Overview 

The UK's National Cyber Security Centre (NCSC) has put a date on a threat that security teams across Europe have been bracing for. In its 2026 Annual Review, The State of the Cyber Nation, the agency assesses it is highly likely that AI-powered malware will be used in a ransomware attack on UK Critical National Infrastructure by 2028. 

That is not a distant, speculative scenario. It is a two-year window, and it lands alongside a second judgement. By 2028, China, Russia and other nation-states will highly likely be using AI-enabled cyber capabilities routinely to pursue geopolitical goals, with the UK facing sophisticated attacks at greater scale and speed. 

The review also recorded that UK and EU member states jointly attributed a December 2025 attack on Poland's energy grid to Russia's FSB Centre 16. Had it succeeded, roughly 500,000 citizens could have lost power. Europe is not watching this threat from the sidelines; it is where the playbook is being tested. 

Key Takeaways 

• 2028 is the marker. The NCSC judges AI malware will highly likely be used in ransomware against UK CNI before the end of 2028. 

• Europe's grid is already a target. Russia's FSB Centre 16 was attributed to the December 2025 attack on Poland's energy grid, and a July 2026 advisory from 18 partners in 12 countries flagged the same group exploiting vulnerable routers to reach CNI networks worldwide. 

• China is best positioned to use AI against CNI. The NCSC rates China's activity as the most sophisticated and sustained cyber challenge facing the UK. 

• AI speeds up old tricks rather than inventing new ones. For large organizations, 88% of incidents the NCSC handled began through just four initial access vectors. 

• A "patch wave" is coming. AI-assisted vulnerability discovery will shrink the time defenders have between disclosure and exploitation. 

• The gap is widening. Organizations with legacy technology and slow remediation will become the preferred targets of both states and criminals. 

The 2028 Warning 

The NCSC's assessment is precise about where AI makes the difference. It calls AI an almost certain "force multiplier" that improves reconnaissance, social engineering, vulnerability discovery and exploit development. The biggest effect, it says, will be faster and larger versions of existing tactics rather than brand-new attack vectors. 

Ransomware is where that acceleration hits CNI hardest. The review expects criminal adoption of AI to raise the scale and efficiency of ransomware, social engineering and exploitation. It also warns that open-source AI tools built for security researchers are likely to be repurposed to automate criminal workflows, cutting costs and raising attack volumes against less resilient targets. 

The agency is careful not to overstate today's reality. Its Incident Management team has begun to see attackers using AI tools, but none of the observed uses enabled a new class of attack. Human operators remain essential, and the NCSC notes that losing control of an agentic AI is likely to hinder threat actors from reaching their goals. 

The review's pessimistic 2028 scenario shows why that caveat may not last. In it, frontier AI is available to everyone from state actors to novice hackers, jailbroken models are sold in criminal marketplaces, and attribution becomes harder as capability spreads. It even describes a realistic possibility of an automated cyber actor operating beyond its operator's control. Cloud-controlled CNI and AI-driven robotics raise the chance that a digital compromise causes physical harm. 

The NCSC stresses this is an illustration of the cost of inaction, not a forecast. But it is a scenario written by the agency responsible for defending UK infrastructure, and it is set just two years out. 

Europe: The Proving Ground for CNI Attacks 

If the UK is looking at 2028, continental Europe is already living with the threat. The NCSC names Russia as the most audacious cyber threat to the UK today. GCHQ Director Anne Keast-Butler goes further in the review's foreword, warning that tactics Russia developed against Ukraine are now being turned more widely on states and their institutions. 

Three data points from the review frame the European picture: 

• Poland's energy grid (December 2025). The UK and EU member states formally attributed the attack to FSB Centre 16. If successful, it could have cut electricity to around 500,000 people. 

• Router exploitation on a global scale (July 2026). The NCSC and 18 international partners from 12 countries issued a joint advisory on FSB Centre 16 actors exploiting vulnerable routers to target CNI networks worldwide. On the same day, the UK sanctioned 24 individuals and entities tied to destructive cyber and hybrid operations, including criminals running proxy networks linked to Russian intelligence. 

• Operational technology in crosshairs. The review points to recent attacks on programmable logic controllers (PLCs) as evidence that organizations failing to modernize are falling behind. 

The pattern matters for anyone running energy, water, transport or telecoms in Europe. Grids, interconnectors and supply chains cross borders, and a disruptive attack in one country can cascade into its neighbors. The review also describes how cyber threats to the UK can escalate rapidly and without warning during periods of geopolitical tension. 

Add AI to this mix and the timeline compresses. A state actor that today relies on patience and known router flaws could, with AI-assisted discovery and exploitation, find and weaponize new weaknesses across thousands of European edge devices far faster than defenders can patch them. 

China is Best Positioned to Turn AI on Critical Infrastructure 

While Russia is the loudest threat, the NCSC sees China as the most capable. It judges that China highly likely has both the intent and the best position to use AI against CNI and other strategic targets. Its frontier AI programmes are expected to sharpen vulnerability identification, targeting efficiency and access operations. 

Data sits at the center of that strategy. The review describes China collecting large volumes of information from the UK and elsewhere, then using it to train models and improve capability. In the AI era, stolen data is no longer just espionage material; it is fuel. 

The UK has already acted on this. In December 2025, it sanctioned two China-based firms: i-Soon, which targeted more than 80 government and private IT systems globally, and Integrity Technology Group, which the FBI has linked to the Flax Typhoon intrusions. In April 2026, the NCSC and 15 partners across nine other countries published guidance on the covert networks most China-linked actors use to hide their activity. 

The 2028 scenario adds a further concern: China, as a leading developer, may help spread advanced AI-cyber capability to other actors, letting them hide in the noise and making attribution harder for European defenders. 

AI Runs the Old Playbook, Only Faster 

The most useful finding in the review is also the least dramatic: attackers are still getting in through the basics. Over the past year, the NCSC received 1,831 reports of cyber attacks. Of these, 337 needed its direct support, and 80 were classed as nationally significant. 

For large organizations, 88% of incidents started through four initial access vectors: 

1. Exploiting public-facing applications 

2. Phishing 

3. Misuse of valid accounts 

4. Exploiting external remote services 

Even state-linked intrusions often used flaws for which patches already existed but had not been applied quickly enough. As the review puts it, sophisticated actors do not need to be sophisticated to gain initial access; their skill shows in what they do once inside. 

This is exactly where AI changes the economics. The NCSC expects AI-assisted vulnerability discovery to give attackers more chances to hit systems before owners patch them. It is urging every organization to prepare for a "patch wave": a surge of security updates across the technology stack, many of them critical, as AI exposes years of technical debt. 

Two further risks deserve attention: 

• Shadow AI. Staff moving sensitive data to personal devices to use unsanctioned AI tools leaves organizations blind to where that data goes, and open to both APT groups and criminals. 

• The widening gap. Mature, well-resourced organizations will use AI to detect and fix faster. Those running legacy systems will fall further behind and become more attractive targets. 

The financial stakes are already clear. UK government research cited in the review puts the annual cost of malicious cyber activity to UK organizations at about £14.7 billion. The 2025 attack on Jaguar Land Rover alone cost the company around £196 million in direct costs and contributed to UK GDP growing just 0.1% in Q3 2025. 

How the UK Is Fighting Back With AI 

The NCSC's answer is to meet machine-speed attacks with machine-speed defense. Several initiatives in the review stand out: 

• Cyber Shield. A joint NCSC and DCMS programme to build a national agentic cyber defense ecosystem over five years. The NCSC supplies the platform and intelligence, while defensive agents are built by the security market and open-source community. Early phases focus on detection and blocking, where automation is already practical. 

• Project DROMOS. Launched in 2026 by the Government Cyber Coordination Centre and the AI Security Institute, it used frontier AI models to review government codebases. Expanded into live environments, it surfaced hundreds of potential security issues, including critical vulnerabilities. 

• National Detect Strategy. A pilot aiming, by 2030, to ensure defenders across critical systems can detect and respond to known vulnerabilities and attacker techniques at organizational, community and national scale. 

• Regulation and benchmarks. The Cyber Security and Resilience Bill brings new sectors into scope and adds national security powers. The new CAF Core Profile sets a minimum resilience baseline for essential services. 

There are early results. Under the Government Cyber Action Plan, the median time to fix domain-related vulnerabilities fell from 50 days to 8. The Early Warning service now covers 19,922 organizations, up 52% on last year. 

For Europe, the lesson is that partnership is now part of the defense. The review highlights the world's first AI security standard developed through ETSI, the European standards body, as proof that allies can shape AI security while the technology is still evolving. 

National defense at machine speed also depends on seeing adversaries before they reach the network. Groups like FSB Centre 16 and China-linked operators plan, recruit, and trade access in places most defenders never look. As AI makes attribution harder, government agencies, national CERTs, and defense bodies need intelligence that tracks threat actors across the open, deep, and dark web and connects that activity to the infrastructure being targeted. Cyble Hawk is built for exactly this. It gives national security teams sovereign threat intelligence, adversary profiling, and investigative support. That means early warning of campaigns against critical infrastructure and stronger attribution when an attack does land. Book a demo to see how your agency can move from reacting to incidents to anticipating them. 

Recommendations for CNI Operators in the UK and Europe 

The NCSC's core message is that AI did not create these weaknesses; it is exposing them faster. Operators of critical infrastructure should act on the following now: 

1. Harden the edge first. Inventory and patch internet-facing applications, VPNs, routers, and remote access services. These are the routes FSB Centre 16 and others are actively exploiting. 

2. Prepare for the patch wave. Build processes to test and deploy security updates more often, faster and across suppliers. Track time-to-remediate as a board-level metric. 

3. Kill password-based access where you can. Move privileged and remote users to phishing-resistant authentication such as passkeys, and audit valid accounts for misuse. 

4. Segment IT from OT. Limit the paths from corporate networks to PLCs and industrial control systems, and monitor those boundaries continuously. 

5. Govern AI use internally. Map what data AI tools and agents can access, what actions they can take, and how they are monitored. Close off shadow AI with approved alternatives. 

6. Rehearse recovery, not just prevention. Test ransomware response playbooks against scenarios where operational systems must run during disruption. Use the NCSC's guidance on recovering from highly disruptive attacks. 

7. Lock down the supply chain. Require baseline controls such as Cyber Essentials, or equivalent standards in EU frameworks, from suppliers with access to critical systems. 

8. Use threat intelligence that moves at AI speed. Monitor for exploitation of newly disclosed flaws, stolen credentials, and chatter about your sector, so you can act before an incident escalates. 

9. Start post-quantum planning. The NCSC wants discovery and migration planning finished by 2028, priority migrations by 2031 and full migration by 2035. 

Conclusion 

The NCSC has given Europe a deadline. By 2028, AI-powered ransomware against UK critical infrastructure moves from possibility to expectation, and state actors will be using AI as a routine part of their operations. The Poland grid attack and the global router campaign show the targeting is already in place; AI simply adds speed and scale. 

The agency's own framing is a "moment of choice." Organizations that modernize, patch fast, and build resilience now will be able to absorb what comes next. Those that defer will find AI exposing their technical debt faster than they can repay it. 

For CNI operators across the UK and Europe, the next two years are the window to close the gap. Continuous visibility into emerging vulnerabilities, active exploitation and threat actor activity will be central to staying ahead of attacks that move at machine speed. 

Source 

• NCSC Annual Review 2026: The State of the Cyber Nation 

The post AI-Powered Ransomware Is Coming for UK Critical Infrastructure, and Europe Is Already the Testing Ground appeared first on Cyble.

This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble's global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).

The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks. 

On the industrial side, CISA issued 14 ICS advisories covering 54 vulnerabilities. Of these, 13 were rated critical, 18 high, 18 medium, and five low. 

Affected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.

Cyble sensors also recorded active malware campaigns, phishing emails, and brute-force attacks against internet-exposed services.

Real-World Attacks Observed by Cyble Sensors 

Attackers moved quickly against newly disclosed flaws in web platforms and AI tooling, while older IoT and embedded-device bugs continued to draw steady traffic. 

CVE-2026-63030 — WordPress REST API 

CVE-2026-63030 is a route-confusion flaw in a WordPress REST API batch endpoint. It affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. 

Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE). 

CVE-2026-44825 — Apache Solr 

CVE-2026-44825 is a hardcoded credential in the Basic Authentication setup tool of Apache Solr 9.4.0 through 9.10.1 and 10.0.0. 

Remote attackers can use it to access a Solr cluster with administrative privileges. 

CVE-2026-9198 — Langflow 

CVE-2026-9198 affects IBM Langflow OSS 1.0.0 through 1.10.0. Unauthenticated attackers can chain two API endpoints to obtain superuser tokens and execute arbitrary code. 

Sensors also caught attempts against an older Langflow code injection flaw, CVE-2025-3248. Repeated targeting of the same AI workflow platform signals sustained attacker interest. 

CVE-2025-68613 — n8n 

CVE-2025-68613 is a critical RCE flaw in the n8n workflow automation platform. Expressions supplied by authenticated users can run in an insufficiently isolated context, enabling full system compromise. 

Fixes are available in versions 1.120.4, 1.121.1, and 1.122.0. 

CVE-2026-4020 — Gravity SMTP 

CVE-2026-4020 affects the Gravity SMTP WordPress plugin, versions 2.1.4 and earlier. An exposed REST API endpoint lets unauthenticated users pull system reports containing server details, database metadata, and configured API keys or tokens. 

