 10. The majority of Clop’s victims in the past month have been organizations in the manufacturing, technology, and healthcare industries. The group has repeatedly exploited a zero-day vulnerability to compromise numerous systems. Clop’s attacks have also targeted systems impacted by CVE-2025-61882, which leads to the compromise of Oracle Concurrent Processing. Organizations using Oracle E-Business Suite versions 12.2.14 to 12.2.3 are advised to implement the latest patch to mitigate this flaw.
React2Shell Vulnerability is Disclosed: CVE-2025-55182 is a critical flaw affecting React Server Components. The vulnerability allows an attacker to gain initial access and perform remote code execution after sending HTTP requests containing malicious objects to the server. React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 are affected. The flaw also impacts the default configurations across the Next.js framework (15.x, 16.x) and Canary builds (14.x). Organizations using these iterations of React and supported components, are advised to patch them immediately. The React2Shell vulnerability may result in a widespread impact similar to those experienced with the exploitation of the Apache Log4Shell and Log4j flaws in ransomware attacks that hit multiple sectors.
CISA Updates Akira Advisory to Include Targeted Nutanix VMs: Hypervisors such as ESXi and Hyper-V environments have been prevalent targets for many ransomware groups aiming to take down hundreds of machines in seconds, Akira has launched campaigns targeting Nutanix VMs for nearly a year. Unlike with the ESXi systems, Akira’s Linux encryptor used in the Nutanix AHV environment can skip the process of powering off virtual machines and encrypt virtual disks (ending in .qcow2). Organizations are advised to ensure that flaws acting as common entry points for Akira and other ransomware groups such as CVEs impacting VPN and network appliances are identified and remediated. It is also recommended that they implement an effective backup and recovery plan.
Warlock Claims Several More Victims Based in Russia: Warlock claimed 3 victims in November that were based in Russia. This instance of more than one Russian-based organization being claimed in one month, and by the same ransomware group, is an anomalous event. This leads many to question Warlock’s motivations and origins. Notably, threat actors utilize capabilities mirroring that of a state-sponsored group, Storm-2603, which has leveraged Warlock ransomware in campaigns that abused flaws affecting SharePoint ToolShell. Shared TTPs between the two entities supports hypotheses that Warlock is an established, China-based threat in spite of the fact that China tends to support Russian-aligned interests.
Top 10 Ransomware Families 
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. Here’s the Top 10 ransomware groups.
Top 10 Most Attacked Countries 
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. In many cases, this means focusing on developed countries with higher projected growth rates. Threat actors may also execute strategic attacks that unfold during geopolitical conflicts or periods of social unrest. Let’s see the top 10 countries that took the biggest hit from ransomware attacks.
Top 10 Most Attacked Industries
Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to consumers, or attack organizations that fall into both categories. Understanding the trends and ramifications associated with specific industries, and how specialized services and clientele are impacted is crucial for assessing risk. Here are the Top 10 industries affected by ransomware attacks.
About Bitdefender Threat Debrief
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on Twitter. You can find all previous debriefs here. 
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed Bitdefender technology and added it to their product or service offerings. This vast OEM ecosystem complements the telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discovers 400+ new threats each minute and validates 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape. 
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu (sorted alphabetically) for their help with putting this report together.
Read More
https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-december-2025
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
]]>Tue, 06 Jan 2026 02:27:23 +0000<![CDATA[Bitdefender Threat Debrief | November 2025 ]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-november-2025
The ALPHV Insiders: Cyber Defenders Who Cast a Shadow on Enterprise Security 
This edition of the Bitdefender Threat Debrief includes coverage on the indictment of ALPHV affiliates, Qilin’s exponential growth, Sinobi’s return to our Top 10, and more. 
As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time. 
For this month's report, we analyzed data from October 1 to October 31 and recorded a total of 759 claimed ransomware victims. This is the third-highest month for the number of claimed victims within the past year. 
Featured Story: The ALPHV Insiders: Cyber Defenders Who Cast a Shadow on Enterprise Security 
What Happened? 
In October, three individuals connected to the ALPHV ransomware group were indicted in the United States. ALPHV, also known as BlackCat rose to prominence in 2023. The group claimed more than 400 victims that year, accumulating sizable ransom payments, totaling hundreds of millions of dollars. The road to the indictments started in December 2023 when ALPHV’s infrastructure was seized by the FBI as a result of an OPSEC failure. Although the group continued to execute ransomware campaigns in early 2024, ALPHV’s activities ceased in September that year. 
The individuals indicted were identified as insiders who worked incident response duties for cybersecurity firms, yet still joined an ALPHV affiliate group to support ransomware campaigns against U.S. organizations.
The parties identified, Clifford Goldberg and Kevin Tyler Martin, are U.S. citizens who could face a minimum of 20 years in prison for damage to protected systems and conspiracy to commit extortion. Two of the three indicted individuals were likely still employed as cybersecurity managers during their time aiding ALPHV, and one was a former employee of a cybersecurity firm. The affiliate members leveraged their technical expertise in ALPHV’s RaaS operations between May and November 2023. ALPHV claimed 278 victims during this timeframe, including organizations in the technology, healthcare, and manufacturing industries. These are all sectors with an increasing need for security resources and staff. 
How Cybersecurity Insiders Can Help a Ransomware Group 
When identifying the ways insiders can support a ransomware group, interesting scenarios emerge. Technical knowledge is often the first area to come to mind as an advantage. It’s true that developing APIs and tools to boost the functionalities of a group’s infrastructure can create significant opportunities for an adversary to strengthen their capabilities. The same can be said for knowledge transfer in cases where insiders share information about the mechanisms that operate within a specific security stack, or about anti-virus technologies and workarounds to evade detection. 
