The threat actor k0t is conducting a large-scale campaign targeting network edge devices from FortiGate, FortiWeb, and Palo Alto GlobalProtect. The campaign exploits known vulnerabilities CVE-2025-64446 and CVE-2026-0257, combined with brute-force attacks, to harvest over 70,000 credentials globally. Post-compromise activities include credential theft, Active Directory enumeration, and data exfiltration using Rclone to cloud storage. Persistence is maintained through tools such as MeshCentral, AdaptixC2, and remote management software like Atera and AnyDesk. The campaign overlaps with ransomware groups Qilin and The Gentlemen, suggesting k0t may act as an Initial Access Broker, though no direct affiliation is confirmed.
FortiBleed is an ongoing global campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It exploits reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. Attackers gain access by scanning for exposed SSL VPN portals, performing credential stuffing and password spraying, and cracking stolen password hashes offline. Once inside, they create new administrative accounts for persistence and conduct Active Directory enumeration to expand access. Organizations may experience account lockouts due to attacker actions. The campaign acts as an initial-access broker with links to ransomware affiliates INC/Lynx and Payload, representing a significant medium-severity threat requiring immediate defensive measures.
BraZetsu is a Python-based Windows malware framework used by the Brazilian threat actor Exilware. It functions as a toolkit for Initial Access Brokers, converting compromised systems into assets for sale in underground markets. The malware targets corporate, financial, industrial, and law enforcement sectors primarily in Iberia and Latin America. It harvests financial transaction files in the Brazilian CNAB format, browsing histories, and digital certificates. BraZetsu supports the 'Infected Marketplace' where initial access is sold to criminal clients for further exploitation. Since early 2026, it has rapidly evolved to include AI-enhanced reconnaissance and advanced evasion techniques. There is no indication of known exploits in the wild or available patches.
In late August, an organization was compromised by INC ransomware affecting at least 175 endpoints. The attack unfolded over several weeks with a 17-day gap, indicating involvement of an initial access broker and a separate ransomware affiliate. Early activity included scheduled tasks with randomized names and lateral movement via RDP using compromised credentials. After the pause, attackers deployed AnyDesk for remote access, used Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security controls, and executed ransomware using Impacket tools. Two ransom notes were found: the standard ransom demand and a secondary data leak threat note listing stolen files and threatening to contact media, employees, and partners within 48 hours to pressure the victim.
BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware, functioning as a comprehensive toolkit for Initial Access Brokers. Unlike standard infostealers, BraZetsu transforms compromised systems into commercial assets through deep reconnaissance capabilities targeting Iberian and Latin American corporate, financial, industrial, and law enforcement environments. The framework scans for standardized financial remittance files in Brazilian CNAB format, extracts detailed browser histories, and employs AI-enhanced data triage for target prioritization. Operating through a modular architecture with stealth techniques, BraZetsu powers the Infected Marketplace where Exilware commercializes initial access to compromised hosts. The platform allows criminal customers to remotely execute secondary malicious payloads on purchased access, creating a persistent threat-multiplier effect. Tracked since February 2026, BraZetsu demonstrates rapid technical progressi...
C2Looper is a Rust-based backdoor malware identified in mid-2026, associated with ransomware threat actors. It provides remote shell execution, reconnaissance, and payload deployment capabilities. Initial versions communicate via plaintext HTTP, while later versions use GitHub repositories for command-and-control, storing commands and exfiltrated data in JSON files. Version 2 adds features such as drive enumeration, shellcode injection, and file listing. Delivery is assessed with low to medium confidence to occur through multi-stage ClickFix infection chains. The malware is actively developed and likely used by initial access brokers to facilitate ransomware and data theft operations.
Since January 2026, a threat actor likely functioning as an initial access broker for ransomware operations has been targeting organizations through Microsoft Teams vishing attacks. Attackers impersonate IT helpdesk staff to convince victims to initiate Quick Assist remote sessions. Following initial compromise, PowerShell scripts deploy a Go-based backdoor called GoGRPC, which exists in four distinct variants: Lep, Giver, Pet, and Kind. These variants communicate with command-and-control infrastructure using gRPC over HTTP/2, an uncommon approach that helps blend malicious traffic with legitimate communications. Additional tools observed include BlindDoor backdoor, RevSocket and PyGRPC SOCKS proxies, S3Siphon data exfiltration utility, and RSOX Rust-based proxy relay. Recent campaigns show increased sophistication and selectivity, with heightened focus on corporate environments through enhanced PowerShell scripts capable of antivirus detection, domain controller fingerprinting, and system reconnaissance b...