CVE-2024-6587 — LiteLLM 

CVE-2024-6587 is a server-side request forgery (SSRF) flaw in LiteLLM. Exploitation can expose OpenAI API keys. 

Older Flaws Still in Rotation 

Cyble sensors also logged exploitation attempts against: 

• CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer's GetMap operation 

• CVE-2024-7591, an OS command injection flaw in Progress LoadMaster 

• CVE-2024-4577, a critical PHP-CGI argument injection flaw 

• CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

• CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

• CVE-2025-46565, a file access control bypass in the Vite development server 

• Command injection flaws in QNAP QTS firmware 

• Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

2. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

3. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

4. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

• CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

• WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

• Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

• IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky's Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as "sa," "root," "password," and "123456." 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA's 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems' TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik's download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision's YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

• Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

• Persistent attacks on years-old embedded-device and router vulnerabilities 

• Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

• Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

• Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

• Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

• Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

• Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

• Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

• Apply compensating controls, such as network isolation, for ICS products without available fixes 

• Verify firmware integrity on remote field devices and cellular gateways 

• Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

• Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

• Conduct regular vulnerability assessments and penetration testing 

Cyble's attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

The post The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws appeared first on Cyble.

A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded "Don't Get Played," was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names "Apex Accelerator" and "Stone Venture."

According to a police report filed by one attendee with the Singapore Police Force, the organizers allegedly pressured guests to install software that would have handed the organizers remote control of their computers.

The allegation first gained traction on X, where several other users claimed they had also been approached by the same group.

What the "Don't Get Played" Police Report States 

The document circulating online is page two of a six-page Singapore Police Force report (form NP299), bearing reference number E/20261011/7004. In it, the complainant lists the group's website as token.apexaccs.org and notes that the event's Telegram group had no public URL; prospective attendees could only join through the website. 

The report is titled "Suspected cyber scam targeting TOKEN2049 attendees ('Don't Get Played' event)." Its summary reads: 

"A group using the names 'Apex Accelerator', 'Stone Venture' and 'Don't Get Played' promoted a crypto security event for TOKEN2049 week (Sun 11 Oct 2026, 6pm to 10pm, The Singapore EDITION). They pressured attendees to install software that would give them remote control of their computers. I did not install their software and have no financial loss." 

Two details in that statement matter. First, the person who filed the report says they did not install anything. Second, they report no financial loss. The filing therefore documents an alleged attempt rather than a confirmed compromise. 

How the TOKEN2049 Side Event Was Pitched 

On paper, "Don't Get Played" looked like exactly the kind of session a careful attendee would seek out. It was marketed as a security-focused gathering designed to help people protect themselves from token scams. 

The event was scheduled for The Singapore EDITION hotel in early October 2026. Entry was free, though guests had to register beforehand, and attendance was capped at 200 people, as detailed by Crypto Briefing.  

The agenda featured a live "wallet clinic" where attendees could have their holdings checked with "Apex Audit" tools. These were promoted as scanners for token risk and honeypots, a term for tokens engineered so that holders can buy them but are never able to sell. 

The promotional material also advertised a panel on how crypto scams have evolved, listing representatives from Spartan Group, Bybit's security team, and the Singapore Police Force Cyber Command among the speakers. 

The final hook was a giveaway. Every confirmed guest was promised a free year of Sophos MDR endpoint protection, bundled with up to $1 million in breach coverage. Research into the event suggests this offer was a major driver of interest. 

There is nothing in the available material indicating that Spartan Group, Bybit, Sophos, or the Singapore Police Force Cyber Command played any part in the alleged conduct. Their names appeared in the event promotion, and that is the full extent of what the sources establish. 

The Allegation and the Gaps in the Record 

The central claim is simple: organizers of "Don't Get Played" allegedly pushed attendees to install software that would give a third-party remote access to their machines. At a crypto event, where many guests carry laptops connected to wallets and exchange accounts, that level of access could be enough to empty funds. 

Several important facts remain unclear. The source material does not name the software attendees were allegedly asked to install. It does not state whether anyone lost money, and it does not say how many people may have been targeted. 

As of October 12, 2026, no mainstream coverage of a police report involving the organizers, or of complaints from victims, could be located. The Singapore Police Force has not publicly confirmed the filing. Apex Accelerator and Stone Venture have not been charged with any offense based on the information available, and their account of events has not yet entered the public record. 

How the Crypto Community Reacted to "Don't Get Played"? 

After SolanaFloor shared the police report on X, the replies split between people claiming firsthand contact, skeptics, and users offering security advice. The account 0xKYM Registry (@KYMRegistrySG) said it filed the report and shared what it described as a scan of the installation's contents.  

Several others, including FamCrypt (@Famous0x3), NomadFury (@NomadFury_), and Sabya | YeNo (@SabyaYeNo), said the group had approached or pressured them to install software or buy a subscription. Alex (@alwye) claimed Apex Accelerator had used similar tactics in Twitter DMs. 

Not everyone was convinced. Sprunky (@sprunky_eth) argued that "page 2 of a report is not a finding," noting the complainant lost nothing, SPF had not confirmed the filing, and no charges exist. Others questioned how anyone could be pressured in Singapore or who vetted the project for the TOKEN2049 lineup. 

Security-minded users focused on the risk. StakeCraft (@stakecraft) called remote laptop access at a crypto event "a wallet drain waiting to happen," and Jey (@TheWarKettle) advised anyone who installed the software to treat the device as compromised, move funds from a clean device, and rotate every password and key.  

Others pointed to fake Luma after-party links and similar incidents at other conferences, and one user floated an unsupported DPRK link. Many replies also mocked the irony of a security event called "Don't Get Played" allegedly becoming the play. 

Conclusion 

The "Don't Get Played" allegations rest on a single attendee's police report and a growing set of claims on X, none of which have been confirmed by authorities. Several questions remain open. 

Will Singapore authorities confirm that a report was filed? Will Apex Accelerator or Stone Venture respond publicly? And will Spartan Group or the Singapore Police Force Cyber Command clarify whether they had any connection to the event? Until those answers arrive, the safest assumption for attendees is the one the event's own name suggested: any request to install software deserves suspicion.

References:  

• https://x.com/SolanaFloor/status/2109654244655812768 

• https://cryptobriefing.com/apex-accelerator-stone-venture-token2049-scam/ 

• https://x.com/DefraudTG/status/2109869264718971363 

Disclaimer: This blog is based on publicly available information, including a police report and posts shared on X, as of October 13, 2026. Cyble has not independently verified these claims. The allegations remain unproven, and naming any organization does not imply its involvement. This content is for informational purposes only and is not legal or financial advice. 

The post “Don’t Get Played”: TOKEN2049 Security Event Faces Remote-Access Scam Allegations appeared first on Cyble.

Cloud infrastructure now changes by the hour, yet many security teams still map their external attack surface once a quarter or once a year. That mismatch creates blind spots that can last for months.  

A developer spins up a test environment on a Tuesday, an engineer opens a storage bucket for a partner on Wednesday, and a marketing team launches a campaign subdomain on Friday. If the next external assessment is scheduled for December, each of those assets sits exposed and unmonitored until then. 

For CISOs, security operations leads, and cloud security leads, the question is no longer whether the attack surface is growing. The question is whether visibility is keeping pace. In 2026, point-in-time scanning is structurally unable to do that. 

Why Cloud Sprawl Breaks the Quarterly Scan 

A point-in-time scan produces an accurate picture of one moment. In a static data center, that picture stayed useful for weeks. In a multi-cloud estate driven by infrastructure as code, CI/CD pipelines, and self-service provisioning, it starts to decay within hours. 

Three forces drive that decay: 

• Ephemeral assets. Containers, serverless functions, and short-lived virtual machines appear and disappear between scan windows, so they are never inventoried at all. 

• Decentralized ownership. Business units, contractors, and acquired subsidiaries open their own cloud accounts and SaaS tenants, often outside central security review. 

• Configuration drift. A security group, storage permission, or DNS record that was correct during the last assessment can be changed by a single commit. 

The NSA's Top Ten Cloud Security Mitigation Strategies warns that misconfigured, unsecured, or unmonitored cloud systems are attractive targets, and it flags "ghost assets" created by manual error. A quarterly scan cannot find a ghost asset that was created the day after it finished. 

What Government Data Says About the Exposure Window 

US federal policy has already moved past the quarterly model. CISA's Binding Operational Directive 23-01 requires federal civilian agencies to run automated asset discovery every 7 days and vulnerability enumeration every 14 days.  

Agencies must also be able to launch on-demand discovery within 72 hours of a CISA request. CISA's implementation guidance goes further: a new scan must start every 14 days even if the previous one has not finished. If a weekly cadence is the floor for federal networks, a 90-day cycle leaves private-sector enterprises roughly 13 times less current. 

The cost of lagging visibility is rising. The FBI's 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses, a 26% increase over 2024. Ransomware complaints rose to 3,611, up from 3,156 the year before. 

The pattern is global. The ENISA Threat Landscape 2025 found that vulnerability exploitation accounted for 21.3% of initial access in the EU, with widespread campaigns weaponizing flaws within days of disclosure.  

CERT-EU reported that exploitation of internet-facing software was the highest-impact initial access vector for the second straight year. When attackers move in days, a defender that looks every 90 days has already lost the race. 

What Continuous Attack Surface Management Requires 

Closing the gap is not a matter of scanning more often. It requires a different operating model built on four capabilities: 

1. Outside-in discovery. Assets are found the way an attacker finds them, through DNS, certificates, IP space, and cloud provider ranges, rather than from an internal inventory that may already be stale. 

2. Continuous monitoring. New subdomains, open ports, exposed services, and certificate changes are detected as they appear, not at the next scheduled window. 

3. Threat-informed prioritization. Findings are ranked by real-world exploitability and attacker interest, so teams fix the exposures most likely to be used first. 

4. Ownership and workflow. Each exposure is routed to the team that owns it, with remediation tracked to closure. 

This model maps directly to what BOD 23-01 asks of federal agencies and to the asset visibility expectations in the NIST Cybersecurity Framework 2.0. 

How Cyble Attack Surface Management Closes the Gap? 

Cyble Attack Surface Management, powered by Cyble Odin, replaces periodic snapshots with a continuously updated view of an organization's external footprint. Odin scans internet-facing infrastructure on an ongoing basis, so newly exposed hosts, cloud services, open ports, and misconfigured assets are surfaced shortly after they go live. 

For CISOs, this turns attack surface reporting from a quarterly slide into a live risk metric that can be tracked against board-level objectives. For security operations leads, it means alerts on new exposures arrive in time to act, ranked by exploitability rather than raw volume. For cloud security leads, it provides an attacker's-eye check on multi-cloud sprawl, catching shadow assets and drift that internal tooling misses. 

Because Cyble ASM draws on Cyble's broader threat intelligence, including dark web and exploit activity, teams can see which exposed assets are being discussed or targeted by threat actors. That context helps US organizations align with the continuous visibility model CISA has set for federal networks, and it gives global teams a consistent view across regions and cloud providers. 

Conclusion 

Cloud environments will keep changing faster than any scheduled assessment can follow. Government guidance has already acknowledged this: weekly discovery is the federal baseline, and attackers weaponize new flaws within days. Organizations that still assess their external attack surface quarterly or annually are accepting months of unmonitored exposure by design. 

The shift to continuous attack surface management is no longer a maturity goal. In 2026, it is the minimum standard for knowing what an attacker can see. 

See your attack surface in real time. Book a demo of Cyble Attack Surface Management (Cyble Odin) to find the exposures your last scan missed. 

Sources 

• CISA BOD 23-01 

• CISA BOD 23-01 Implementation Guidance 

• FBI 2025 Internet Crime Report 

• NSA Top Ten Cloud Security Mitigation Strategies 

• ENISA Threat Landscape 2025 

• CERT-EU Threat Landscape Report 2025 

The post Attack Surface Management in 2026: Why Point-in-Time Scans Can’t Keep Up With Cloud Sprawl appeared first on Cyble.

Nation-state operators rarely need a zero-day to get inside a carrier. Much of the telecom stack still runs protocols designed when every participant was a known, trusted operator. SS7 assumes that the node sending a request has a legitimate reason to send it.  

BGP assumes a network announcing a route actually owns it. Attackers who understand those assumptions can operate inside a carrier for years without triggering a single alert. For telecom CISOs and SOC teams, defending this environment starts with understanding how these attacks actually work. 

SS7: A Protocol That Trusts Every Caller 

SS7 is roughly 40 years old and still underpins 2G and 3G SMS and phone services as well as international roaming. Its weakness is architectural. Any node with signaling access can send Mobile Application Part (MAP) queries asking where a subscriber is, or tell the network to route that subscriber's SMS elsewhere.  

SS7 has no built-in way to confirm the request came from someone entitled to make it. Access is also easier to get than many assume. Leased Global Titles, loosely vetted roaming partners, and compromised operators all provide an entry point. 

The consequences are well documented. SS7 can enable location tracking, interception of voice data and multi-factor authentication keys, and can even serve as a spyware delivery vector. Moving to newer generations doesn't solve the problem. The 4G and 5G Diameter protocol has its own location tracking weaknesses, and 4G and 5G users can be downgraded to SS7 when roaming. 