A security professional’s familiarity with organizational policies and breach notification rules and regulations is equally beneficial. ALPHV was one of the first groups that introduced a different type of extortion-one that involved threats and reports to third parties such as the U.S. Securities and Exchange Commission (SEC). When organizations failed to notify such authorities of a cyber incident, the cybersecurity insiders could have helped convince leadership to submit payment to ransomware groups, especially in circumstances where other staff may not understand recovery methods and the ‘safety nets’ upheld by keeping secure data outside of the immediate compromised ecosystem. If no other options are communicated to leadership or legal teams, they may feel immense pressure to concede to ransom demands. 
What Are the Lessons Learned?
No environment is immune to the insider threat. An emphasis on detecting and hunting external adversaries presents major gaps in risk assessment programs. The indictment of the ALPHV affiliate staff underscores the importance of maintaining and hardening defenses against all threat types. Multiple strategies can be implemented to proactively combat insider threats, including the following:
- Limit the systems that staff may access based on the principle of least privilege
- Enforce monitoring logging across administrative functions, ensuring alerting is also in place for events that include log-ons, data transfers, deletion or modification activities, etc.
- Establish training to educate staff about insiders and communicate protocols for reporting unusual activity
Other Notable Ransomware News
Now, let’s explore the notable news and findings since the last Threat Debrief release
Qilin ranks in the Top 10 for the sixth consecutive month: Qilin claimed 205 victims in October, which is a significant increase from their 96 victims reported in the last release. We have not seen the total number of victims claimed by an individual group exceed 200 since Clop’s milestone of surpassing 300 victims in February this year. As 2025 Q4 approaches its midpoint, QIlin’s presence and expansion puts both competing groups and victim organizations at risk. 
Bitdefender monitors campaigns targeting WSUS: CVE-2025-59287 was identified in a recent string of campaigns and allows an unauthenticated attacker to send requests to WSUS; then, the attacker can execute remote code with the highest level of privileges. Readers may stay informed about how threat actors targeting WSUS, by reading the latest advisory. Organizations are advised to apply the current Out-of-Band security update to mitigate this flaw. 
Sinobi makes their return to the Top 10 groups: Sinobi ransomware claimed 72 victims in October, narrowly surpassing Akira. Sinobi’s data leak site resembles those of other groups like Lynx. These sites feature News, Leaks, and Report sections with the same gray background and similar fonts and web components. Several hypotheses explain this resemblance: it’s possible that Sinobi is a Lynx affiliate. Another hypothesis points to the group’s use of a common developer: Multiple groups may employ the same contractor to maintain their site. An additional option is that similarities in the layout of a DLS may be a threat actor’s attempt to shirk responsibility by imitating another adversary. 
Handala’s decline in activity continues: Earlier this year, Bitdefender’s 2025 Cybersecurity Predictions included the resurgence of hacktivism in combination with ransomware campaigns. Handala, a group that has claimed nearly 125 victims since 2023, has engaged in hacktivist activities targeting Israeli entities. This aligns with their pro-Palestine dogma and repeated campaign activity. While Handala’s activity saw a sharp decline in August, this does not mean that further leaks will not be publicized. It is not uncommon for campaigns with such unique targets to see dips when the focus narrows to a specific group of potential victims. 
Kazu steps in with numerous breaches: Kazu is a ransomware group that has been active since September 2025. Despite their recent emergence, the group has already leaked data from government, military, and healthcare organizations. The majority of Kazu’s current victim demographic is from Southeast Asia, the Middle East, and South America. 
Top 10 Ransomware Families
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. 
Top 10 Most Attacked Countries 
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. In many cases, this means focusing on developed countries with higher projected growth rates. Threat actors may also execute strategic attacks that unfold during geopolitical conflicts or periods of social unrest. Let’s see the top 10 countries that took the biggest hit from ransomware attacks. 
Top 10 Most Attacked Industries
Ransomware gangs may target organizations in critical infrastructure sectors, select organizations that offer services tailored to the consumer marketplace, or choose to attack organizations that fall into both categories. Understanding the trends and ramifications associated with specific industries, and how specialized services and clientele may be impacted, is crucial to assessing risks and anticipating incidents that may occur. Here are the Top 10 industries affected by ransomware groups. 
About Bitdefender Threat Debrief
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on Twitter. You can find all previous debriefs here. 
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed Bitdefender technology and added it to their product or service offerings. This vast OEM ecosystem complements the telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discovers 400+ new threats each minute and validates 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape. 
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu (sorted alphabetically) for their help with putting this report together.
Read More
https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-november-2025 
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
]]>Mon, 01 Dec 2025 06:33:03 +0000<![CDATA[Bitdefender Threat Debrief | October 2025 ]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-october-2025
LockBit Lives On with Version 5.0 and a New Partnership
This edition of the Bitdefender Threat Debrief covers developments that include LockBit’s return, a new Clop campaign, revived groups, and more.
As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT)—such as news reports and research—with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time. 
For this month's report, we analyzed data from September 1 to September 30 and recorded a total of 556 claimed ransomware victims. 
Featured Story: LockBit Lives On With 5.0 and a New Partnership 
After two months of inactivity and a pending announcement, LockBit has released version 5.0. The release marks a six-year milestone in LockBit’s operations and is expected to draw in the interests of other emerging ransomware groups and potential affiliates. The LockBit 5.0 ransomware is upgraded to include anti-analysis capabilities such as ETW patching. This allows the ransomware to stifle detection measures by altering logging patterns written to specific processes in memory. LockBit 5.0 is also designed to target OSes such as Windows, Linux, and ESXi. 
The Platform: Access and Security 
LockBit is a group that has fallen victim to past compromises. As a result, many in the security community are curious about the precautions LockBit will now take to secure their infrastructure and resources. A user must pay to register an account and access LockBit 5.0. Once the user makes a $500 payment via a Bitcoin or Monero transaction to the provided address, the user can access the platform's control panel. This allows them to create encryptors and correspond with victims.