CVE-2025-5777, known as CitrixBleed 2, is a memory-overread vulnerability in Citrix NetScaler ADC and Gateway appliances. It allows attackers to send malformed pre-authentication login requests that leak memory containing valid session tokens, enabling session hijacking and bypass of multi-factor authentication. Exploitation leads to privilege escalation via a registry-symlink technique targeting the AppMgmt service, creation of rogue administrator accounts, and persistence through legitimate remote access tools. The vulnerability has been actively exploited in multiple unrelated organizations, culminating in deployment of DragonForce ransomware in the most severe cases. The attack chain is highly standardized, indicating a single initial access broker. The vulnerability is listed in the CISA KEV catalog and public exploit code is available. Patch status is not confirmed in the provided data.
Mistic is a stealthy backdoor malware linked to the Woodgnat initial access broker, active since April 2026. It uses sideloading of legitimate Microsoft files to execute payloads in memory without disk writes, enhancing stealth. Mistic includes typical backdoor functions and a self-delete kill switch. It has been observed deployed alongside ModeloRAT, another tool associated with Woodgnat. Targeting is opportunistic across sectors such as insurance, education, IT, and professional services. Woodgnat sells persistent remote access to ransomware affiliates involved with multiple ransomware families. The threat leverages social engineering lures delivered via compromised WordPress sites.
An initial access broker linked to Payouts King ransomware is deploying Edgecution, a sophisticated malware utilizing a malicious Microsoft Edge browser extension. The attack begins through social engineering via Microsoft Teams, impersonating IT staff and directing victims to fake Microsoft websites offering supposed Outlook updates. Edgecution comprises two components: a browser extension that communicates with command-and-control servers via websockets, and a Python-based backdoor. The extension abuses Chrome native messaging protocol to escape browser sandbox restrictions, enabling direct host access. This allows attackers to manipulate the filesystem, launch processes, and execute arbitrary code. The malware operates in a headless browser, remaining invisible to users. Deployment methods include AutoHotKey scripts, Windows batch scripts, and PowerShell scripts. The Python backdoor supports various commands including system information collection, filesystem access, and arbitrary code execution.
An exposed attacker server has unveiled FortiBleed, a large-scale credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways globally. This operation involved credential harvesting through reuse, brute force, and hash cracking using a distributed GPU infrastructure with approximately 36 rented GPUs via Hashtopolis. The exposed directory contained 319 files revealing scanning tools, cracking infrastructure, credential databases, post-exploitation toolkits, and active VPN configurations. While initially reported as affecting 21,632 domains, analysis of the attacker's own tooling reveals only 918 organizations showed evidence of internal network compromise, with merely 148 confirmed cases where credentials were fully cracked. The operation ultimately aimed to sell initial access to compromised networks, with victims spanning 194 countries, predominantly India, United States, and Taiwan.
A multinational law enforcement operation called Operation Endgame has successfully disrupted SocGholish, a malware framework operated by threat actor TA569 since 2017. The operation took down 106 servers and domains and remediated nearly 15,000 compromised WordPress websites. SocGholish uses fake browser update prompts on compromised websites to trick victims into downloading malicious JScript payloads, providing initial access to corporate networks for ransomware deployment and data breaches. Analysis revealed that 55% of Infoblox cloud customers were exposed to SocGholish in 2026, demonstrating widespread impact across multiple industries including government, education, and healthcare. The framework employs domain shadowing techniques and operates through a four-stage attack chain involving traffic acquisition, filtering, fake update lures, and on-device implant execution. SocGholish infrastructure has facilitated access for various ransomware families and has been extensively used by the notorious Evi...
DriveSurge is a newly identified threat actor operating as an Initial Access Broker using a Pay-Per-Install model to supply victim leads to downstream actors. The actor has compromised thousands of websites, injecting malicious code that redirects visitors through zTDS (Traffic Distribution System) to deliver malware via two primary methods: FakeUpdates, which impersonate browser update prompts for Chrome, Firefox, Edge, Safari, and eight other browsers; and ClickFix, which tricks users into executing malicious PowerShell commands disguised as fixes. DriveSurge leverages sophisticated infrastructure including bulletproof hosting, obfuscated JavaScript injection patterns, and environment-specific targeting including macOS systems. The operation has been active since at least September 2025, utilizing specific technical fingerprints including unique file naming conventions and server configurations that enable detection and tracking of their evolving infrastructure.