U.S. government assessments are blunt. The Department of Homeland Security concluded in 2017 that all U.S. carriers are vulnerable to SS7 and Diameter exploits, and a DHS presentation named Russia, China, Israel and Iran as the primary countries reportedly using other nations' telecom assets to exploit U.S. subscribers.  

These attacks often travel indirectly. According to that material, the traffic was being routed through third-country networks. The tooling is also spreading. Cyble's dark web researchers have confirmed that SS7 and Diameter exploits and services are still routinely discussed on underground forums, including detailed attack exploits. 

BGP: Internet Routing on the Honor System 

BGP has the same trust problem at internet scale. The FCC has noted that the protocol was designed decades ago and offers no intrinsic way to verify route origination. If a network announces a prefix it doesn't own, or a more specific slice of one, its neighbors will often accept the announcement and send the traffic to it. 

The best-known case is still a warning for the industry. According to the U.S.-China Economic and Security Review Commission's 2010 report to Congress, China Telecom advertised erroneous routes for about 18 minutes on April 8, 2010, pulling traffic for roughly 15 percent of internet destinations through Chinese servers, including traffic to U.S. government and military sites.  

Regulators are now responding. In 2024, the FCC proposed that broadband providers build BGP security plans based on RPKI, with the nine largest filing those plans confidentially and publishing quarterly progress data. 

The Router Layer: Where Persistence Lives 

Signaling and routing abuse are only part of the picture. The most serious recent intrusions have targeted the hardware that carries the traffic. A 2025 joint advisory from CISA and allied agencies found that PRC state-sponsored actors focus on large backbone routers of major telecom providers, along with provider edge and customer edge routers, and use compromised devices and trusted connections to pivot into other networks.  

They often modify routers to maintain persistent, long-term access. 

Initial access typically came through known vulnerabilities, not novel ones. The advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level code execution.  

Once inside, the Salt Typhoon cluster implanted malicious code on network devices and configured GRE tunnels to pull data through compromised routers. 

Aging infrastructure makes eviction harder. U.S. Senator Mark Warner, describing carrier networks, said there is equipment "so old it's unpatchable". 

Why Detection Lags 

These intrusions have a common pattern. SS7 abuse looks like normal roaming traffic. A hijacked prefix looks like an ordinary route update. A rogue GRE tunnel looks like legitimate provisioning. None of them runs on an endpoint where EDR can see it.  

By the time anomalous activity shows up internally, the attacker has usually already mapped the network and started moving laterally. 

Defending this environment takes several layers working together: 

• Signaling: Deploy SS7 and Diameter firewalls and vet Global Title partners strictly. 

• Routing: Publish Route Origin Authorizations and enforce RPKI origin validation. 

• Router hygiene: Patch the CVEs above immediately, and audit every tunnel, mirror session, and AAA configuration against an approved baseline. 

• External visibility: Track what happens outside your perimeter, where attacks are often planned before they launch. 

Where Cyble Vision Fits 

External visibility is the gap Cyble Vision closes. It tracks underground forums where SS7 exploits and signaling access are traded, and flags leaked credentials and device configurations tied to your infrastructure.  

It maps exposed management interfaces across your attack surface and prioritizes the edge-device vulnerabilities state actors are actively exploiting.  

Threat actor intelligence connects those signals to the groups behind them, so your SOC can act on early indicators instead of reconstructing a breach after the fact. 

See intrusions before lateral movement starts. Book a Cyble Vision demo → 

References 

• https://www.wyden.senate.gov/imo/media/doc/wyden-schmitt_dod_letter.pdf 

• https://docs.fcc.gov/public/attachments/DOC-402579A1.pdf 

• https://www.washingtonpost.com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/ 

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a 

• https://docs.fcc.gov/public/attachments/FCC-24-62A1.pdf 

• https://www.uscc.gov/sites/default/files/annual_reports/2010-Report-to-Congress.pdf 

The post Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions  appeared first on Cyble.

Cybersecurity compliance APAC 2026 has moved from guidance to enforcement across three of Southeast Asia's largest economies, almost in step. Singapore's Cyber Security Agency issued an updated Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026.

Malaysia's Cyber Security Act 2024 has been active since August 2024, with NACSA now well into audits and incident-reporting enforcement. Thailand's Cybersecurity Act NCSA mandate now covers new cloud and website security standards, with the cloud standard already in force. 

None of this happened quietly, and none of it is optional for the organizations it covers. For enterprise CISOs and compliance leads across ASEAN, the message from three separate regulators is the same: continuous monitoring and fast incident reporting are now the baseline for Critical Information Infrastructure APAC-wide, not the aspiration. 

Singapore Cybersecurity Code of Practice 2026 

Singapore Cybersecurity Code of Practice 2026 is the first substantial revision since 2022, and it changes who is accountable and how far the obligations reach. Boards of Critical Information Infrastructure owners must now maintain a documented cyber resilience framework, sit through cybersecurity training at least once a year, and receive threat briefings twice a year.

The code also extends mandatory controls to "Interconnected Systems" — the vendor platforms and adjacent networks that talk to CII but were never designated as CII themselves.

CSA has been explicit about why: Advanced Persistent Threats and AI-enabled attacks are shortening the gap between a vulnerability's discovery and its exploitation, and perimeter-only defense no longer covers that gap. Most obligations take effect by 29 July 2027, with Cyber Trust Mark Tier 5 certification required by the end of that year. 

Malaysia Cyber Security Act 2024 and NACSA Compliance Malaysia 

Malaysia Cyber Security Act 2024 has already reshaped how National Critical Information Infrastructure entities operate.  

NACSA compliance in Malaysia now demands that organizations across the 11 CNII sectors run periodic risk assessments and audits, work only with NACSA-licensed cybersecurity service providers, and notify authorities as soon as they become aware of an incident — with detailed follow-up required within hours through the national coordination system, and a full account due within 14 days. 

 Failure to report carries fines of up to RM500,000 and up to ten years' imprisonment. That penalty structure alone has pushed incident detection speed onto the CISO's list of board-level metrics. 

Thailand Cybersecurity Act NCSA and Cloud Security Standards Thailand 

Thailand Cybersecurity Act NCSA authority extends to a narrower but no less demanding set of obligations. NCSA cloud security standards Thailand has enforced since 10 September 2026 require government agencies, state enterprises, and cloud service providers to maintain encryption, access control, and at least annual security assessments across IaaS, PaaS, and SaaS environments.  

A companion Website Security Standard, effective 16 September 2026, asks organizations serving the public to formalize risk registers, access governance, and incident response practices aligned with standards like ISO/IEC 27005. Both sit on top of Thailand's Cybersecurity Act B.E. 2562, which already empowers the NCSA to designate and directly oversee Critical Information Infrastructure. 

Detection Speed is Now a Compliance Metric 

Read together, these three frameworks are not really about paperwork. They are about how fast an organization can see a threat, understand it, and prove that it acted. Board-level cyber resilience reviews, hours-not-days incident notification windows, and mandatory continuous monitoring across cloud and interconnected systems all assume real-time threat intelligence APAC organizations rarely have in place today. 

That is precisely where most regional enterprises still fall short. The ASEAN cyber threat landscape has historically produced reactive detection — SOC teams responding to alerts generated after compromise, or intelligence arriving too late and too generic to inform an actual decision.  

Regulators in Singapore, Malaysia, and Thailand have each, independently, concluded that this model no longer meets the moment. AI-accelerated reconnaissance, faster exploit development, and an increasingly interconnected regional supply chain mean the window between initial access and material damage keeps shrinking. 

Where Cyble Vision Actually Fits?

The gap between what these regulations now require and what most enterprises currently have is specific: visibility into threats before they become incidents, and evidence that can be produced when a regulator asks for it. Cyble Vision is built around that gap rather than around it as a slogan. 

The platform monitors surface, deep, and dark web sources continuously — underground forums, ransomware leak sites, and cybercrime marketplaces — to surface exposed credentials, leaked data, and threat actor chatter referencing an organization before that activity turns into a breach.  

Cyble's attack surface management solutions keeps a running inventory of internet-facing assets, cloud services, and adjacent vendor systems, which maps directly onto Singapore's requirement to account for Interconnected Systems and Thailand's expectation that cloud configurations be reviewed on an ongoing basis.  

Brand and executive monitoring flags impersonation and targeted threats aimed at leadership, and risk scoring is used to prioritize which alerts actually warrant an incident response versus which are noise. 

None of this replaces the audits, board reporting, or licensed-provider engagements that Singapore's CCoP, Malaysia's Cyber Security Act, and Thailand's NCSA standards require — those remain organizational and legal obligations. What continuous, contextualized threat intelligence does is shorten the time between something going wrong and someone finding out, which is the exact metric each of these regulators is now measuring. 

See how fast you can detect a breach. Request a Cyble Vision demo. 

References 

•  https://www.csa.gov.sg/news-events/press-releases/cybersecurity-code-of-practice-for-critical-information-infrastructure-to-be-updated-to-address-apt-and-ai-enabled-threats/ 

• https://securiti.ai/overview-of-malaysia-cyber-securitiy-act-2024/ 

• https://sth.sh/en/compliance/ncsa-cloud-security-standard/ 

• https://www.csa.gov.sg/ 

Disclaimer: This article is intended for general informational purposes only and does not constitute legal, regulatory, or compliance advice. Regulatory requirements referenced — including Singapore's Cybersecurity Code of Practice, Malaysia's Cyber Security Act 2024, and Thailand's NCSA Cloud and Website Security Standards — are based on publicly available information as of the date of publication and may be revised, amended, or reinterpreted by the respective authorities. Organizations should consult qualified legal counsel or their compliance teams to confirm current obligations applicable to their specific operations and jurisdiction. 

The post Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026 appeared first on Cyble.

Infostealer malware is behind a large share of today's credential compromise — and it usually doesn't start with a breach at all. When a security team hears "data breach," the instinct is to look for the moment a database was exfiltrated or a network was penetrated. But more often, the real starting point is a single endpoint infection, often on a personal device, that has nothing to do with the organization's perimeter.

By the time stolen credentials show up in a breach notification or a dark web alert, they've already passed through several distinct, mechanical stages. Understanding that pipeline — rather than waiting for the final alert — is what separates reactive security teams from ones that catch exposure early.

How Infostealer Malware Powers the Credential Theft Pipeline?

What follows is a stage-by-stage breakdown of that journey — from the moment infostealer malware first executes on a device, through the log assembly and enrichment steps that add value along the way, to the final point where credentials are packaged and sold on the open market. Each section builds directly on the one before it, showing exactly how a single infection turns into an inventoried, priced, and marketable product.

Execution and Harvesting 

The pipeline begins with infostealer malware — a lightweight piece of software designed to do one thing efficiently: grab whatever credentials, cookies, and session tokens are sitting in a browser or application on the infected machine. This is the core mechanism behind modern credential harvesting, and these tools typically arrive through cracked software installers, fake game cheats, malicious browser extensions, or phishing lures disguised as invoices or shipping notices. 

Once executed, the stealer doesn't loiter. It targets browser credential stores, autofill data, saved payment details, cryptocurrency wallet files, FTP client configurations, and any session cookies that could allow an attacker to bypass login screens entirely. Many stealers also grab system fingerprinting data — IP address, hardware ID, installed software — which becomes useful later for building convincing sessions or bypassing device-based fraud checks. 

The output of this stage is a "log": a structured folder of text files, often just a few kilobytes, containing everything the malware could pull from that one machine. These stealer logs are the raw currency of the entire pipeline that follows. 

Aggregation and Log Assembly 

A single log is not particularly valuable on its own. Its worth comes from volume. Threat actors operating stealer campaigns typically run panels — command-and-control dashboards — that collect incoming logs from hundreds or thousands of infected machines simultaneously. These logs get bundled into larger archives, sometimes labeled by infection date, campaign, or targeted region. 

This is the point where individual credential theft becomes an inventory problem for the attacker. Logs get sorted, deduplicated, and screened for anything obviously valuable — corporate VPN logins, SaaS admin panels, banking portals — versus low-value consumer accounts. 

Parsing and Enrichment 

Raw logs are messy, so a parsing step usually follows before anything is sold or shared. Automated tools and, in some cases, manual review are used to extract structured fields: username, password, URL, and associated cookies, organized into searchable formats. This is also where enrichment happens — cross-referencing a log against previously leaked datasets to add context like a person's employer, job title, or other accounts tied to the same email address. 

Enrichment matters because it changes the value proposition. A raw password paired with a login URL is interesting. That same credential paired with confirmation that it belongs to an IT administrator at a mid-sized company is something else entirely — and priced accordingly.  

It's also at this stage that enriched credentials become prime material for credential stuffing campaigns, where attackers automate login attempts across dozens of unrelated services in the hope that a password was reused. 

Marketplace Listing 

The final stage is distribution. Parsed and enriched logs are listed for sale on dark web marketplaces and forums, sometimes as full archives ("bulk logs") and sometimes broken apart and sold as individual access credentials to specific platforms — a corporate email account, a cloud console login, a remote desktop session. Listings often include partial samples as proof of authenticity, along with metadata like infection date, geography, and browser type, to help buyers judge freshness and relevance. 

This is usually the first point where an outside observer — including a security team — has a realistic chance of spotting exposure, provided they're actually looking at this layer of the ecosystem rather than waiting for a breach disclosure further downstream. 

Why the Earlier Stages Matter More Than the Alert? 