Image: LockBit 5.0 webpage
LockBit also has a bug bounty program intended to bolster security measures for their website and connected services. However, when it comes to communications with affiliates and other groups, LockBit has allowed the use of other methods outside of the direct infrastructure controlled by the group. These actions tend to reduce the group’s operational security. This can come at a greater detriment to LockBit, especially when considering that their future recruitment efforts and other communications likely extend to sites leveraged by DragonForce. 
The Recent Coalition with DragonForce 
DragonForce recently opened their digital doors, starting a partnership with LockBit and Qilin. LockBit’s partnership with DragonForce may be a strategic move made to rebuild followers and the LockBit ransomware brand after events such as Operation Cronos, builder and infrastructure leaks, and the loss of staff. At the time of this release, no victims have been published under LockBit 5.0. 
While Qilin continues to be an influential threat actor, DragonForce’s total number of claimed victims has remained consistently low each month. The group has averaged 20 victims over the past few months. DragonForce also continues to seek out additional partnerships and recently published the following: “Our doors are open to anyone who cares about the future of our challenging field. If you have a partnership program, feel free to reach out to us, and together we can maximize our overall income! More updates on this topic will be coming soon, so keep an eye out for news.” 
DragonForce’s desire to form other partnerships may stem from a need to exert greater economic control, doubts about Qilin and LockBit’s long-term cooperation, or both. We’ve seen just how fickle group partnerships can be when examining emerging and established groups. DragonForce remains a proponent of distributing the infrastructure and weapons that groups utilize to organize and execute their campaigns. That model may work in LockBit’s favor (temporarily) or come at a cost that undermines their ability to grow without DragonForce’s support. Regardless, as this development evolves, the groups must either innovate or stagnate. 
Other Notable Ransomware News 
Now, let’s explore the notable news and findings since the last Threat Debrief release. 
Qilin claims the top rank for the fourth consecutive month: Nearly a third of Qilin’s September victims were organizations in Financial Services. And another group, Securotrop, continues to be affiliated with Qilin and data leak activities. Qilin’s dominance month after month has shown that even groups ranking second or third and claiming 50+ victims have fallen behind significantly. 
Clop’s extortion campaign is revealed: Clop is known for leveraging zero-day exploits and they’ve crafted an extensive campaign, sending emails to thousands of compromised accounts and demanding that affected parties pay their ransom to prevent the disclosure of sensitive data. The campaign has been active since August. The sensitive data is tied to the application Oracle E-Business Suite. Clop extorted CVE-2025-61882. Exploiting this flaw does not require credentials and allows a threat actor to remotely execute code. Organizations using an affected version of Oracle E-Business Suite, including 12.2.3 through 12.2.14 are advised to promptly update their software. 
Scattered LAPSUS$ Hunters’ movements are disrupted: The group recently published a data leak site (DLS) where they maintain posts on past and current victims. The DLS emerged only weeks after the arrests of two teens based in the U.K. that have been tied to Scattered Spider’s operations. A statement was later posted on BreachForums announcing that Scattered Spider, LAPSUS$, and others would go dark. The FBI seized BreachForums’ infrastructure in early October 2025. Their ally, ShinyHunters, claimed responsibility for two recent campaigns and has remained adamant that they will continue to post claimed victims. 
The Gentlemen and Coinbase Cartel join the Top 10: Little is known about two groups that have emerged into this month’s top 10. The Gentlemen is one group, and little is known about their motivations, and current operations. Coinbase Cartel is another emerging group. Interestingly, the group claims that they do not use ransomware, and instead they deal with data theft and disclosure. As both groups enter our Top 10, Sinobi ransomware has fallen from the list. 
Google’s AI detects ransomware, stopping Google Drive compromise: Google Drive now includes support for an AI model that has learned from analyzing millions of ransomware samples. If Google Drive syncing is enabled on a system that has executed ransomware, then Google’s AI stops the syncing process. This prevents the modification and encryption of data in synced Drive folders. Local folders and directories, however, may still be encrypted, so it’s important to ensure that any local data is regularly backed up.
Old ransomware groups, presumed dead, resurface: The group activities of both Kawa4096 and Radar ransomware were observed last month. Radar’s infrastructure was taken down by the U.S. FBI nearly two years ago . Kawa4096 had also gone quiet but emerged again in June of this year. The group reportedly had a DLS with a terminal window that mirrored the appearance of Akira’s DLS. Their site has been down since August; however, Kawa4096’s recent activities indicate that the group may be operating under new leadership or has already been acquired by other threat actors. 
Top 10 Ransomware Families 
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. 
Top 10 Countries for Ransomware Attacks
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. In many cases, this means focusing on developed countries with higher projected growth rates. Threat actors may also execute strategic attacks that unfold during geopolitical conflicts or periods of social unrest. Let’s see the top 10 countries that took the biggest hit from ransomware attacks. 
Top 10 Most Attacked Industries 
Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to the consumer marketplace, or choose to attack organizations that fall into both categories. Understanding the trends and ramifications associated with specific industries, and how specialized services and clientele may be impacted, is crucial to assessing risks and anticipating incidents that may occur. Here are the Top 10 industries affected by ransomware groups. 
About Bitdefender Threat Debrief
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements the telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discovers 400+ new threats each minute and validates 30 billion threat queries daily. This provides us with one of the industry’s most comprehensive real-time views of the evolving threat landscape. 
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu (sorted alphabetically) for their help with putting this report together.  
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
]]>Fri, 17 Oct 2025 09:39:53 +0000<![CDATA[Bitdefender Threat Debrief | September 2025]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-august-20251
Salesloft Drift supply chain attack lands a devastating blow to tech and connected customers 
This edition of the Bitdefender Threat Debrief covers several recent developments, including a supply chain attack, an offer made to Qilin and LockBit, a manufactured ransomware powerhouse, and more. 
