LockBit

Operation Endgame, a coordinated law enforcement action by Netherlands, Canada, US, and Germany, disrupted TA569's SocGholish web inject infrastructure by taking down over 100 servers and remediating 14,971 compromised websites. TA569 compromises legitimate websites—often WordPress installations—to inject obfuscated JavaScript that presents fake browser update pages to visitors, ultimately delivering GhoLoader malware which can lead to ransomware deployments. The attack chain leverages traffic direction systems (TA2726's Keitaro TDS and ParrotTDS) for victim filtering and uses advanced client-side blob URL construction to evade sandbox detection and network-based download tracing.

Proofpoint and IBM X-Force collaborated with Europol and Microsoft's Digital Crimes Unit to disrupt the StealC malware-as-a-service ecosystem as part of Operation Endgame, seizing 66 domains, 296 servers, and over 25.6 million stolen credentials. Researchers discovered a directory traversal vulnerability in the StealC PHP C2 panel's filename handling during ZIP extraction, which was exploited by law enforcement to access and seize C2 servers. The teams also built a StealC bot emulator to track affiliate infrastructure and observe payload delivery chains, revealing StealC's loader functionality distributing a broad range of secondary malware including ransomware, RATs, and additional stealers.

2026-07-0110 minRecorded Futurehigh

Recorded Future's Insikt Group evaluates Mexico's newly published 2025-2030 National Cybersecurity Plan, assessing it against the country's actual threat landscape from 2020-2026. Ransomware is the dominant threat with 223 documented incidents across 64 groups, while financial malware (Mispadu, Grandoreiro, Casabaneiro, Fenix botnet), state-sponsored espionage (TAG-141/FamousSparrow, TGR-STA-1030), hacktivism (Chronus Team, Guacamaya), and organized crime-linked money laundering via Chinese networks compound the risk. The 2026 FIFA World Cup will be an early operational test of Mexico's cyber resilience.

2026-06-197 minESETcritical

ESET researchers analyzed the Gentlemen ransomware-as-a-service (RaaS) operation, highlighting their unique approach of providing an in-house developed EDR killer framework, GentleKiller, directly to affiliates. The framework leverages Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate over 400 security processes and is augmented by third-party tools like HexKiller and HavocKiller, all standardized with a shared defense-evasion layer.

2026-06-186 minInfobloxhigh

Operation Endgame successfully disrupted the SocGholish (TA569) initial access framework, which relies on compromised WordPress sites and Traffic Distribution Systems (TDS) to deliver fake browser updates. The threat actor utilizes domain shadowing and a multi-stage JScript payload to establish footholds, primarily targeting corporate environments during standard work weeks to facilitate follow-on ransomware deployment.

2026-06-046 minRecorded Futurehigh

The 2026 FIFA World Cup faces a multifaceted threat landscape encompassing cybercriminal fraud, state-sponsored espionage, and physical security risks. Financially motivated actors are actively deploying purchase scams and fake domains to harvest payment card data, while state-aligned groups from Iran, Russia, and China are expected to target telecommunications, logistics, and VIP attendees for intelligence collection and potential disruption.

2026-05-245 minCheck Pointcritical

This threat intelligence report highlights a surge in ransomware activity, critical zero-day vulnerabilities in Windows, and the active exploitation of Cisco Catalyst SD-WAN controllers. Additionally, it details emerging AI-driven threats, including malicious Hugging Face repositories and the abuse of AI website generators for phishing, alongside an APT intrusion by FamousSparrow targeting the energy sector.

2026-05-217 minHuntresshigh

The Ransomware-as-a-Service (RaaS) ecosystem relies heavily on affiliates who dictate the actual intrusion tradecraft, meaning a single ransomware brand can be associated with vastly different attack chains. Affiliates frequently abuse legitimate Remote Monitoring and Management (RMM) tools, exposed RDP, and vulnerable edge appliances for initial access, followed by the use of LOLBins and open-source utilities for persistence and data exfiltration.