Most detection strategies are built around the last step: someone notices a listing or a breach compilation and issues an alert. But by then, the credential may have already changed hands, been tested against multiple services, or been bundled into a larger fraud operation. The earlier stages — infection, log assembly, and enrichment — are where exposure actually originates, and where it can be caught closer to the source. 

For SOC teams and identity security leads, the practical takeaway is that credential exposure isn't a single event to monitor for — it's a pipeline to monitor across. Visibility into stealer logs, marketplace chatter, and enrichment activity gives a much earlier warning than waiting for a finished, packaged breach. 

Your Credentials Are Probably Already for Sale. You Just Don't Know It Yet. 

Somewhere right now, an infostealer log sits in a marketplace listing with your company's name attached to it — and nobody on your team has seen it. That's not a scare tactic. It's the default state for most organizations, because credential exposure happens quietly, on devices you don't control, long before it ever becomes "your" incident. 

The only real question is whether you find out from a threat feed, or from a breach headline. 

See what's already exposed — before someone else finds it first. Run a free check with Cyble and get a real answer, not a guess. 

The post From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline appeared first on Cyble.

Six hours. That's the incident notification window under the UAE's Information Assurance Standard v2. Once a breach is detected, the framework requires incident notifications within 6 hours of detection, alongside quarterly compliance updates and annual maturity assessments.

Saudi Arabia's regulators aren't far behind — SAMA's cybersecurity framework and the Kingdom's PDPL both converge on a 72-hour notification standard, and the NCA's Essential Cybersecurity Controls point organizations toward a similar 72-hour reporting expectation for serious cyber incidents.

Read that again. Regulators across the GCC aren't asking enterprises to respond fast anymore — they're mandating how fast enterprises must know. And that's the part most security programs still get wrong.

The Compliance Clock Starts at Detection, Not Response 

Every regulatory framework reshaping the region's cybersecurity posture — NCA ECC, NESA/UAE IAS v2.1, SAMA CSF — shares a structural assumption: the organization already knows it's been breached. The clock for reporting, escalation, and remediation only starts ticking once detection happens. 

That assumption breaks down inside most enterprise SOCs. Detection today typically means: 

• Alerts triaged manually across siloed tools, hours or days after initial compromise 

• Threat intelligence that arrives as static reports, not real-time signal 

• Exposure discovered only after a regulator, a customer, or an attacker's leak site announces it 

Under NESA's incident management requirements, tested response procedures and a maintained incident log matter — but the underlying detection of SLA still has to be met before any of that documentation is worth anything. A perfect incident response plan is irrelevant if the breach itself goes unnoticed for a week. 

Why Reactive Detection Can't Survive These Timelines 

Reactive security was designed around a different clock — the attacker's dwell time, not the regulator's reporting window. Under IAS v2's enhanced SOC requirements, Tier 1 critical infrastructure entities now need 24/7 monitoring capability paired with defined detection and response SLAs, not just a monitoring function. That's a measurable performance bar, not a checkbox. 

For a Gulf enterprise, missing that bar isn't just a security failure — it's a compliance failure with financial, contractual, and reputational consequences layered on top. And because a single incident can trigger overlapping obligations across multiple regulators at once, one detection gap can cascade into several separate compliance breaches simultaneously. 

See how fast you can detect a breach — run a live check with Cyble Vision. 

Where AI-powered Threat Intelligence Closes the Gap 

This is the shift Cyble Vision is built for. Instead of waiting for a signature match or a manual review cycle, AI-powered threat intelligence continuously correlates external signals — leaked credentials, dark web chatter, exposed assets, attacker infrastructure — against your enterprise footprint in real time. 

That matters specifically because GCC frameworks measure speed from the moment of detection, not from the moment someone happens to notice. Closing that gap means: 

• Continuous exposure monitoring instead of periodic scans, so assets breaching policy or appearing in threat actor chatter surface immediately 

• AI-correlated alerting that cuts through noise and prioritizes what actually threatens regulated systems 

• Audit-ready detection logs that document when a threat was identified — the evidence NESA and SAMA assessors specifically ask for 

Don't wait for attackers — or a regulator — to find your blind spots first. 

What "Regulatory-Ready" Detection Actually Looks Like? 

For a CISO or compliance lead building toward NCA ECC, NESA, SAMA, or UAE IAS v2.1, the operational bar has moved from "can we respond" to "can we prove we detected in time." That means: 

1. Detection telemetry timestamped and retained for regulator review 

2. Threat intelligence mapped directly to the assets and systems in scope 

3. Alerting fast enough to fit inside a 6-to-72-hour reporting clock — not just a monthly threat report 

Cybersecurity compliance in the UAE and Saudi Arabia is no longer a documentation exercise. It's a speed test, and most enterprises are still building for the exam they used to take. 

Find Your Blind Spots Before the Regulator Does 

AI-powered threat intelligence isn't a nice-to-have layered on top of compliance anymore — for Gulf enterprises operating under NCA ECC, NESA, SAMA, and UAE IAS v2.1, it's becoming the mechanism that makes compliance achievable at all. 

See how fast you can detect a breach.  

The post AI-Driven Threat Intelligence for Gulf Enterprises: Why Detection Speed Is Now a Regulatory Requirement appeared first on Cyble.

Supply chain attacks in 2026 are no longer an edge-case risk buried in a vendor questionnaire — they are a primary breach vector that regulators, incident responders, and CISOs now treat as a first-order threat. Verizon's 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches, up 60% year over year, following the 2025 edition, which already recorded a jump from 15% to 30%.  

Every vendor integration, every open-source dependency, and every managed file transfer tool expands the attack surface that an organization does not directly control. That is the core problem with supply chain security today: the weakest link is rarely the enterprise itself.  

It is the supplier three tiers removed that nobody in procurement flagged as high-risk. 

What Is a Supply Chain Attack, and Why Does It Bypass Standard Defenses?  

A supply chain attack targets the vendors, software components, and build pipelines that an organization depends on, rather than attacking the organization directly.  

Software supply chain security failures happen when a trusted update, library, or third-party platform is compromised upstream, and that compromise rides in through a channel the target already trusts and has whitelisted.  

Traditional vulnerability scanning is built to find flaws in owned infrastructure — it was never designed to flag a poisoned dependency sitting inside a vendor's codebase. 

Recent Supply Chain Attacks Prove the Blind Spot Is Structural, Not Occasional 

The pattern keeps repeating at scale. The Cybersecurity and Infrastructure Security Agency and FBI documented in advisory AA23-158A how the Cl0p ransomware group exploited a SQL injection flaw (CVE-2023-34362) in Progress Software's MOVEit Transfer platform, a widely used managed file transfer tool. Exploitation began on May 27, 2023. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on June 2, six days later, and Progress had published its own advisory on May 31. 

By January 2024, breaches or downstream exposures at more than 2,700 organizations had compromised the personal data of more than 93 million people, according to tracking by Emsisoft and KonBriefing Research. Censys counted more than 3,000 MOVEit environments exposed to the internet before the flaw was disclosed or patched.  

The same advisory covers an earlier Cl0p campaign against Fortra's GoAnywhere MFT, launched in late January 2023 against a separate zero-day, CVE-2023-0669. Cl0p claimed to have exfiltrated data affecting approximately 130 victims over the course of 10 days, a claim CISA and the FBI recorded in the advisory.  

The agencies did not identify lateral movement from GoAnywhere into victim networks, which suggests the breach stopped at the platform itself. That detail is the point, not a caveat: the attacker never needed to go any further because the platform already held the data.  

These campaigns share a structure: one vendor, one flaw, hundreds of downstream victims who had no visibility into the vendor's exposure until the breach was already public. 

Why Vendor Dependencies Create Blind Spots Scanning Alone Can't Close 

This is the operational reality procurement and vendor risk teams face: an organization can harden its own perimeter completely and still inherit a breach through a supplier's unpatched system, a compromised update mechanism, or a fourth-party dependency nobody mapped.  

Supply chain threats don't trip an internal vulnerability scanner because the vulnerable asset was never inside the scan's scope to begin with.  

By the time a breach notification arrives from a vendor, the exposure window has already closed — and the damage is already done. 

Supply Chain Attack Prevention Now Requires Continuous, External Vendor Visibility 

Governments are formalizing the response. In September 2025, CISA and the NSA, together with 19 international partners, published joint guidance establishing a shared framework for Software Bills of Materials, treating component-level transparency as a baseline security expectation rather than a nice-to-have.  

CISA, the NSA, the FBI, and international partners followed on July 29, 2026, with 2026 Minimum Elements for a Software Bill of Materials, which updates and replaces the minimum elements NTIA published in 2021.  

The revision draws on more than 90 public comments and applies to all software, including open-source components, AI systems, and software delivered as a service 

CISA has since followed with the 2026 Minimum Elements for SBOM guidance, updating the original 2021 federal standard.  

The regulatory direction is unambiguous: organizations are expected to know what's inside their vendors' software stacks —not just their own—before deployment, not after an incident. 

Monitoring the Vendor, Not Just the Perimeter 

Closing this blind spot requires continuous monitoring of vendor infrastructure, exposed credentials, dark web chatter, and third-party breach signals — the exact layer traditional vulnerability management doesn't cover.  

Cyble's Third-Party Risk Management platform continuously tracks vendor risk posture, surfacing exposure signals tied to suppliers before they cascade into a confirmed compromise, giving CISOs, vendor risk managers, and procurement security teams the lead time that reactive scanning can't provide. 

Find your blind spots before an attacker does. Request a Cyble TPRM demo! 

Conclusion 

Supply chain attacks in 2026 succeed for the same reason every time: organizations extend trust to vendors faster than they extend visibility into them. CISA's own advisory record — from GoAnywhere to MOVEit — shows that a single upstream compromise can cascade into hundreds of victims before any of them see it coming. Patching internal systems faster won't fix that. Neither will another vendor questionnaire be filed away after onboarding. 

What changes the outcome is continuous visibility into the vendors, software components, and dependencies an organization has already accepted as trusted — tracked before a breach notification forces the issue. That's the gap threat intelligence is built to close, and it's the difference between reacting to a supplier's incident and seeing it coming. 

Don't wait for a vendor to tell you they were breached. See how Cyble Third-Party Risk Management maps your vendor exposure. 

References 

• #StopRansomware: CL0P Ransomware Gang: Exploits CVE-2023-34362 MOVEit Vulnerability 

• CISA, NSA, and 19 International Partners Release Shared Vision of Software Bill of Materials for Cybersecurity Guide 

Disclaimer: This blog is for general informational purposes only and does not constitute security, legal, or compliance advice. Statistics and incidents referenced are drawn from public advisories issued by CISA, FBI, and NSA, accurate as of their publication dates. Threat conditions and guidance change frequently — consult the original advisories and your own security team before making risk or compliance decisions.

The post Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works appeared first on Cyble.

For years, cybersecurity teams have communicated risk through labels such as “High,” “Medium,” and “Low.” Those ratings can help security teams prioritize vulnerabilities, but they often leave CFOs with a more important question unanswered: What does the risk actually mean for the business financially? 

That question has become harder to ignore as the threat landscape accelerates. Cyble’s 2025 threat predictions, published as the year unfolded, provide a useful illustration. More than 80% of the threats Cyble forecast—including AI-driven ransomware and complex supply-chain attacks—materialized as anticipated.  

It was observed that dark-web discussions about using large language models for phishing, automated social engineering, and ransomware negotiation as early as six months before AI-powered ransomware became a mainstream concern. 

From Threat Signals to Financial Exposure 

Cyble’s 2025 research identified several trends that demonstrate why qualitative risk scores are no longer enough. 

Ransomware incidents increased by 52% in 2025, according to Cyble's analysis. Cyble's full-year 2025 report recorded 6,604 ransomware attacks, compared with 4,346 in 2024. December 2025 alone recorded nearly 731 attacks, the second-highest monthly total of the year, surpassed only by February. 

The FBI and CISA also issued joint warnings regarding Medusa ransomware, including the use of AI to streamline intrusion, escalate privileges, and evade detection. The EU SOCTA 2025 report similarly identified an increase in ransomware activity. Cyble also documented 57 new ransomware groups, 27 new extortion groups, and more than 350 new ransomware strains during 2025 alone. 

At the same time, ransomware affiliates proved remarkably adaptable. Cyble also documented 57 new ransomware groups, 27 new extortion groups, and more than 350 new ransomware strains during 2025 alone. 

International disruption operations targeted several ransomware ecosystems, but as RansomHub went offline in April 2025 and Black Basta became largely inactive following internal chat leaks and operational disputes, displaced affiliates migrated between operators and adopted distributed criminal models rather than withdrawing from the market. The United States remained the primary target, accounting for 55% of attacks in 2025. 

Qilin and DragonForce absorbed the bulk of those displaced affiliates, reinforcing the resilience that has made ransomware a persistently growing threat. 

Public-facing applications and zero-days remained another major entry point. The data supported its prediction that exposed applications would remain attractive targets. Incidents involving Multer for Node.js, Microsoft SharePoint, CVE-2025-20337, and CVE-2025-5777 reinforced that concern. 
 
Identity and credential compromise became the dominant initial-access vector: Unit 42 attributed 65% of intrusions to compromised credentials, stolen infostealer logs, and abused VPN access. ClickFix social-engineering lures — which manipulate users into executing malicious commands — increased 517% year over year in the first half of 2025. 

Cloud and hybrid environments also became increasingly important targets. Campaigns associated with Silk Typhoon, attacks against cloud-based identity systems, and growing software supply-chain activity demonstrated how attackers were expanding beyond traditional infrastructure. 