As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time. 

For this month's report, we analyzed data from August 1 to August 31 and recorded a total of 496 claimed ransomware victims.
Featured Story: Salesloft Drift supply chain attack lands a devastating blow 
What Happened? 
A Salesloft Drift supply chain attack with incidents dating back to early August has impacted more than 700 organizations worldwide with IT firms, MSSPs, Managed Security Service Providers, and their customers taking the brunt of these attacks.
The breaches have affected several data types, including unique customer information, support tickets, and credentials to access APIs and other services. Salesloft is a SaaS offering designed to manage sales and project management processes, while Drift is the chat agent that supports Salesloft functions, with the assistance of AI. Those using Drift alongside Salesloft and Drift’s integrated services were advised to disconnect Drift, reauthenticate with a new API key, and leave synchronization functions inactive.
The Attack's Origin
The findings published from a recent investigation established that the Salesloft Drift supply chain attack started with a threat actor’s access to a GitHub account from March to June 2025. The threat actor extracted data from connected repositories, created a guest user account, and conducted reconnaissance on the Salesloft and Drift ecosystems. OAuth tokens were a key component of the supply chain attack. After conducting reconnaissance, the threat actor gained access to a Drift AWS environment and obtained the necessary tokens, which they used to locate data stored in Drift-integrated platforms.
Is Scattered LAPSUS$ Hunters Behind This Attack?
Threat activity associated with the Salesloft Drift supply chain attack has been connected to the threat actor known as UNC6395. While a channel named after the Scattered Spider, LAPSUS$, and Shiny Hunters in late July claimed responsibility for the attack, these claims were lacking significant evidence to support that stance. 
At the time of this debrief, there is, however, supporting information that the threat actor responsible for the supply chain attack is distinct from Scattered LAPSUS$ Hunters due to the method used to gain initial access to target systems and the scope of the attack.
Rather than rely on social engineering to enter an environment, the threat actor breaches a third-party software that integrates with multiple platforms, making the consequences of their breach far more extensive than for instance one affected group of machines or accounts. The outcome of such a compromise also differs from the tactics associated with Scattered LAPSUS$ Hunters, who prioritize extortion.
What are the lessons learned?
Customers, service providers, and vendors share a responsibility to secure applications and data. The Salesloft Drift supply chain attack also underscores the importance of maintaining mature risk assessment and incident response programs. It is imperative for teams to assess critical applications used in the environment in addition to the resources connected to those applications. 
Access controls, including the enforcement of separation of duties and credential rotation, provide a barrier to protect against unauthorized users and devices. Finally, testing and continuously updating detection parameters for anomalous activity, including logons, new user/account additions, and data retrieval/removal, can help proactively enhance threat detection efforts to spot threat actor activity earlier.
Other Notable Ransomware News
Now, let’s explore the notable news and findings since the last Threat Debrief release.
Qilin claims the top rank for the third consecutive month: Qilin has placed in our Top 10 Groups for a year. It’s no surprise that another ransomware group would voice a desire to collaborate with them. Qilin’s status, however, also makes them a target. This was observed several weeks ago when a bounty for Qilin admins disguised as a Europol notice was shared in a Telegram channel. Whether this action was executed by a scorned rival or internal staff is unknown.
DragonForce offers LockBit and Qilin an opportunity to join forces: At the time of this release, details surrounding the opportunity, including the expected profit-sharing ratio is not known. There is great speculation about whether this proposition by DragonForce is a ruse to save face before a takeover attempt. The group made headlines back in April for their involvement with the competitor RansomHub and a DLS post announcing RIP RansomHUb shortly thereafter.
WarLock Group exploits SharePoint zero-day flaws: WarLock has exploited a ToolShell flaw in recent campaigns. A threat actor exploiting the SharePoint zero-day flaw can declare a domain Group Policy Object, escalate privileges, and establish a covert command and control channel to transfer data and perform lateral movement before deploying ransomware. Organizations using SharePoint Server 2016 or 2019 and the SharePoint Subscription Edition are advised to update the software to the latest version and check that AMSI in the SharePoint integration settings with HTTP Request Body scanning in Full Mode.
The PromptLock powerhouse was invented by researchers: Last month, reports of an AI-powered ransomware sewed fear in the hearts of business owners and great doubt in the minds of security engineers. Many wondered how processes central to ransomware operations could be automated further with the support of LLMs to create code that performs scanning activities, identifies target files, exfiltrates, and encrypts data. In response to this growing curiosity, NYU Tandon engineering students created the proof of concept Ransomware 3.0. The code was later uploaded to VirusTotal where researchers flagged it as malicious and assumed it was present in attacks in the wild until NYU Tandon students came forward, disclosing the role in the project.
Another EDR killer enters the fray: The tool, unnamed, has multiple builds; it has been used by Qilin, DragonForce, BlackSuit, and the former RansomHub. Executed in the context of a legitimate application via code injection, the EDR killer references a digitally signed driver that has a stolen or invalid (expired) certificate. This certificate enables the malicious driver to be loaded into the kernel, allowing it to disable security tools. The various builds of the tool leveraged by different threat actors indicate that tool-sharing activities persist beyond affiliate partnerships.
Newcomer Sinobi emerges: Sinobi ranked in third place, surpassing SafePay. The group claims to be financially and not politically motivated, encrypting systems and then offering victims seven days to contact them and negotiate a ransom payment. Sinobi has a data leak site that has accrued thousands of views in a short time span. Their site diverges from other ransomware groups as it does not feature more immediate visibility to preview or access impacted files. 
Top 10 Ransomware Families
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. 

Top 10 Countries
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. This often means focusing on developed countries.  Let’s see the top 10 countries that took the biggest hit from these attacks. 
Top 10 Industries
Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to the consumer marketplace, or attack both. Here are the Top 10 industries that were hit by ransomware groups.
