In April 2026, a manufacturing organization in the Middle East was targeted by a ransomware attack leveraging Active Directory Group Policy Objects (GPOs) without deploying ransomware binaries on endpoints. Attackers with domain admin privileges created malicious GPOs linked at the domain root to distribute ransom notes, modify user interface elements, enforce logon banners, and disable local administrator accounts across all domain-joined workstations. The attack did not encrypt files but focused on operational disruption and data exfiltration. Initial access was obtained via compromised VPN credentials. The attackers delayed activation by one day to evade detection by file-based security tools, exploiting trusted Active Directory infrastructure for domain-wide impact.
An exposed attacker server has unveiled FortiBleed, a large-scale credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways globally. This operation involved credential harvesting through reuse, brute force, and hash cracking using a distributed GPU infrastructure with approximately 36 rented GPUs via Hashtopolis. The exposed directory contained 319 files revealing scanning tools, cracking infrastructure, credential databases, post-exploitation toolkits, and active VPN configurations. While initially reported as affecting 21,632 domains, analysis of the attacker's own tooling reveals only 918 organizations showed evidence of internal network compromise, with merely 148 confirmed cases where credentials were fully cracked. The operation ultimately aimed to sell initial access to compromised networks, with victims spanning 194 countries, predominantly India, United States, and Taiwan.
Threat actors have been observed exploiting Net Monitor for Employees Professional and SimpleHelp software in ransomware operations. These legitimate tools were used for remote access, command execution, and persistence. The attackers disguised Net Monitor as Microsoft OneDrive and configured SimpleHelp with cryptocurrency-related keyword triggers. In one case, the attack led to an attempted deployment of Crazy ransomware. The intrusions involved initial access through compromised VPN accounts, followed by the installation of these tools for remote control and monitoring. The shared infrastructure and tactics suggest a single threat actor or group behind these activities, with objectives including cryptocurrency theft and ransomware deployment.