Supply-chain ransomware followed the same trajectory. Cyble recorded a 93% increase in supply-chain attacks, from 154 incidents in 2024 to 297 in 2025. LockBit 5.0 emphasized third-party compromise, while activity associated with Qilin, SafePay (which claimed 58 victims in May 2025 alone), and DevMan demonstrated how IT providers and technology vendors can become pathways to multiple victims. 

Critical infrastructure also faced heightened pressure amid geopolitical tensions. Hacktivist campaigns targeted energy, transportation, and government systems, while the UAE reported successfully blocking a major cyberattack against critical infrastructure, and China accused Taiwan of targeted cyber intrusions. 

Meanwhile, underground ecosystems remained resilient. Forums including XSS, Exploit, and RAMP continued to support malware development, initial-access brokerage, affiliate recruitment, and the exchange of stolen data. The HelloKitty-to-HelloGookie transition provided another example of how underground communities support ransomware operations. 

Cyble’s Cyber Risk Quantification (CRQ) addresses the gap between technical severity and business impact. The cloud-native SaaS platform combines real-time threat intelligence, asset visibility, and predictive analytics to quantify cyber risk in financial terms, calculate Return on Security Investment (RoSI), and align security decisions with enterprise value. 

See how Cyble CRQ turns cyber exposure into financial insight. Discover your financial exposure now! 

What the CFO Needs to Know 

A CFO does not necessarily need another dashboard showing hundreds of vulnerabilities. The finance function needs to understand questions such as: 

• What could this threat cost? 

• Which business assets create the greatest financial exposure? 

• What is the likelihood of a loss event? 

• Which security control reduces the most risk? 

• How much would that control cost? 

• What is the expected return on the investment? 

That is where CRQ changes the conversation. Instead of reporting that a vulnerability is “critical,” security teams can model its potential effect on operations and financial performance. 
 
Recent incidents illustrate the stakes: Marks & Spencer estimated an impact of approximately £300 million on its 2025/26 annual profit from a single ransomware incident, and the Cyber Monitoring Centre assessed the combined losses for M&S and Co-op at £270 million to £440 million, excluding any ransom payments. Meanwhile, only 28% of victims paid a ransom in 2025 — down from 62.8% in 2024 — yet the median payment increased 368%, reflecting a shift toward higher-value, targeted demands. 

Cyble CRQ provides enterprise- and asset-level risk quantification, financial risk modeling, RoSI analysis, real-time dashboards, and operational metrics including MTTD, MTTN, MTTR, FPR, and IRR. Cyble's capabilities can help reduce breach containment time by up to 23%. The platform can also integrate with Cyble CSPM, Threat Intelligence, and Asset Management through APIs and real-time feeds. 

Its AI-driven risk engine ingests security and business data, evaluates potential loss scenarios, models the effect of different controls, and continuously updates exposure as conditions change. The result is a risk picture that both the CISO and CFO can interpret. 

The Executive Risk Equation 

Financial exposure is not limited to infrastructure. Executives themselves are increasingly valuable targets because compromising a trusted leader can provide access to sensitive information, systems, and relationships. 

Spear-phishing, executive impersonation, credential theft, dark-web exposure, and social engineering can create direct financial, regulatory, and reputational consequences. A compromised CFO account, for example, could be abused to distribute fraudulent financial information, while a compromised CEO identity could be used to manipulate employees, customers, or business partners. 

Cyble’s Executive Monitoring capability extends visibility into these risks by monitoring for impersonation, leaked information, dark web exposure, and emerging threats targeting organizational leadership. 

This becomes particularly important when executives operate outside the traditional corporate perimeter through personal devices, external platforms, social media, travel environments, and other channels. A mature risk strategy, therefore, needs to connect technology risk, human risk, and business impact. 

From Security Budget to Business Investment 

Cyble Saratoga takes this approach further by combining cyber risk quantification with investment optimization, human and process risk analysis, scalable assessment models, and executive-ready dashboards. Built on Cyble’s AI-native foundation and evolving toward agentic intelligence, the platform is designed to continuously adapt to changing environments and threat conditions. 

The objective is not simply to produce a better risk score. It helps organizations determine where to invest first and why. 

For financial services organizations, that can mean quantifying ransomware, fraud, credential compromise, and operational disruption. For manufacturing and supply chains, it can mean assessing third-party exposure and potential downtime. In 2025, manufacturing accounted for 65% of all industrial ransomware activity, with 1,660 victims, making it the most heavily targeted sector of the year.  

Healthcare organizations can evaluate risks to patient data and critical systems - 423 healthcare ransomware attacks were recorded in the first nine months of 2025, with average ransom demands of USD 514,000 to USD 532,000, while government and critical-infrastructure operators can translate complex cyber exposure into measurable financial and operational consequences. 

Conclusion 

Cyber risk is no longer a static “High, Medium, or Low” assessment—it is a dynamic business exposure that can directly impact revenue, operations, reputation, and resilience. With more than 80% of Cyble’s 2025 threat predictions materializing, organizations need to move beyond severity scores and understand what cyber risk could actually cost.  

Cyble CRQ helps security and finance leaders quantify cyber exposure in financial terms, prioritize the investments that matter most, and measure how effectively each security dollar reduces risk. 

Stop telling the board your cyber risk is “High.” Tell them what it could cost. 

Turn cyber risk into financial clarity with Cyble CRQ. Request a personalized demo today. 

References: 

• Cyble’s 2025 Threat Predictions Proven True—Here’s What We Expect for 2026 

• Medusa Ransomware Surge: 60 Victims in 3 Months—Are You Next? 

The post From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO  appeared first on Cyble.

Ransomware rarely appears out of nowhere. Before encryption, extortion, or data theft begins, attackers often spend time establishing access, stealing credentials, moving laterally, and identifying valuable systems. These activities occur during the ransomware pre-execution phase, when malicious activity may be difficult to distinguish from legitimate administration. 

For security teams, understanding ransomware attack vectors, ransomware initial access methods, and how ransomware evades detection is critical. Endpoint security blind spots can give attackers the time they need to prepare an attack without triggering an obvious alarm. 

Here are five areas where ransomware activity can remain hidden before detonation. 

1. Remote Access Tools: A Favorite Ransomware Attack Vector 

VPNs, RDP, and remote management tools are essential for distributed organizations, but they are also among the most important ransomware attack vectors. 

Qilin affiliates have abused tools including WinSCP, AnyDesk, and ScreenConnect to facilitate lateral movement. Attackers who obtain valid credentials can potentially use legitimate remote-access software without immediately deploying obvious malware. 

This is one reason why ransomware evasion cannot be reduced to antivirus evasion alone. Attackers can blend into normal administrative activity. 

Organizations should enforce MFA on remote-access systems, monitor unusual login behavior, and restrict remote administration privileges. 

2. Compromised Endpoints and Credential Stores 

A compromised laptop or workstation may be only the beginning. Attackers can use credential-stealing tools to obtain additional passwords and authentication material, allowing them to move toward servers, backups, and privileged accounts. 

CRIL has tracked ransomware operators using credential-harvesting techniques associated with tools such as NirSoft and Mimikatz. BYOVD, or Bring Your Own Vulnerable Driver, is another technique security teams should monitor because vulnerable drivers can help attackers bypass security controls. 

These activities represent major endpoint security blind spots when organizations monitor servers but have limited visibility across employee workstations. 

EDR coverage across every endpoint can help identify unusual processes, credential access, and other indicators during the ransomware pre-execution phase. 

3. Vendor Connections and Supply Chain Access 

Manufacturers rarely operate alone. Suppliers, contractors, logistics providers, and software vendors can all connect to corporate environments. 

Attackers may compromise a smaller vendor with weaker defenses and use that trusted relationship to reach a larger target, a technique commonly known as island hopping. 

A shared credential, remote connection, vulnerable integration, or compromised software update can become one of the most dangerous ransomware initial access methods. 

Organizations therefore need visibility beyond their own infrastructure. Vendor access should be reviewed regularly, unnecessary connections should be removed, and third-party privileges should follow least-privilege principles. 

4. Operational Technology and Industrial Systems 

Manufacturing environments face additional endpoint security blind spots because operational technology (OT) and industrial control systems (ICS) often have long lifecycles and cannot be patched as easily as conventional computers. 

Many industrial systems were designed for reliability rather than modern cybersecurity requirements. Connecting previously isolated systems to corporate networks, cloud platforms and remote-management tools has expanded their attack surface. 

A ransomware attack affecting production systems can disrupt manufacturing lines, robotics, quality controls and logistics. Attackers can also steal product designs, supplier contracts, pricing information, and other intellectual property before encryption. 

Network segmentation, vulnerability monitoring, and strict access controls can reduce the risk while allowing production environments to remain operational. 

5. Phishing and Business Email Accounts 

Phishing remains one of the most effective ransomware initial access methods, but modern campaigns are often highly targeted. 

Attackers may research procurement, finance, and supplier relationships before sending messages that closely resemble legitimate business communications. Once credentials are stolen, attackers can monitor conversations before attempting fraud or using the account to gain further access. 

This activity can remain hidden because the attacker may initially use legitimate credentials rather than obviously malicious software. 

MFA, payment verification, email monitoring, and employee awareness training can reduce exposure. Security teams should also investigate unusual authentication patterns and unexpected account behavior. 

RaaS Makes Endpoint Blind Spots More Dangerous 

Ransomware-as-a-service has lowered the barrier for criminals seeking to conduct sophisticated attacks. Cyble identified 57 new ransomware groups and 27 new extortion groups in 2025, along with more than 350 new ransomware strains. 

Between January and April 2025, global ransomware incidents increased by 86%, with Cl0P accounting for 28% of activity during that period, according to Cyble. 

Double extortion has also become common. Attackers may steal data before encryption and threaten to leak it. Some groups have escalated to triple extortion by adding DDoS attacks or directly contacting victims' customers. 

For organizations with limited security resources, this makes early detection particularly important. 

Conclusion 

Effective ransomware defense starts before encryption begins. Organizations should patch exploited vulnerabilities, enforce MFA, segment networks, and maintain tested backups while continuously monitoring endpoint security blind spots.  

Cyble Titan Endpoint Security combines behavioral detection, threat intelligence from Cyble Vision, and Blaze-AI-powered autonomous response to detect and contain threats before they escalate. See Cyble Titan in action and strengthen endpoint protection today—request a demo. 

Frequently Asked Questions (FAQs)  

1. What are endpoint security blind spots? 

Endpoint security blind spots are areas where security teams have limited visibility into devices, applications, accounts, or activities. These gaps can allow attackers to establish access and move through an environment before ransomware is detected. 

2. How does ransomware evade detection? 
 
Ransomware can evade detection by using legitimate remote-access tools, stolen credentials, fileless techniques, and vulnerable drivers. Attackers may also remain inactive during the ransomware pre-execution phase to avoid triggering security alerts. 

3. What are common ransomware attack vectors? 

Common ransomware attack vectors include phishing emails, compromised credentials, vulnerable internet-facing systems, remote-access tools, third-party vendors, and exposed operational technology environments. 

4. How can organizations reduce ransomware risks on endpoints? 

Organizations can reduce risk by deploying EDR or advanced endpoint protection, enforcing MFA, applying least-privilege access, patching vulnerabilities, segmenting networks, and continuously monitoring endpoint activity. 

5. How can Cyble Titan help prevent ransomware attacks? 

Cyble Titan combines behavioral detection, next-generation antivirus, endpoint telemetry, and Cyble Vision cyber threat intelligence. Its Blaze AI engine can analyze threats, prioritize alerts, and support automated containment and remediation to help security teams respond faster. 

Media Disclaimer: This blog was compiled from publicly available advisories and open-source security reporting. It is provided for reference purposes only; readers bear full responsibility for their reliance on it. 

The post Endpoint Blind Spots: The 5 Places Ransomware Hides Before It Detonates appeared first on Cyble.

A company can have strong firewalls, modern endpoint protection, and carefully controlled access—and still find its brand being used as a weapon against customers, employees, and partners. 

That is the new reality of digital impersonation. Attackers can register lookalike domains, clone websites, create fake executive profiles, publish fraudulent job advertisements and imitate customer-support accounts without ever breaking into the legitimate organization. 

The objective is pretty simple. Borrow the credibility that a trusted brand has already built and use it to make a scam look legitimate. For professional services, financial, legal, and consulting organizations, that risk can be particularly damaging because trust is central to the business model. 

The Numbers Show Why Speed Matters 

The scale of digital fraud makes slow brand-abuse response difficult to justify. 

The FBI's 2025 Internet Crime Report recorded 1,008,597 complaints, marking the first time the Internet Crime Complaint Center (IC3) exceeded 1 million in a year. Reported losses reached $20.877 billion, up 26% from 2024. Phishing and spoofing were among the most frequently reported complaint types. 

Business email compromise was even more costly, producing approximately $3.05 billion in reported losses from 24,768 complaints. 

The Federal Trade Commission provides another measure of the impersonation problem. Consumers reported $3.5 billion in losses to imposter scams during 2025, with nearly one in three fraud reports involving impersonation. People reported losing nearly $1 billion to business impersonators alone. 

These figures represent reported losses, not the full economic impact. Fraudulent domains and profiles can disappear quickly, victims may never report incidents, and reputational damage is difficult to quantify. 