About Bitdefender Threat Debrief
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements the telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discovers 400+ new threats each minute and validates 30 billion threat queries daily. This provides us with one of the industry’s most comprehensive real-time views of the evolving threat landscape. 
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu (sorted alphabetically) for their help with putting this report together.  
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
Get Started Now
]]>Mon, 08 Sep 2025 09:15:08 +0000<![CDATA[Bitdefender Threat Debrief | August 2025 ]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-august-2025
ScatteredSpider Team Up with LAPSUS$ and ShinyHunters: More Growth, More Bragging? 
This edition of the Bitdefender Threat Debrief highlights major ransomware developments, including ScatteredSpider’s activities and collaborations; updates concerning Qilin and Akira; charges involving Ryuk’s former operator, and a new group that activated after Operation Checkmate. 
Ransomware is a moving target, and our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all threat actor claims but are confident in the trends we see over time. 
For this month's report, we analyzed data from July 1 to July 31 and recorded a total of 512 claimed ransomware victims. 
Featured Story: ScatteredSpider Team Up with LAPSUS$ and ShinyHunters
What Happened? 
After the first week of August, reports circulated about a Telegram channel named Scattered Lapsus$ Hunters. This indication of ScatteredSpider’s collaboration with both LAPSUS$ and ShinyHunters was intentional and was followed by an update on their mutual aim to play a greater role in the ransomware economy. 
A user in the Scattered Lapsus$ Hunters channel mentioned an upcoming RaaS platform, ShinySp1d3r. The user stated that this platform would be on par with similar offerings by LockBit and DragonForce. The group previously posted images of a red Chevrolet Corvette sports car on their Telegram. The car sported a Kentucky license plate labeled LAPSUS.

Image: A Corvette with a license plate from the U.S. state of Kentucky appears in the Scattered Lapsus$ Hunters channel, briefly, before being deleted.
While the Telegram channel and a secondary channel were taken down just three days later, its existence highlights two important aspects that shape organized crime: collaboration and showing off.
Why Team Up? 
ScatteredSpider is known for clever social engineering tactics, leveraging VPN obfuscation to transfer victim data, and flexing their wealth. In their campaigns from early summer 2025, it was revealed that they executed DragonForce ransomware once initial access to a victim was established. This was one indication of a budding partnership between DragonForce and ScatteredSpider. However, that partnership was short-lived. ScatteredSpider has shifted its focus from targeting high-value retail organizations to targeting other industries, including transportation and aviation. 
ScatteredSpider is likely teaming up with LAPSUS$ and ShinyHunters to cast a far-reaching net, growing their collective influence and appealing to more potential recruits within their demographic of Western males aged 16 to 25. 
The LAPSUS$ Connection
While many of the LAPSUS$ members who received media attention from 2022 to 2023 were teens, and some were even convicted in the years that followed, they should not be underestimated due to their age or past decisions. 
LAPSUS$ has conducted high-profile attacks and also leaked data from victim organizations in several industries, including technology and logistics. LAPSUS$ has also evolved to incorporate SIM swapping in their operations. The decision by LAPSUS$ to consider a team-up with ScatteredSpider may have stemmed from shared contacts within a criminal network. LAPSUS$ establishes connections to the Com, a larger criminal syndicate that engages in both extortion and physical crime. 
LAPSUS$ would also greatly benefit from the aid that comes with combining forces, after losing many of its members. Moreover, there is a repeated emphasis on teenagers having a common goal: committing crimes and showing off would reach a similar community found in ScatteredSpider’s group of male youth, located throughout the United Kingdom and parts of the United States. 
New Pursuits with ShinyHunters 
ScatteredSpider’s alliance with ShinyHunters may also boost their standing and influence based on ShinyHunters’ former roles in the underground. Security researchers trace ShinyHunters’ operations back to early 2020. The group is known for their role in maintaining the BreachForums platform in 2021 and launching further iterations of BreachForums and participating in activities on RaidForums. 
ShinyHunters’ connection to ScatteredSpider may go back to the spring of 2024. One marker of this collaboration between the two groups is the creation of a Sp1d3rHunters BreachForums account in May 2024. However, the account and others associated with ShinyHunters were compromised. A newer iteration of the BreachForum site was also seized by law enforcement. 
ShinyHunter’s TTPs, including their unique use of data exfiltration via known, legitimate cloud services and credential harvesting techniques, paired with ScatteredSpider's social engineering and authentication-type attacks form a far more formidable threat. The combination of tactics used by the two groups has already been observed in campaigns targeting the Salesforce platform that feature malicious lures (SSO pages) used to harvest credentials. 
What’s Performative? 
Now that ScatteredSpider has shifted gears and formed an alliance with LAPSUS$ and ShinyHunters, the united group faces greater scrutiny from law enforcement agencies and threat intelligence firms seeking insights into their operations. 
The alliance likely wants to be perceived as a highly capable and wealthy threat. Performative acts of showing off, such as posting an image of the red Chevrolet Corvette, appear impressive. However, upon closer examination, it becomes clear that the image is cropped to obscure a wider view. 
The vehicle’s model is six years old with the Stingray Premium 3LT trim. This trim makes the particular Corvette comparable in cost to a 2025 Honda Pilot, which has a price range of $45,000 to $60,000. Nice, yes, but it doesn’t convey the image of a ransomware group bringing in millions of dollars to purchase imported accessories and luxury sports cars. 
And, just like the fleeting nature of the scattered lapsus$ hunters Telegram channel, the promoted collaboration may be a temporary glimpse into a moment that is not followed up with decisive action. 
What’s Next? 
