The Azazel affiliate of the Gentlemen ransomware group compromised over two dozen organizations across six countries by exploiting CI/CD secrets from GitLab and deeply compromising an AI platform using SSRF, credential decryption, and continuous data exfiltration. Azazel operated an independent leak site called LEAKNED to publish stolen data and manage extortion proceeds. This campaign is notable for the first documented criminal use of AI assistant tooling via the Model Context Protocol (MCP) as a command-and-control channel. The attacker infrastructure included three nodes with over 50TB storage capacity, transferring approximately 6TB of victim data. Affected sectors include logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent organizations.
Galago is a newly identified ransomware operation that emerged in September 2026, claiming operational partnership with the Panzer ransomware group. The connection is suggested through shared infrastructure, specifically matching prefixes in their Tor leak-site addresses (pnzr4del for Galago and pnzruro for Panzer). Galago was first detected following an alleged attack on an Icelandic healthcare organization on 9 September 2026, though this claim remains unverified as their dark leak site showed no published victims. Panzer, described as a ransomware-as-a-service operation, has published 32 victims between August and September 2026 and employs double extortion tactics. While the naming pattern and self-reported claims suggest a relationship, no independent evidence confirms shared operators, malware, or infrastructure control between the two groups.
The Gentlemen is a ransomware group active since July 2025, operating a Ransomware-as-a-Service model with dual-extortion tactics. They target Windows, Linux, and ESXi systems, focusing on extensive preparation before encrypting data. Their methods include privilege escalation using legitimate tools, persistence via registry and scheduled tasks, disabling security tools, deleting logs, and terminating backup services. They use strong encryption algorithms XChaCha20 and Curve25519. The group primarily targets medium-to-large organizations in the Asia-Pacific region, with a recent surge in activity. Victims face ransom demands with about 10-day deadlines and threats of data publication if unpaid.
Check Point Research discovered critical flaws in VECT 2.0 ransomware affecting Windows, Linux, and ESXi platforms. A fundamental encryption implementation error causes files larger than 128 KB to be permanently destroyed rather than encrypted. The malware uses ChaCha20-IETF cipher but only saves one of four decryption nonces required for large files, making recovery impossible even after ransom payment. VECT's encryption speed modes are non-functional, thread scheduling degrades performance, and anti-analysis code is unreachable. Despite partnerships with TeamPCP and BreachForums for distribution, the technical implementation demonstrates amateur execution behind a professional facade. The nonce-handling flaw exists across all platform variants since initial deployment, effectively transforming this ransomware into a wiper for enterprise assets including VM disks, databases, and backups.
NightSpire ransomware, first discovered in February 2025, presents a categorization challenge regarding whether it operates as Ransomware-as-a-Service (RaaS). Analysis of two incidents from December 2025 and March 2026 reveals significant variations in tactics, techniques, and procedures between attacks. The March 2026 incident involved threat actors installing Chrome Remoting Desktop and AnyDesk for persistence, using Everything and 7Zip for data staging, MEGASync for exfiltration, and deploying VMWare Workstation and WPS Office. The attacker accessed systems via RDP days before detection. Comparison with the December 2025 incident shows evolution in the ransomware encryptor, including modified ransom note filenames and contents. These variations in TTPs and indicators suggest either operational evolution or involvement of multiple affiliates, demonstrating that ransomware indicators aren't consistent across campaigns.
This analysis delves into the Beast ransomware, a Ransomware-as-a-Service (RaaS) that emerged in June 2024 as a successor to Monster ransomware. The investigation focuses on a Beast ransomware server detected in March 2026, revealing the operators' toolkit and attack methodology. The toolkit includes various tools for reconnaissance, network mapping, credential theft, persistence, lateral movement, exfiltration, and impact. Notable findings include the presence of both Windows and Linux versions of Beast ransomware, indicating targeting of workstations and Linux servers on VMware ESXi hypervisors. The report highlights the importance of proactive collection of internet telemetry in identifying ransomware operators' toolkits before they can be used against targets.
DragonForce, a ransomware group that emerged in late 2023, has become a significant cyber threat. They employ a dual-extortion strategy, encrypting and exfiltrating data, and have targeted various sectors, particularly manufacturing and construction. The group offers a flexible ransomware-as-a-service platform with advanced features, supporting multiple platforms and encryption modes. DragonForce has announced a shift to a cartel model, allowing affiliates to create their own brands. They've also introduced automated registration for new affiliates and a 'Company Data Audit' service to enhance extortion campaigns. The group has engaged in conflicts with rival ransomware operations and claims to have formed a coalition with other major groups. While their connection to DragonForce Malaysia remains unsubstantiated, technical analysis reveals similarities with other ransomware families and sophisticated attack techniques.