Professional Services Have More Than a Brand to Protect 

Consulting and professional services firms often handle sensitive client information, financial models, strategic plans, legal documents and confidential communications. That makes their identities valuable to criminals. 

The legal sector provides a useful comparison. The American Bar Association's cybersecurity research has previously found that 29% of surveyed lawyers reported that their firms had experienced a security breach. 

Impersonation adds another layer because the attacker may never enter the firm's network. A counterfeit website can steal credentials. A fake executive can request a payment. A fraudulent recruiter can collect applicant information. A fake support account can redirect customers to a malicious login page. 

The brand becomes the attack surface. 

Why Traditional Takedowns Become a Whack-a-Mole Exercise 

Conventional brand protection is often reactive. Someone discovers a suspicious domain, reports it to the registrar, contacts the hosting provider or social platform, and waits. 

That process can work—but it does not scale well against automated adversaries. 

By the time one fraudulent domain is removed, another may have appeared. A fake executive account can be recreated under a slightly different name. A phishing kit can be deployed against several brands simultaneously. Fraudsters can also move between websites, social networks, advertisements, application stores and messaging platforms. 

Counting the number of takedowns therefore tells only part of the story. A more meaningful measurement is the time from discovery to verification and from verification to removal. 

The shorter that window, the fewer opportunities an attacker has to reach victims. 

What AI Changes 

Artificial intelligence has made impersonation faster, cheaper, and more convincing. 

Attackers can generate polished phishing messages, translate campaigns for different markets, create synthetic personas, clone websites and produce increasingly convincing voice or video content. The FBI has also warned about scams involving AI-generated videos and spoofed websites used to create false legitimacy. 

Europol's 2025 Internet Organised Crime Threat Assessment similarly described a cybercrime economy increasingly powered by stolen data, which can support fraud, ransomware, extortion and other criminal activity. 

That means defenders face an uncomfortable imbalance: criminals can create fraudulent content almost instantly, while organizations may still investigate abuse manually. 

Brand security consequently must become faster without becoming careless. 

The Most Common Brand-Abuse Tactics 

Security teams should watch for a broad range of impersonation signals, including: 

• Typosquatting: domains using misspellings or visually similar characters. 

• Combosquatting: brand names combined with words such as “login,” “support” or “secure.” 

• Fake social profiles: cloned executive, employee, or company accounts. 

• Account takeovers: legitimate accounts hijacked and used to exploit an existing audience. 

• Cloned websites: replicas designed to collect credentials or payment information. 

• Fake mobile applications: counterfeit apps using familiar names, icons, or branding. 

• Fraudulent marketplace listings: fake products or services presented as legitimate. 

• Malicious QR codes: QR-based redirects leading victims to phishing infrastructure. 

• AI-generated impersonation: synthetic voices, images, video, and written communications. 

• Business email compromise: messages designed to trigger payments or sensitive disclosures. 

• Fake customer-support accounts: fraudulent profiles responding to real customer complaints. 

• Malicious search advertisements: paid placements directing users toward counterfeit sites. 

• Fake recruitment campaigns: fraudulent jobs used to collect personal or financial information. 

• Fake press releases: fabricated announcements intended to mislead customers, investors or the public. 

• Dark-web brand abuse: stolen credentials, data, and brand-specific fraud resources circulating in criminal communities. 

Conclusion 

Brand impersonation is no longer just a reputation issue—it can quickly become a pathway to phishing, fraud, credential theft, and customer harm. As AI enables attackers to create convincing fake websites, domains, social profiles, and campaigns at unprecedented speed, organizations need equally fast detection and response.  

Cyble’s brand monitoring and takedown services help organizations detect impersonation, validate malicious activity, and coordinate the removal of fraudulent assets before they can cause greater damage.  

With continuous visibility and managed takedown support, Cyble helps security teams stay protected from brand threats and protect customer trust.

See Cyble’s brand monitoring and takedown capabilities in action—request a demo today. 

Frequently Asked Questions (FAQs)  

1. What is brand impersonation in cybersecurity? 

Brand impersonation occurs when attackers imitate a legitimate company, executive, employee or digital channel to deceive customers, employees or business partners. Common examples include fake websites, lookalike domains, fraudulent social profiles, counterfeit applications and phishing emails. 

2. Why is AI making brand impersonation more dangerous? 

AI allows attackers to create convincing emails, websites, social profiles, synthetic identities, voice messages and other fraudulent content much faster and at greater scale. This makes it harder for organizations to rely on manual monitoring and reactive investigations. 

3. What brand impersonation tactics should security teams monitor? 

Security teams should monitor for typosquatting and lookalike domains, fake executive profiles, cloned websites, counterfeit apps, fraudulent job postings, fake customer-support accounts, malicious advertisements, phishing campaigns, AI-generated impersonation, and brand abuse on underground platforms. 

4. Why is rapid takedown important for brand protection? 

A fraudulent website or social profile can cause harm within minutes by stealing credentials, collecting personal information, or redirecting payments. Faster verification and takedown reduce the amount of time attackers have to reach potential victims. 

5. Can smaller and mid-sized organizations also be targeted? 

Yes. Attackers are not limited to globally recognized brands. Smaller and mid-sized organizations can also be attractive targets because they may have fewer resources dedicated to continuous brand monitoring and digital risk management. 

6. How can Cyble help with brand impersonation? 

Cyble’s brand monitoring and digital risk protection capabilities help organizations identify suspicious domains, fake profiles, fraudulent websites and other forms of digital brand abuse across the online ecosystem. By bringing detection and threat intelligence together, Cyble can help security teams investigate impersonation faster and take action before fraudulent assets cause greater damage. 

References 

• FBI 2025 Internet Crime Report 

• FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 

Media Disclaimer: This blog was compiled from publicly available government advisories and open-source security reporting. It is provided for reference purposes only; readers bear full responsibility for their reliance on it. 

The post When the Attacker Wears Your Logo: Detecting and Taking Down Impersonation at AI Speed appeared first on Cyble.

Ransomware stopped being an isolated incident type in 2025. It became the dominant force behind the modern breach landscape, and the ransomware data breach statistics from Cyble's own tracking make the shift impossible to ignore. For organizations facing this growing threat, having a ransomware incident response plan in place is becoming just as important as preventing an attack in the first place.

Cyble's Global Cybersecurity Report 2025 documented 5,967 ransomware attacks for the year, a 50% year-over-year jump. Against the 6,046 data breaches and leaks recorded in the same period, ransomware accounted for nearly half — 49.7% — of the combined ransomware-and-breach total tracked by Cyble Research and Intelligence Labs (CRIL). That's the "nearly half" this blog's title refers to, and it isn't a projection. It's what Cyble observed. 

The pace hasn't slowed into 2026: 

• Q4 2025 brought 2,018 claimed attacks (roughly 673 a month), and January 2026 held that pace at 679 victims, 30% above the 2025 monthly average. 

• Europe's Q1 2026 tally hit 462 incidents, 404 of them ransomware, with the UK as the region's most-attacked country and manufacturing/construction overtaking financial services as top targets. 

• The META region logged 133 incidents in Q1 2026 alone, with construction absorbing 23 ransomware attacks and the top five gangs claiming 67% of all activity. 

Ransomware-as-a-service Threats Have Removed the Skill Barrier 

CRIL identified 57 new ransomware groups and 27 new extortion groups in 2025, alongside more than 350 new ransomware strains built largely on the MedusaLocker, Chaos, and Makop families.  

This is the mechanics of RaaS: affiliates rent pre-built toolkits, and operational capacity scales faster than any single group's headcount. Between January and April 2025, this dynamic drove an 86% spike in global incidents, with Cl0P alone responsible for 28% of that quarter's activity, per Cyble's Ransomware Threat Landscape report. 

Double Extortion Ransomware is the Baseline, Not the Exception 

Encrypt-and-leak is now standard operating procedure. CRIL's research into extortion technique evolution tracked groups layering in triple extortion (DDoS on top of encryption and data theft) and direct outreach to a victim's clients — a tactic CL0P has used to compound reputational damage beyond the initial breach. For a lean team, this means "we have backups" no longer neutralizes the threat; the data theft component still forces a decision. 

Why Cost Pressure Hits Small Teams Hardest 

Cyble's Europe Q1 2026 findings noted that attackers are deliberately targeting sectors with narrow downtime tolerance — manufacturing and construction firms face contract penalties and supply-chain breakage within days of an outage, which shortens the runway between intrusion and ransom decision. Lean security teams, by definition, have the least slack to absorb that pressure. 

How to Prevent Ransomware Attacks in 2026: What the Data Points to 

The October 2025 surge to 5,194 year-to-date attacks was fueled by a steady supply of critical vulnerabilities and unpatched internet-facing assets, per Cyble's analysis. For small teams, prevention priorities follow directly from that finding: 

• Patch internet-facing systems against CISA KEV entries first — over 86% carry CVSS scores of 7.0 or higher. 

• Treat remote-management tools (RMM, VPN, RDP) as high-risk attack surface; Qilin affiliates have abused WinSCP, AnyDesk, and ScreenConnect for lateral movement. 

• Monitor for BYOVD (Bring Your Own Vulnerable Driver) activity, a technique increasingly paired with credential-harvesting toolkits. 

Zero Trust Security for Small Teams is Achievable Without Enterprise Budgets 

Zero trust doesn't require a full architecture overhaul on day one. The practical entry points for a lean team: 

• Enforce MFA on every remote access path, especially RMM and VPN tools — the same tools driving initial access in Cyble's tracked campaigns. 

• Segment networks so a single compromised endpoint can't reach backup infrastructure. 

• Apply least-privilege access reviews quarterly, not annually. 

Endpoint Detection and Response for Small Business is the Non-negotiable Layer 

Given that Qilin and similar groups deploy Linux-based binaries on Windows hosts and harvest credentials via NirSoft and Mimikatz-style toolkits, EDR coverage across every endpoint — not just servers — is the difference between detection in hours versus discovery via a ransom note. 

Building a Ransomware Incident Response Plan Before it's Needed 

A working ransomware incident response plan and cybersecurity incident response checklist should cover, at minimum: 

• Pre-approved communication chain (legal, leadership, cyber insurance, law enforcement contact) that doesn't depend on compromised email. 

• Isolated, tested offline backups with a documented restoration time objective. 

• A decision framework for the ransom-payment question, made before an attack, not during one. 

• Log retention sufficient to reconstruct the intrusion timeline for post-incident analysis. 

Ransomware Recovery Best Practices After the Encryption Hits 

The ransomware incident response plan and recovery speed depend on preparation done months earlier: validated backup integrity, a pre-mapped list of critical systems in priority order, and a rehearsed communication plan for customers and regulators. Teams that treat recovery as an extension of the incident response plan — rather than an improvised scramble — cut both downtime and the pressure to pay. 

How Cyble Can Help 

Every ransomware statistic in this ransomware incident response plan playbook — the leak-site counts, the group rankings, the extortion techniques, the sector targeting — traces back to one thing: visibility into where attackers operate before they hit a victim's network. That's the gap Cyble Vision is built to close. 

Cyble Vision is the threat intelligence platform behind CRIL's own research, continuously monitoring deep, dark, and surface web sources — ransomware leak sites, underground forums, and threat actor chatter — through its Blaze AI engine.  

For a lean security team, that means the same early-warning signal CRIL uses to track Qilin, Akira, and every emerging RaaS affiliate becomes available as a live feed for their own organization: exposed credentials, brand mentions on cybercrime forums, ransomware group activity tied to their sector, and third-party breach exposure, all correlated and prioritized automatically instead of requiring a dedicated analyst to piece it together manually. 

For a team that can't staff round-the-clock dark web monitoring or manually track which of the dozens of active ransomware groups is circling their industry, this is the difference between finding out from a leak site and finding out weeks earlier. 

Lean teams can't out-staff ransomware operators, but they can out-see them. Request a Cyble Vision demo to get the same dark web and ransomware-tracking intelligence CRIL uses to build reports like this one — built for teams that need to know who's targeting them before the leak site does. 

Conclusion 

A ransomware incident response plan for small security teams isn't about matching enterprise headcount. It's about aligning limited resources against the specific mechanics CRIL has documented: patch the exploited CVEs first, lock down remote-access tools, deploy EDR broadly, and rehearse the incident response plan before the RaaS-fueled affiliate economy finds the gap. 

References: 

• Ransomware and Supply Chain Attacks Soared in 2025
• Threat Landscape March 2026: Ransomware Dominance, Access Brokers, Data Leaks, and Critical Exploitation Trends
• Ransomware Attacks Have Surged 30% Since Q4 2025

• UK tops Europe's ransomware target list as five groups take 60% of attacks, new Cyble report finds

• Middle East, Turkey & Africa Threat Landscape Report: Q1 2026

• Ransomware Threat Landscape: Jan-April 2025

• October 2025 Attacks Soar 30% as New Groups Redefine the Cyber Battlefield

The post Ransomware Now Shows Up in Nearly Half of All Breaches: A Survival Playbook for Lean Security Teams appeared first on Cyble.

A single compromised credential is often all it takes to turn an ordinary workday into a full-scale cybersecurity incident. Despite investments in firewalls, endpoint security, and identity controls, attackers continue to exploit one of the simplest yet most effective entry points—stolen usernames and passwords. 