Whether ScatteredSpider can truly surpass LockBit and rival the ransomware cartel that DragonForce has built remains unknown. No further connections have been drawn between ScatteredSpider and DragonForce. Their partnership, like others, was not sustainable as ScatteredSpider's team up with LAPSUS$ and ShinyHunter's became public. At the time of this post, there is no data leak site that has been linked to the ScatteredSpider-LAPSUS$-ShinyHunters collaboration. No release date for their RaaS has been publicized, and there are no mentions of specific platform features.
Bitdefender has observed a phenomenon year after year: competition in the RaaS space remains fierce and chaotic. The fight against time (until detection), innovation to stand out among competition, and prowess to maneuver away from law enforcement, positions many cybercriminal groups to join other criminal enterprises or fail and cease their operations entirely. Fewer ransomware groups, excluding rebranded entities, are persisting beyond two to three years. 
Ransomware Awareness and Defense 
Ransomware threats, ranging from small and insular extortion groups to large, interconnected networks, continue to pose significant challenges for organizations seeking to protect their assets and reputation. As the threat landscape undergoes frequent changes, understanding the elements that influence ransomware operations, and a successful or unsuccessful compromise, is vital to implement timely and relevant threat-informed countermeasures. 
For a comprehensive analysis of the ransomware playbook, including attack execution paths and defense strategies, please refer to our updated Bitdefender Ransomware Whitepaper. 
Other Notable Ransomware News 
Now, let’s explore the notable news and findings since the last Threat Debrief release. 
Qilin claims the greatest number of victims again: Qilin continues to place in the top ransomware position. Qilin has now claimed nearly 410 victims in 2025. However, Akira narrowly exceeded Qilin’s total victims, claiming 419 victims in 2025. With the emergence of new ransomware groups and alliances among threat actors like ScatteredSpider, Qiln’s ranking may become more variable over time. 
Akira exploits SonicWall VPN flaw: A pattern of activity in Akira campaigns during July 2025 highlighted the compromise of VPN accounts followed by encryption. It is important to note that Akira did not use a zero-day vulnerability in these attacks and instead leveraged CVE-2024-40766. While this pattern was identified in campaigns last month, a string of similar activity has been ongoing since October 2024. Organizations using SonicWall VPN/ are advised to update the firmware to version 7.3.0 and implement other practices to harden their systems, such as enabling Botnet Protection and enforcing MFA. 
Chaos emerges in the wake of BlackSuit’s fall: Bitdefender assisted in Operation Checkmate, which resulted in the seizure of BlackSuit infrastructure. Chaos, a ransomware group which is not associated with the ransomware builder of the same name, has emerged in their stead. The group uses vishing and impersonation tactics to gain access to target systems. There is speculation surrounding their origin and one theory establishes that Chaos is a rebrand of BlackSuit due to their common encryption parameters and TTPs, including the abuse of authorized programs and RMMs like AnyDesk.
AiLock ransomware incidents grow: AiLock emerged in March 2025. Notably, the ransomware is equipped to perform encryption, locking the contents of files and metadata, using the ChaCha20 and NTRUEncrypt algorithms alongside a two-thread encryption routine. Its defense evasion properties include string obfuscation, process termination, and Recycle Bin cleaning.   
Ryuk operator indicted on charges of ransomware conspiracy: Karen Serobovich Vardanyan, an Armenian national, faces a sentence of five years for his involvement in Ryuk’s ransomware campaigns, which generated $15 million from March 2019 to fall 2020. Searches for the individuals who collaborated with him, Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, remain underway. Penalties of $250,000 were also filed by U.S. federal authorities.
DragonForce seeks out more talent: The ransomware cartel added a post on their data leak site, requesting partnerships with those versed in C++, Rust, and Go, and reverse engineering skillsets. DragonForce announced the expansion of their affiliate force in late spring; few updates were released thereafter.
FunkSec decryptor is available: FunkSec made a name for itself as a ransomware group that emerged with the help of AI and ambitious script kiddies. The decryptor for the ransomware is publicly available and FunkSec is now considered a dormant group. They could be re-strategizing to start anew. We’ve examined several events involving AI and ransomware in recent months, such as Global’s use of AI to support ransom negotiations. As developments occur, we’ll continue to assess changes in the ways threat groups utilize AI. 
Top 10 Ransomware Families 
Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. 

Top 10 Countries 
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. This often means focusing on developed countries. Now, let’s see the top 10 countries that took the biggest hit from these attacks. 
Ransomware Victims: Top 10 Industries 
Ransomware gangs may target organizations in the critical infrastructure ecosystem, select other organizations that offer services tailored to the consumer marketplace, or attack both. Here are the Top 10 industries that have been targeted by ransomware groups.
About Bitdefender Threat Debrief
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements the telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discovers 400+ new threats each minute and validates 30 billion threat queries daily. This provides us with one of the industry’s most comprehensive real-time views of the evolving threat landscape. 
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu (sorted alphabetically) for their help with putting this report together.  
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
Get Started Now
]]>Mon, 08 Sep 2025 09:15:08 +0000<![CDATA[Bitdefender Threat Debrief | July 2025]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-july-2025
Global Hits the Ground Running with RaaS Release   
This Threat Debrief release covers key changes among ransomware groups, including the emergence of Global, a recent update on Qilin’s rise, and developments connected to DragonForce and Scattered Spider. 
Ransomware is a moving target, and our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It’s important to remember that we can't independently verify all of these claims but are confident in the trends we see over time.
For this month's report, we analyzed data from June 1 to June 30 and recorded a total of 468 victims claimed. This is a 38% increase compared to June 2024. 
Featured Story: Global Hits the Ground Running with RaaS Release 
Who are they? 
Global is a RaaS (ransomware as a service) group that emerged in late June. The group has attacked organizations based in the United States, Great Britain, and Australia as well as other regions. Global’s activities have been associated with $$$, a BlackLock contributor, and they have a DLS (dedicated leak site) that features 16 posts. $$$ is an alias associated with the creation of several ransomware groups, including Mamoma and BlackLock, which were both defaced by DragonForce in March.   