'The Gentlemen' ransomware group, active since July 2025, operates a Ransomware-as-a-Service (RaaS) platform that employs advanced dual-extortion tactics by encrypting data and exfiltrating sensitive information to coerce ransom payments. Their ransomware targets Windows, Linux, and ESXi platforms, encrypting both local and network-shared drives using strong cryptographic algorithms XChaCha20 and Curve25519. Recent updates include automatic self-restart, run-on-boot persistence, configurable encryption speeds, and attack methods, enhancing their operational resilience and adaptability. The group has publicly disclosed 47 victims within two months, indicating rapid propagation and impact. The malware leverages multiple MITRE ATT&CK techniques such as persistence (T1547.001), data encryption (T1486), and network share discovery (T1135). No known exploits or CVEs are associated yet, but the threat is significant due to its multi-platform support and dual-extortion approach. European organizations with mixed OS environments and ESXi virtualization are at particular risk. Mitigation requires tailored detection of persistence mechanisms, network segmentation, and robust incident response plans. Countries with high adoption of VMware ESXi and diverse enterprise IT infrastructures, such as Germany, France, and the UK, are likely most affected.
Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept.2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.
Qilin ransomware is used for domain-wide encryption, and a ransom is then demanded for the decryption keys and/or to prevent the publication of the stolen data. Qilin affiliates are recruited from cybercrime forums to use the Qilin RaaS platform, which handles payload generation, the publication of stolen data, and ransom negotiations.
Cisco Talos Incident Response has observed attacks by Chaos, a new ransomware-as-a-service group conducting big-game hunting and double extortion attacks. The group uses spam flooding, voice-based social engineering, RMM tool abuse, and legitimate file-sharing software for data exfiltration. Their ransomware employs multi-threaded rapid selective encryption and anti-analysis techniques, targeting both local and network resources. Chaos is likely formed by former BlackSuit (Royal) gang members, based on similarities in encryption methodology, ransom note structure, and toolset. The group has impacted various business verticals, predominantly in the U.S., UK, New Zealand, and India. They use the '.chaos' file extension and demand ransoms around $300K, threatening data disclosure and DDoS attacks if not paid.
This analysis examines a recent incident involving Qilin ransomware, highlighting the evolving tactics of cybercriminals to evade Endpoint Detection and Response (EDR) systems. The attackers utilized a previously unknown driver, TPwSav.sys, to disable EDR measures through a technique known as bring-your-own-vulnerable-driver (BYOVD). The report details the entire attack chain, from initial compromise using stolen credentials to the final attempt at deploying ransomware. It emphasizes how rapid isolation of impacted systems and a layered security approach thwarted the attackers. The analysis also provides background on Qilin ransomware, its operation as a ransomware-as-a-service (RaaS), and its targeting patterns. The technical breakdown includes an examination of the EDR bypass technique and the customized version of the EDRSandblast tool used in the attack.
The June 2025 threat analysis reveals an increase in new ransomware samples compared to May. The data is based on detection names from AhnLab and information collected from Dedicated Leak Sites (DLS) of ransomware groups. Statistics cover the past six months, showing the total number of ransomware samples collected. The analysis includes a breakdown of companies affected by ransomware attacks, as posted on DLS. While some data collection may be incomplete or delayed for certain ransomware groups, the report provides insights into the current ransomware landscape. A list of affected companies publicly disclosed by various ransomware groups is also included, along with MD5 hashes of notable samples.
Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an 80% profit share to affiliates supporting Iran or attacking its enemies, blending financial motivations with geopolitical objectives. Pay2Key.I2P employs sophisticated evasion techniques, including anti-analysis checks and obfuscation methods. The operation's strategic marketing on darknet forums and social media platforms indicates a planned rollout, with the addition of Linux-targeted ransomware expanding their attack surface.
A new ransomware strain resembling DragonForce but with unique traits has emerged, possibly connected to an entity called DEVMAN. The sample reuses DragonForce code but adds its own elements, including the .DEVMAN file extension. Attribution is unclear, as the ransom note is identical to DragonForce's. The malware operates offline, probes for SMB connections, and uses three encryption modes. It exhibits different behaviors on Windows 10 and 11, particularly in changing wallpapers. The ransomware encrypts its own ransom notes, likely due to a builder flaw. DEVMAN claims to have stopped using DragonForce months ago, suggesting this may be an experimental or outdated build.