2026-05-196 minSophoshigh

WantToCry is a remote ransomware operation that targets internet-exposed SMB services using brute-force authentication. Instead of deploying local malware, attackers exfiltrate files, encrypt them on their own infrastructure, and write the encrypted versions back to the victim's network via authenticated SMB sessions, effectively bypassing traditional process-based EDR detections.

Kaspersky's Q1 2026 threat report highlights significant law enforcement actions against major ransomware operators, alongside the emergence of new ransomware groups like The Gentlemen. The quarter also saw active zero-day exploitation of Cisco Secure FMC (CVE-2026-20131) by the Interlock group, a rise in macOS-targeted crypto stealers and supply chain attacks via the Axios npm package, and persistent IoT botnet activity dominated by Mirai variants.

2026-05-135 minCheck Pointhigh

In Q1 2026, the ransomware ecosystem experienced significant consolidation, with top groups like Qilin, Akira, The Gentlemen, and LockBit 5.0 dominating the landscape. Notably, The Gentlemen leveraged a massive stockpile of pre-exploited FortiGate devices (CVE-2024-55591) to rapidly scale operations, while LockBit 5.0 returned with multi-platform capabilities and a strategic shift away from US targets to evade law enforcement.

2026-05-136 minHuntresscritical

Huntress has observed an uptick in threat actors exploiting CVE-2026-1731 in outdated Bomgar RMM instances to compromise organizations and their downstream clients. Attackers utilize this access to establish persistence via secondary RMM tools, evade defenses using BYOVD techniques, and ultimately deploy LockBit ransomware.

2026-05-134 minMandianthigh

In 2025, Germany became the primary focus for cyber extortion in Europe, experiencing a 92% surge in data leak site victims. The disruption of major ransomware cartels has given rise to agile mid-tier groups like SAFEPAY and Qilin, who are heavily targeting the German Mittelstand (SMEs) and critical supply chain sectors such as manufacturing and professional services.

2026-05-135 minRecorded Futurehigh

In 2025, the Latin America and the Caribbean (LAC) region faced escalating cybercriminal activity driven by rapid digital adoption and economic instability. Threat actors heavily utilized Telegram and dark web forums to distribute ransomware, banking trojans, and infostealers, increasingly targeting the healthcare, manufacturing, and government sectors while adapting to law enforcement disruptions.

2026-05-134 minCisco Taloshigh

Ransomware tactics in 2025 have shifted heavily toward 'Living off the Land' (LotL) techniques, with threat actors leveraging valid accounts and built-in administrative tools like RDP, PowerShell, and PsExec to evade detection. Qilin has emerged as the most prolific ransomware group, utilizing double-extortion tactics, while manufacturing remains the most targeted industry.

2026-05-137 minESETcritical

Ransomware affiliates increasingly rely on EDR killers—ranging from BYOVD exploits and abused anti-rootkits to driverless tools—to disrupt security solutions prior to deploying encryptors. This approach allows encryptors to remain simple while the EDR killers handle complex defense evasion, complicating attribution and defense strategies.

2026-05-138 minMandiantcritical

In 2025, ransomware operators increasingly relied on vulnerability exploitation for initial access and heavily targeted virtualization infrastructure like ESXi. While overall ransomware profitability appears to be declining, threat actors have adapted by increasing data theft extortion, targeting smaller organizations, and utilizing cross-platform ransomware families like REDBIKE, AGENDA, and INC.

2026-05-134 minWithSecurehigh

The cybercrime-as-a-service ecosystem is evolving rapidly, characterized by a shift towards trading live session tokens, the integration of generative AI for dynamic payload generation, and a preference for data exfiltration over encryption. Defenders must adapt by prioritizing identity monitoring, rapid session revocation, and recognizing the blurring lines between commodity cybercrime and state-aligned operations.