How many victims have they claimed? 
Global has claimed 16 victims since its start in June. In comparison, BlackLock claimed 9 victims in June and has accumulated 33 victims since its rebrand from El Dorado in the fall of 2024. 
What are they offering? 
Global markets its locker as the fastest currently available with support for Windows, ESXi, and NAS systems. According to correspondence from their DLS, it also offers other capabilities, including EDR evasion, partial encryption to expedite the locking process, and a self-delete option. The Global panel is bundled with various features, including 24/7 support, a mobile version, regular updates, expanded storage, AI-driven support, and a negotiation panel. 
What separates Global from BlackLock? 
While $$$ is the alias that connects the BlackLock and Global entities, the RaaS panels for each may suit different affiliates. The Global platform provides a system for affiliates who may need greater support with a ready-made solution to thrive. In contrast, BlackLock RaaS operations have been reported as exercising great discretion and also requiring some specialization. Internal teams and collaborators may take on roles essential for Initial Access Broker type services or other tasks such as code development. One of BlackLock’s hallmarks has also been its incorporation of code written in Go. 
What might this mean for future operations? 
Global is in a lucrative position, opening their doors to affiliates who may need a structured, pre-packaged toolkit built with resources to fill gaps that exist in their own operational plans. A profit of 85% of any earnings collected from campaigns for affiliates and the omission of any deposit in the process also creates ample opportunities for potential affiliates to join with fewer concerns over financial deficits. 
It is unknown if DragonForce has some stake in BlackLock following their defacement of Mamona and the BlackLock data leak sites. As a result, BlackLock’s and by extension Global’s ties to DragonForce have yet to be validated. While Global does not replace BlackLock, if one were displaced by DragonForce, it could spell trouble for the other, resulting in the loss of their affiliates or connected resources. 
Ransomware Awareness and Defense 
Ransomware threats, from small and insular extortion groups to large, allied networks, continue to present great challenges for organizations seeking to protect their assets and reputation. As the threat landscape undergoes frequent changes, understanding the elements that influence ransomware operations and a successful or unsuccessful compromise is vital to implement a sound and informed defensive strategy. 
For a comprehensive analysis of the current ransomware playbook, including how these attacks are executed and how to defend against them, read our frequently updated ransomware whitepaper. 
Additional Ransomware News 
Now, let’s explore other notable shifts and findings since last month’s Threat Debrief. 
Qilin claims the greatest number of victims and adds a strategic feature: Qilin set a record by claiming 89 victims in a month, the group’s highest total to date. The group also added a Call Lawyer feature to its affiliate panel. The feature is intended to offer affiliates legal guidance and a scheme to exert additional pressure on victims. This feature comes several months after other updates to the panel, such as the Distributed Denial of Service functionality, were released.
REvil cybercriminals are released: Four REvil members convicted in 2022 for their involvement in the group’s ransomware operations are out of jail. Andrei Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotayev were freed from Russian custody for serving more than three years in pre-trial detention. This ruling comes nearly a year after a separate case involving the sentencing of REvil members Daniil Puzyrevsky, Ruslan Khansvyarov, Alexei Malozemov, and Artem Zayets; these members refuted their charges and have sentences ranging from 4.5 to 6 years.
A DragonForce ransomware variant emerges: Devman is a ransomware group that has now been connected with a DragonForce variant. DragonForce gained notoriety for operating as a ransomware cartel, likely to pressure rivals and emerging groups into joining forces with them. The DragonForce variant has several unusual characteristics, including the encryption of a ransom note. Devman completed their RaaS release project, Devman 2.0, this month. The group has published multiple ransoms ranging from $60,000 to $10 million. While the extent of Devman’s relationship with DragonForce remains unclear, it came to light months after Devman’s affiliation with Qilin.
Scattered Spider attacks organizations in aviation and transportation: The hacker group initially connected to attacks against retail organizations, employing techniques also used by DragonForce, has recently launched attacks against organizations providing transit services. Scattered Spider continues to pose a significant threat to organizations as they leverage social engineering tactics such as impersonation to bypass conventional controls and gain privileged access to critical systems.
Hunters International announces the end of their operations a second time: Despite the announcement, a working theory persists to refute the finality of this claim. Hunters may instead have regrouped under the name World Leaks, operating with a focus on data exfiltration instead of encryption. World Leaks has claimed more than 25 victims since initial reports of their data theft activities were published in April. That total surpasses the number of victims that Hunters International claimed in previous months, as Hunters averaged just over 7 victims a month. 
Top 10 Ransomware Families 
Bitdefender's Threat Debrief analyzes data from ransomware leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. 
Top 10 Countries Targeted by Ransomware
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. This often means focusing on developed countries. Now, let’s see the top 10 countries that took the biggest hit from these attacks. 
Top 10 Industries 
Ransomware gangs may target organizations in the critical infrastructure ecosystem, select other organizations that offer services tailored to the consumer marketplace, or attack both. Here are the Top 10 industries that were hit by ransomware groups. 
About Bitdefender Threat Debrief
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on Twitter. You can find all previous debriefs here.
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discover 400+ new threats each minute and validate 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape.
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu for their help putting this report together. 
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
Get Started Now
]]>Thu, 21 Aug 2025 09:42:06 +0000<![CDATA[Bitdefender Threat Debrief | June 2025  ]]>https://www.netmon.asia/blogs/post/bitdefender-threat-debrief-may-20251
SafePay Ransomware Surpasses Qilin and Play, Claiming the Greatest Number of Victims in May 
This month's Threat Debrief covers several shifts in the ransomware ecosystem, including SafePay’s recent increase in victims, a strategic leak of Conti and TrickBot data, plus the latest exploits leveraged by Qilin and other groups. 