Whether exposed through phishing campaigns, malware infections, credential-stealing infostealers, or data breaches, compromised credentials are readily traded across underground forums and dark web marketplaces. Once obtained, threat actors waste little time putting them to use. What begins as an unauthorized login can quickly escalate into privilege abuse, lateral movement, data exfiltration, and ransomware deployment—all within a matter of hours. 

The risk is no longer theoretical. According to Cyble Research & Intelligence Labs (CRIL), more than 6,046 confirmed data breach incidents were monitored globally in 2025, with stolen credentials and compromised identities remaining one of the most common starting points for enterprise attacks. At the same time, Cyble researchers continue to observe credentials harvested through infostealer malware being traded across underground marketplaces, enabling attackers to purchase valid enterprise access for as little as a few dollars. 

The 72-hour Timeline 

Understanding how quickly credential-based attacks unfold is critical for reducing response times. The following 72-hour timeline breaks down each stage of a typical intrusion, highlights the attacker’s objectives, and identifies key detection opportunities that can help security teams interrupt the attack before it becomes a business-wide crisis. 

Stolen credentials often appear on underground marketplaces long before organizations realize they have been compromised. Cyble's Dark Web Monitoring continuously tracks dark web forums, marketplaces, and leak sources to identify exposed corporate credentials early, enabling security teams to investigate and remediate risks before attackers can exploit them. 

Hour 0–6: Initial Access 

The attack begins when threat actors obtain valid credentials. These may originate from credential dumps, phishing campaigns, malware infections, or previously breached third-party services where employees reused passwords. 

This growing underground economy is fueled by infostealer malware. According to CRIL, more than 50 active infostealer variants are currently circulating, continuously harvesting usernames, passwords, browser cookies, and session tokens that are later sold or shared among initial access brokers and ransomware affiliates.  

Because the credentials are legitimate, attackers frequently bypass traditional perimeter defenses without triggering immediate alarms. Instead of exploiting software vulnerabilities, they simply log in using valid accounts. 

Detection Opportunity 

Security teams should monitor for: 

• Logins from unfamiliar geographic locations 

• Impossible travel events 

• Access attempts from anonymous VPNs or Tor exit nodes 

• Repeated authentication failures followed by a successful login 

The earlier abnormal authentication behavior is identified, the greater the chance of preventing further compromise. 

Hour 6–18: Establishing Persistence 

After gaining access, attackers work to ensure they cannot be easily removed. They may register new authentication methods, create additional user accounts, modify MFA settings, or generate persistent API tokens. 

Their goal is simple: maintain access even if the original password is reset. 

Attackers also spend this period quietly learning about the environment, identifying high-value systems, and understanding privilege structures. 

Detection Opportunity 

Security teams should investigate: 

• Unexpected MFA changes 

• Newly created privileged accounts 

• Unauthorized mailbox rules 

• Suspicious administrative activities 

• Changes to identity or authentication configurations 

At this stage, seemingly minor administrative changes often provide the earliest indicators of malicious persistence. 

Hour 18–36: Privilege Escalation and Internal Reconnaissance 

With persistence established, attackers begin expanding their access. They enumerate Active Directory environments, identify privileged users, scan internal assets, and search for sensitive repositories. 

Rather than acting aggressively, experienced adversaries move deliberately to avoid detection. Their objective is to understand the organization's architecture before executing the next phase. 

This reconnaissance often reveals domain administrators, backup infrastructure, cloud resources, financial systems, and critical databases. 

Detection Opportunity 

Organizations should monitor for: 

• Unusual privilege escalation attempts 

• Excessive directory queries 

• Credential dumping activities 

• PowerShell abuse 

• Administrative tools running outside normal operating hours 

This phase represents one of the strongest opportunities to stop attackers before they reach mission-critical assets. 

Why Early Visibility Matters 

Attackers rarely begin with privileged accounts—they build toward them. Cyble's Dark Web Monitoring helps organizations detect leaked employee credentials, exposed corporate identities, and compromised accounts circulating across dark web ecosystems.  

Hour 36–60: Lateral Movement 

Once sufficient privileges have been acquired, attackers begin moving across the environment. 

Using legitimate remote administration tools, stolen session tokens, or harvested credentials, they access additional endpoints, servers, and cloud workloads. Their movements are intentionally designed to blend into normal administrative activity. 

During this stage, attackers identify the systems that contain the organization's most valuable information. 

Detection Opportunity 

Security teams should watch for: 

• Remote administrative connections between unusual hosts 

• Sudden authentication activity across multiple systems 

• Unexpected access to file servers 

• Abnormal service account usage 

• Large volumes of internal network scanning 

Behavioral anomalies become increasingly valuable indicators during lateral movement because attackers are using valid identities rather than malware. 

Hour 60–72: Data Exfiltration and Business Impact 

The final stage is where financial and operational damage occurs. 

Sensitive customer information, intellectual property, financial records, and confidential business documents are collected and transferred outside the organization. In many cases, ransomware deployment follows immediately afterward to maximize leverage during extortion. 

At this point, containment becomes significantly more expensive, investigations become more complex, and regulatory reporting obligations often begin. 

Detection Opportunity 

Security teams should prioritize alerts involving: 

• Large outbound data transfers 

• Connections to unfamiliar cloud storage services 

• Compression and archiving of sensitive files 

• Encryption activity across multiple endpoints 

• Unexpected privilege changes immediately before data movement 

By this stage, every hour of delayed detection substantially increases business risk and recovery costs. 

Why Speed Determines the Outcome 

Credential-based attacks are no longer slow-moving campaigns that unfold over weeks. Modern adversaries automate credential validation, privilege escalation, and reconnaissance, allowing them to compromise environments in less than three days. 

This compressed timeline leaves security teams with only a handful of meaningful opportunities to detect and interrupt malicious activity. While strong authentication controls remain essential, organizations also need visibility beyond their own networks. 

Monitoring the dark web for exposed credentials provides an opportunity to act before attackers ever attempt to authenticate. Combined with proactive identity monitoring and rapid incident response, early intelligence can dramatically reduce the likelihood of a successful credential-based breach. 

Cyble's Dark Web Monitoring enables organizations to identify leaked employee credentials, monitor underground criminal ecosystems, and receive timely alerts when corporate identities appear in dark web forums, marketplaces, and breach repositories. This proactive visibility empowers security teams to remediate exposed accounts before they become the first step in a 72-hour compromise. 

Book a personalized demo today to see how Cyble helps security teams uncover credential exposure across the dark web, prioritize risks, and respond faster to new threats. 

The post From Stolen Credentials to Full Breach: The 72-Hour Timeline appeared first on Cyble.

Modern organizations no longer operate within a fixed network perimeter. Cloud services, remote work, third-party integrations, and rapid digital expansion have made the boundary between "inside" and "outside" for the enterprise increasingly difficult to define. 

Attackers exploit this ambiguity by scanning continuously for weaknesses across an organization's hardware, software, cloud, and internet-facing assets. The uncomfortable truth security leaders must confront is simple: an organization cannot secure what it does not know it has. 

Attack surface expansion is frequently framed as a tooling gap, but the evidence points elsewhere — toward a persistent, structural failure in attack surface discovery, asset discovery, and visibility. 

Why Attack Surface Sprawl Happens 

Attack surfaces expand for several identifiable and recurring reasons. Cloud adoption introduces new workloads, storage resources, and services that may be provisioned outside formal IT review processes, creating visibility gaps.  

Effective cloud asset discovery has become important as organizations struggle to maintain awareness of resources created across distributed cloud environments. Shadow IT further increases complexity when business units deploy applications, platforms, or services without security teams being aware of their existence, creating additional shadow IT risk. 

Multi-cloud environments can fragment visibility across different providers, each with varying configuration standards and security controls. During mergers and acquisitions, organizations often inherit unknown infrastructure and assets from newly integrated entities, making it difficult to establish complete visibility. Forgotten infrastructure, including systems that were intended to be decommissioned but remain accessible online, can continue to create exposure risks. 

Third-party services also expand the attack surface by introducing dependencies on vendors, suppliers, and partners whose security weaknesses may impact the organization. In addition, temporary development environments are frequently left active, misconfigured, or unmonitored after their original purpose has ended. As organizations continue adding internet-facing assets at a rapid pace, traditional manual inventory processes struggle to maintain an accurate and complete view of the modern attack surface. 

Discovery Is the Real Challenge 

Security tools, firewalls, endpoint detection, vulnerability scanners, and vulnerability management tools can only act on assets that are already registered in an inventory. They cannot protect what has never been identified. This is why NIST's Cybersecurity Framework places asset understanding at the very foundation of its Identify function: organizations must understand their data, hardware, software, systems, facilities, services, people, and supplier relationships before they can prioritize risk. 

Traditional asset inventories, built on periodic audits and manual record-keeping, cannot keep pace with environments that change hourly. CISA's own directive on federal network visibility frames this directly, stating that its core focus areas, asset discovery and vulnerability enumeration, are essential building blocks of operational visibility that many organizations still lack. 

The visibility gap is not a failure of detection technology; it is a failure to first establish a complete, current record of what exists. Strong IT asset inventory security practices require organizations to continuously identify, classify, and monitor assets across their environments. 

 Why Organizations Lose Sight of Their Digital Assets 

Government agencies and independent research organizations consistently point to the same conclusion: unknown and unmanaged assets represent a significant source of organizational risk. Without a complete understanding of what exists across an environment, security teams cannot accurately assess exposure, prioritize vulnerabilities, or reduce potential attack paths. 

This challenge is reflected in CISA’s approach to asset visibility. CISA’s Binding Operational Directive 23-01 requires federal civilian agencies to maintain continuously updated asset inventories and identify vulnerabilities across discovered systems, emphasizing that comprehensive asset visibility is a necessary foundation for effective vulnerability management.  

Similarly, CISA’s Cyber Asset Attack Surface Management (CAASM) resources highlight the importance of understanding and reducing exposure across software, hardware, and network environments, reinforcing the idea that organizations must first identify their assets before they can effectively protect them. 

The UK’s National Cyber Security Centre (NCSC) has also emphasized the importance of visibility into modern attack surfaces. NCSC notes that threat actors continuously scan organizations’ hardware, software, services, and cloud assets to identify weaknesses. External attack surface management (EASM) approaches are designed to help defenders achieve comparable visibility into their exposed digital footprint.  

NCSC’s Active Cyber Defence trials further demonstrated that organizations gained security benefits from EASM capabilities beyond vulnerability identification alone, largely because these tools improved awareness of externally exposed assets. 

Cyble Research and Intelligence Labs (CRIL) has similarly documented how misconfigured and outdated internet-facing assets continue to expand opportunities for threat actors. Cyble’s research highlights sustained targeting of public-facing infrastructure, including exploitation patterns associated with campaigns such as the MOVEit-linked Clop ransomware attacks, demonstrating how exposed systems can become entry points for large-scale compromises. 

The scale of exposed infrastructure further illustrates the challenge organizations face in maintaining visibility. Cyble’s ODIN platform identified more than 660,000 exposed cloud storage buckets and over 91 million exposed hosts, with more than 200 billion files accessible due to cloud misconfigurations. These findings demonstrate the extent to which digital assets can exist outside formal security oversight and create unknown exposure risks. 

Cyble’s analysis of the attack surface management landscape also highlights that the discipline emerged in response to the growing need for organizations to discover unknown technology assets. The approach has evolved into complementary areas, including External Attack Surface Management (EASM), which focuses on internet-facing assets, and Cyber Asset Attack Surface Management (CAASM), which provides broader visibility into internal environments.  

Together, these capabilities address the central challenge facing modern security teams: gaining an accurate understanding of the assets they need to protect. 

Best Practices 

Guidance from these sources converges on a consistent set of practices: 

• Continuous asset discovery rather than periodic, point-in-time audits. 

• External attack surface management to maintain an attacker's-eye view of internet-facing infrastructure. 

• Asset inventory validation against NIST's Identify function categories, including supplier and third-party systems. 

• Continuous monitoring for newly exposed services, certificate issues, and configuration drift. 

• Risk prioritization is based on exploitability and business impact once assets are known. 

• Third-party exposure management, since vendor and supplier assets extend the organizational attack surface. 

Conclusion 

The recurring theme across CISA, NIST, NCSC, and Cyble research is not a shortage of security tools; it is a shortage of visibility. Vulnerability scanners, firewalls, and detection platforms are only as effective as the asset inventory feeding them.  

Organizations that treat discovery as a one-time or occasional exercise will continue to carry unknown, unmanaged, and forgotten assets into every future incident. Reducing organizational risk begins with a foundational discipline: knowing, continuously and comprehensively, what exists. 

Know what's exposed before an attacker finds it first. Get a Free External Threat Profile →

References

1. https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks 
2. https://www.cisa.gov/resources-tools/services/cyber-asset-attack-surface-management-caasm 
3. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf 
4. https://www.ncsc.gov.uk/guidance/external-attack-surface-management-buyers-guide 
5. https://www.ncsc.gov.uk/blog-post/active-cyber-defence-2-insights-easm-trials 
6. https://cyble.com/knowledge-hub/what-is-external-attack-surface-management/
7. https://cyble.com/knowledge-hub/third-party-risk-management-attack-surface/ 
8. https://cyble.com/blog/unmasking-the-critical-risk-of-internet-exposed-assets-to-public-and-private-organizations/ 
9. https://cyble.com/blog/detects-200-billion-files-exposed-in-cloud-buckets/ 
10. https://cyble.com/blog/cyble-recognized-in-forresters-attack-surface-management-solutions-landscape-q2-2024-report/ 

The post The Assets You Don’t Know You Own: Attack Surface Sprawl Is a Discovery Problem, Not a Tooling Problem appeared first on Cyble.