TA584, a prominent initial access broker targeting organizations globally, demonstrated significant changes in attack strategies throughout 2025. The actor expanded its global targeting, adopted ClickFix social engineering techniques, and began delivering new malware called Tsundere Bot. TA584's operational tempo increased, with monthly campaigns tripling from March to December. The actor uses various delivery methods via email, often sending from compromised individual accounts. TA584's campaigns now feature rapid succession and overlapping, with distinct lure themes and short operational lifespans. The actor has shown adaptability in social engineering, brand impersonation, and payload delivery, making static detection less effective. Recent payloads include XWorm with the 'P0WER' configuration and the newly observed Tsundere Bot, both likely part of Malware-as-a-Service offerings.
Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to conceal malicious activity as routine operations, bypass defenses, and maintain persistence. Their new tactics include Microsoft domain spoofing, curl-to-PowerShell piping, and fileless execution. Storm-0249's ability to weaponize trusted processes and conduct stealthy reconnaissance poses significant challenges for security teams. The group's evolution represents a broader trend in the ransomware-as-a-service ecosystem, lowering the technical barrier for attackers and accelerating the spread of ransomware across sectors.
A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, BlackBasta, and Qilin groups. CountLoader was recently employed in a phishing campaign targeting Ukrainian citizens, impersonating the Ukrainian police. The loader attempts to connect to multiple C2 servers, downloads and executes various malware payloads, and uses advanced techniques to evade detection. It has been observed dropping CobaltStrike and AdaptixC2, among other malicious tools. The malware's functionality includes system information gathering, persistence mechanisms, and multiple download methods.
SocGholish, operated by TA569, functions as a Malware-as-a-Service vendor, selling access to compromised systems to various cybercriminal clients. The primary tactic involves deceptive 'fake browser update' lures initiated by JavaScript injections on compromised websites, leading to drive-by malware downloads. SocGholish leverages Traffic Distribution Systems like Parrot TDS and Keitaro TDS to filter and redirect victims to malicious content. TA569 acts as an Initial Access Broker, enabling other notorious groups and even Russian GRU's Unit 29155 to conduct follow-on attacks, including ransomware deployments. The threat uses domain shadowing and frequent domain rotation to evade detection, making proactive threat intelligence crucial for defense.
SocGholish, operated by TA569, functions as a Malware-as-a-Service vendor, employing deceptive 'fake browser update' lures to compromise systems. It leverages Traffic Distribution Systems like Parrot TDS and Keitaro TDS to filter and redirect victims. TA569 acts as an Initial Access Broker, enabling other cybercriminal groups to conduct follow-on attacks, including ransomware deployments. SocGholish utilizes domain shadowing and frequent domain rotation to evade detection. The malware's infection chain involves multiple stages, from compromised websites to on-device payload delivery. Notable customers include Evil Corp and MintsLoader operators. SocGholish's sophisticated filtering mechanisms and tracking techniques ensure only high-value targets receive the final payload.
An initial access broker exploited leaked Machine Keys on ASP.NET sites to gain unauthorized access to organizations. The group, tracked as TGR-CRI-0045, targeted industries in Europe and the U.S.including finance, manufacturing, and technology. They used ASP.NET View State deserialization to execute malicious payloads in server memory, minimizing forensic artifacts. The attackers deployed post-exploitation tools for persistence and privilege escalation. The campaign began in October 2024, with increased activity from January to March 2025. Organizations are advised to review and remediate compromised Machine Keys following Microsoft's guidance. The threat group is possibly linked to Gold Melody based on overlapping indicators and tactics.
A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazilian electronic invoice system (NF-e) as bait, leading victims to malicious content on Dropbox. The threat actor, likely an initial access broker, abuses free trial periods of RMM tools to gain complete control of target machines. The campaign's objective is to create a network of compromised machines for potential sale to third parties, including ransomware operators and state-sponsored actors. The abuse of commercial RMM tools is increasing due to their digital signatures, full backdoor capabilities, and low cost.