Ransomware is a moving target, and our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It’s important to remember that we can't independently verify all of these claims but are confident in the trends we see over time. 
For this month's report, we analyzed data from May 1 to May 31 and recorded a total of 467 victims claimed. 
Featured Story: SafePay Surpasses Qilin and Play, Claiming the Greatest Number of Victims in May 
Who are they? 
SafePay is a ransomware group that was discovered in the fall of 2024. The group claims that they have not and do not offer Ransomware-as-a-Service (RaaS). While simplistic in nature, lacking a blog or open forum, their data leak site lists victims and stolen data. 
What systems and industries have been affected by SafePay? 
SafePay binaries have several iterations to attack not only endpoints, but also hypervisors. Once executed, systems are encrypted, and the .safepay extension is appended to affected files and directories. The top industries represented in their victim demographic are currently manufacturing, healthcare, education and research, consulting, and government. 
How many victims have they claimed? 
To date, SafePay has claimed more than 200 victims. They claimed 70 victims in May, more than doubling the prior record set for their highest number of victims claimed per month. Their second highest number of victims claimed per month, 33, was reported in March of this year. 
How is LockBit involved? 
SafePay has used ransomware that features code elements found in LockBit 3.0. Excluding the use of this code in a time following the LockBit builder leak, there are no other known links between LockBit and SafePay. SafePay does however have a Cyrillic kill switch functionality, meaning that if it identifies that a Cyrillic language keyboard is set, it will not execute the ransomware. This leads many to identify SafePay as a potential Russian-affiliated or allied threat actor.   
What tactics has SafePay used? 
SafePay has leveraged PowerShell scripts for reconnaissance and post-exploitation tasks. They’ve also used Living Off the Land tactics to inhibit system recovery methods and disable Windows Defender. Indicators of data exfiltration are tied back to repeatedly observed activities that involve WinRAR and the use of command line tools or in some cases, FTP. 
Ransomware Awareness and Defense 
Ransomware groups may experience ebbs and flows in their operations over time. This may be due to several factors, including the success rate of opportunistic attacks or modeling attacks based on tactics employed by past threat actors. It is essential to stay informed about relevant threats and the measures you can take to secure your organization’s assets and reduce the likelihood of a successful ransomware attack. 
For a comprehensive analysis of the current ransomware playbook, including how these attacks are executed and how to defend against them, please read our Ransomware whitepaper. 
Notable Ransomware News 
Now, let’s explore other notable news and findings since our last Threat Debrief release. 
Conti and TrickBot operations exposed: A leaker known as GangsExposed published files and names associated with Conti and TrickBot campaigns on a Telegram channel. The leak includes correspondence between Conti leadership, photos, and other data that dates back to 2020. One alleged leader in those ransomware operations, Stern or Vitaly Nikolaevich Kovalev, was identified by German authorities and may reside in Russia. 
Critical Fortinet vulnerabilities are exploited in Qilin attacks: Qilin claimed the second rank in this month’s Top 10 ransomware groups. This threat actor has exploited CVE-2024-21762 and CVE-2024-55591 in recent campaigns. These flaws pose a significant threat to environments that feature affected Fortinet/FortiGate systems, as most zero-day flaws do. It is advised that organizations review their latest patches to ensure their systems are up to date. 
The next chapter of Operation Endgame disrupts cybercrime operations: A joint effort by Europol and other law enforcement agencies in France, Germany, Canada, and the United Kingdom, has resulted in the seizure of illicit domains and nearly 4 million USD in cryptocurrency. Distribution channels for several ransomware strains, including Oakbot, DanBot, and TrickBot were eradicated. The AVCheck domain was also seized, barring cybercriminals from accessing a service to test their crypted malware samples against anti-virus services. 
Ransomware group Datacarry emerges with a climbing victim count: Datacarry is a ransomware group that emerged a few weeks ago. Datacarry has claimed more than 10 victims at the time of this Threat Debrief publication, claiming victim organizations based in the United States, Belgium, Great Britain, and Switzerland. Their data leak site is also unique; although it is not as interactive as others, it features a desktop-like interface that allows visitors to navigate to folders containing leaked data. 
IMN Crew adds 8 victims to its DLS: IMN Crew is a newer ransomware group that claimed 8 victims in May. They’ve had a data leak site for over a month and have published data stolen from victim organizations based in the United States, Great Britain, Indonesia, and Sweden. 
The FBI and CISA publish a joint advisory with updates on Play: The publication highlights some changes since the last advisory, including patterns in Play’s correspondence with victims by both email and phone. The group continues to launch attacks against critical infrastructure and also exploits vulnerabilities in the SimpleHelp RMM tool to execute remote code. 
Top 10 Ransomware Families 
Bitdefender's Threat Debrief analyzes data from ransomware leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into the overall activity of the RaaS market. However, there is a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method only captures the number of victims claimed, not the actual financial impact of these attacks. 

Top 10 Countries 
Ransomware gangs prioritize targets where they can potentially squeeze the most money out of their victims. This often means focusing on countries with large or growing economies. Now, let’s see the top 10 countries that took the biggest hit from these attacks. 
Top 10 Industries 
Ransomware gangs may target organizations in the critical infrastructure ecosystem, select other organizations that offer services tailored to the consumer marketplace, or attack both. Here are the Top 10 industries that have been targeted by ransomware groups. 
About Bitdefender Threat Debrief
The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on Twitter. You can find all previous debriefs here.
Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discover 400+ new threats each minute and validate 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape.
We would like to thank Bitdefenders Vlad Craciun, Mihai Leonte, Gabriel Macovei, Andrei Mogage, and Rares Radu for their help putting this report together. 
#Bitdefender #Bitdefender Threat Debrief #cybersecurity #ransomware attacks #cybercriminals #NetMon
Get Started Now
]]>Thu, 21 Aug 2025 03:24:59 +0000