Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

This intelligence report details a sophisticated cyber intrusion with links to three major ransomware groups: Play, RansomHub, and DragonForce. The attack began with a malicious file impersonating DeskSoft's EarthTime application, which deployed SectopRAT malware. The threat actors used various tools for reconnaissance, lateral movement, and data exfiltration, including SystemBC, Betruger backdoor, AdFind, SharpHound, and Grixba. They leveraged RDP and Impacket's wmiexec for lateral movement, and used WinRAR and WinSCP for data collection and exfiltration. The intrusion lasted six days before the threat actors were evicted, showcasing a range of advanced persistent threat techniques and highlighting the blurred lines between different ransomware operations.

• Akira Ransomware Attack InvestigationMalware2026-10-07
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23
• Authorities disrupt nearly 11,000 cybercrime networks in AfricaNews2026-10-22