You may have heard your peers say, “Cybercrime has become industrialized.” But did you have any proof? 

We do. 

Cyble Research and Intelligence Labs (CRIL) closed out its tracking for the first half of 2026 with a deep analysis of the Global Threat Landscape spanning ransomware, initial access brokers, data breaches and leaks, nation-state espionage, and hacktivism, among others.  

One of the most striking analyses that puts the threat landscape severity in perspective was the number of distinct threat actor profiles active worldwide between January and June. 261 — that’s how many identifiable groups and individuals, each with its own tradecraft, targeting logic, and operational rhythm, running campaigns simultaneously across nation-state espionage, ransomware, hacktivism, and cybercrime.

What makes this data set valuable isn't just the headline count. It's what the composition reveals. A threat landscape dominated by nation-state APT groups tells a very different story than one dominated by ransomware crews — and as Cyble's regional breakdown shows, that composition shifts dramatically depending on where you're standing. 

The Worldwide Picture of Most Active Threat Actors: APTs Lead, But Not Everywhere 

Across all 261 profiles tracked globally, nation-state Advanced Persistent Threat (APT) groups were the single largest category — accounting for 118 profiles, or just over 45% of the total. Ransomware operators came second at 75 profiles (29%), followed by hacktivist collectives (34), cybercriminal groups (31), and dedicated extortion-only gangs, which remained a niche category at just 3. 

That APT dominance reflects the sheer number of state-sponsored programs China, North Korea, Iran, and Russia field simultaneously across espionage, intellectual property theft, and pre-positioning operations.

The extortion-only category being almost statistically irrelevant is telling too — it confirms that pure extortion has essentially been absorbed into the ransomware business model rather than surviving as an independent specialty. Double extortion is now just how ransomware works. 

Worried your business is not immune to the tactics of these APT and ransomware groups? Book a demo to validate and fortify your defenses today! 

Threat Actors to Watch Out For 

CRIL flagged five groups worldwide as carrying the highest confidence and activity levels for security teams to track through the rest of 2026: 

Two of these deserve particular attention for how they operate.  

Bluenoroff, a financially motivated Lazarus Group subgroup, funds North Korean state operations by impersonating established crypto investors and planting malicious links inside victims' Calendly scheduling accounts. This fraud vector blends social engineering with a tool most professionals trust implicitly.  

Volt Typhoon continues to favor "living off the land" techniques that blend into normal network activity, prioritizing long-term undetected access over rapid data theft — a profile consistent with pre-positioning for a future disruption event rather than opportunistic espionage. 

UNC6508 is worth flagging separately: the group compromises externally accessible REDCap research environments and has been observed creating malicious mail-forwarding rules to silently exfiltrate correspondence — all routed through US-based residential proxies and compromised routers specifically to obscure attribution. 

For a regional breakdown of which actors were the most active and which sectors they target, download Cyble Research and Intelligence Labs’ H1 2026 Global Threat Landscape Report. 
 
Download now! 

Track These Threat Actors in Real Time

The threat actor profiles, targeting patterns, and regional breakdowns in this analysis are drawn from Cyble's H1 2026 Global Threat Landscape Report, built on continuous monitoring across dark web forums, ransomware leak sites, and threat actor communications worldwide.  

Cyble Vision provides ongoing tracking of these groups — including new actor emergence, TTP shifts, and targeting changes — as they develop.  

Request a demo to see how continuous threat actor intelligence can sharpen your regional security priorities. 

The post APTs Top the List of Most Active Threat Actors in H1 2026 appeared first on Cyble.

The dark web is no longer just a marketplace for stolen credentials; it has grown far beyond that point and now affects nearly every phase of the cyberattack lifecycle. Markets that once traded only compromised accounts now also sell ransomware services, initial network access, exploit kits, phishing infrastructure, and even AI-powered attack tools.  

What used to be a place for selling stolen data has become the operational backbone of modern cybercrime. 

The first half of 2026 alone is indicative of the trends we may continue to observe. The dark web has evolved into a highly organized ecosystem that facilitates cybercrime, underpins ransomware supply chains, fuels geopolitical campaigns, and accelerates identity-based attacks.  

Instead of serving as the endpoint for stolen data, it now functions as an operational hub where access, intelligence, and malicious services are traded before attacks even begin.  

The pace of activity reflects this shift: March 2026 alone recorded 702 ransomware attacks and 54 major publicly reported data breaches and leaks worldwide. 

Enterprise security teams must monitor such activities using continuous threat intel and underground monitoring. The current ecosystem is no longer optional as an intel exercise but an essential capability for spotting threats before they materialize.  

The dark web trends observed during the first half of 2026 reveal how underground ecosystems are reshaping the cyber threat landscape. 

1. Ransomware Operations Continue to Mature

During the first six months of 2026, ransomware remained one of the most disruptive cyber threats, but the infrastructure supporting it became noticeably more organized. Five ransomware operations—Qilin, Akira, The Gentlemen, DragonForce, and INC Ransom—accounted for more than 56% of ransomware activity recorded in March 2026.  

This concentration highlights the growing consolidation of the ransomware ecosystem, where a handful of established operators dominate attacks while relying on affiliates and underground service providers to scale their campaigns. 

Modern ransomware campaigns rarely focus on encrypting systems. Data theft has increasingly become a standard component in most attack scenarios, as it allows threat actors to pressure their victims with the threat of public exposure, even if the victims have proper backups and can restore their systems. Dark web leak sites play a major role in this, as they are where stolen information is published or auctioned when organizations do not want to pay.  

This shift will require businesses to monitor underground forum trends in H1 2026, including discussions about leaked data, targeted organizations, and early chatter about upcoming campaigns. Regional data reinforces the same trend. In the Americas alone, 1,305 cyber incidents were reported during Q1 2026, including 1,138 publicly claimed ransomware attacks. Nearly 58% of those attacks were attributed to just five ransomware groups. 

2. Access Brokers Are Powering the Underground Economy 

Many cyberattacks are now starting long before ransomware is deployed. Initial access brokers have become major players, specializing in one activity: network compromise and then selling that access to other threat actors. 

Underground marketplaces also showed growing demand for initial access. In March 2026 alone, researchers observed 80 separate listings advertising access to compromised corporate networks. Government & LEA remained the most targeted industry, with 11 tracked incidents. Governments, Professional services, Manufacturing, and Retail continued to be persistently targeted. 
 
The bulk of this activity traced back to Big-Bro, an initial access broker (IAB) who has operated on Russian-language cybercrime forums since 2022. Two newer actors followed: Saturned33, who appeared in 2025, and Vexin, who surfaced in early 2026 (primarily active in March) and built a reputation selling unauthorized access to corporate cloud environments across multiple countries. 

Ransomware groups and espionage operators don’t need to spend time and effort breaching organizations themselves; they can buy verified entry points into corporate environments. This new division of labor has made cybercrime much faster and more effective. 

Access is typically sold soon after a compromise, so defenders have less time to detect exposed credentials or compromised infrastructure. As such, dark web intelligence is valuable not only for identifying stolen data but also for indicating that access to an organization's network is already being traded on underground markets. 

To see how Cyble’s threat intelligence can help your organization detect external exposure and track threat activity, book a personalized demo. 

3. Identity Has Become the Primary Attack Surface 

With the rise of credential-based attacks over malware, the security perimeter is pretty much irrelevant. The most common enterprise infiltration paths include credential theft, session hijacking, bypassing multi-factor authentication, and abuse of third-party access. All those have one thing in common: valid credentials. 

From an attacker's perspective, logging in with legitimate credentials generates far less suspicion than exploiting software vulnerabilities. As organizations expand cloud adoption and remote work, identities have become a new perimeter. 

Compromised endpoints have always been a key initial access vector for a variety of illicit activities, ranging from data breaches to initial access brokerage (IAB) operations. Compromised Endpoint monitoring is essential to securing an organization’s digital surface in the current threat landscape.  

Over the last 6 months, Vision observed 9.7 billion compromised endpoints. This trend also explains why stolen usernames, passwords, authentication tokens, and corporate accounts continue to be traded on the dark web. Monitoring for exposed credentials allows organizations to respond before compromised identities are weaponized. 

Your executives are a prime target. → Discover how Cyble Executive Monitoring detects executive impersonation and deepfakes before they escalate.

4. Geopolitical Events Are Driving Cyber Activity 

The connection between global conflicts and dark web activity has become increasingly apparent during the first half of 2026. State-sponsored groups, hacktivists, and financially motivated criminals frequently operate in parallel during periods of geopolitical tension, creating a more complex threat environment. 

Rather than focusing exclusively on immediate disruption, many sophisticated actors are investing in long-term access to critical infrastructure, telecommunications, transportation, and energy systems. During the February 2026 escalation in the Middle East, cyber operations demonstrated how geopolitical events now extend into the digital domain.  

Internet connectivity in affected regions reportedly dropped to between 1% and 4% of normal levels; more than 70 hacktivist groups became active; over 8,000 conflict-themed domains were registered for scams and malware campaigns; and disruptions to navigation systems affected more than 1,100 vessels near the Strait of Hormuz. 

This convergence of political objectives and cybercrime makes attribution more difficult and raises the importance of monitoring underground discussions that may signal emerging campaigns before they reach production environments. 

When physical events become cyber risks, can you connect the dots? → Explore Cyble's Physical Security Intelligence

5. AI Is Accelerating Both Attackers and Defenders 

Artificial intelligence has moved from experimentation to operational use across the cybersecurity landscape. Threat actors are increasingly using AI-assisted techniques to automate reconnaissance, accelerate the exploitation of vulnerabilities, and scale phishing campaigns with greater precision. 

The dark web has become a marketplace for sharing AI-enabled attack tools alongside traditional malware, making advanced capabilities accessible to less experienced operators. This lowers the barrier to entry while increasing the overall speed of cyber operations. 

Dark web threat intelligence in 2026 is becoming increasingly AI-driven, with defenders using automated analysis to process large volumes of dark web data, identify indicators of compromise, and prioritize threats in near real time. As attacks unfold more rapidly, automation is becoming necessary to reduce detection and response times. 

The question is no longer whether your organization appears on the dark web. The real question is whether you'll discover it before your attackers do. 

Get Cyble’s Global Threat Landscape Report – H1 2026 for critical insights into the new cyber ecosystem and the actions security leaders should prioritize next.

Conclusion 

The first half of 2026 stresses that the dark web is no longer where stolen information appears after an incident. It has evolved into a live intelligence environment where attacks are planned, infrastructure is traded, identities are monetized, and emerging tactics become visible before they reach production networks. 

Organizations that incorporate dark web intelligence into broader security operations gain more than visibility into compromised data; they gain early warning of evolving threats.  

As ransomware groups become more coordinated, identity attacks continue to rise, and AI reshapes offensive capabilities. Proactive monitoring will play an important role in reducing cyber risk during the remainder of 2026. 

References: 

• 2026 Threat Intelligence Trends, Cyber and Ransomware Report
• Cyble's Monthly Threat Landscape Analysis - March 2026

The post Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape appeared first on Cyble.

The first half of 2026 has given security teams little room to breathe. Ransomware operators kept up a punishing pace. If that wasn’t enough, access brokers turned network intrusions into a marketplace, and nation-state activity blurred further into hacktivism and organized cybercrime. Taken together, the numbers point to a threat landscape that isn't just growing louder; it's becoming faster, more coordinated, and harder to attribute. 

Cyble's monthly and quarterly research has tracked this shift in real time, and the pattern across regions is consistent. In short, attackers are scaling operations while defenders are still catching up. These threat intelligence trends 2026 also provide an early look at the top cyber threats 2026 and what organizations should expect during the remainder of the year. 

Ransomware Set the Pace for Threat Intelligence Trends in 2026 

Ransomware was one of the biggest threat intelligence trends by far in 2026, in terms of visibility. In just the month of March, a total of 702 ransomware attacks and 54 major data breaches and leaks were registered worldwide. More than 56% of that activity was brought by five groups-Qilin, Akira, The Gentlemen, Dragonforce, and INC Ransom- showing how much consolidation has taken place in the ecosystem. 

The pattern was consistent across regions. In the Americas, there were 1,305 cyber incidents in Q1 2026, of which 1,138 were publicly claimed ransomware attacks — and, once again, just five groups drove 58% of that volume. The most affected were construction, professional services, manufacturing, healthcare, and government bodies, primarily because downtime in these sectors has immediate operational or public-safety consequences. 

Dual-extortion tactics, pairing data theft with system disruption, have become close to standard practice. 

Access Brokers Are Quietly Powering the Ecosystem 

The purchase and sale of access to compromised networks is a major driver of ransomware and espionage campaigns. In March 2026, 20 distinct incidents of the sale of access were observed on underground forums, and the most commonly listed sectors were professional services (25%) and retail (20%).  

Three of these sellers, vexin, holyduxy, and algoyim, accounted for over 55% of this activity, effectively forming a supply chain for the larger attacks. This is one of the upstream markets where response time matters; access is usually sold and exploited long before a breach is publicly detected. 

What if attackers are already buying access to your environment before you know it's been compromised? Discover how Cyble Attack Surface Management helps identify exposed assets and reduce opportunities for initial access.

Identity Has Replaced the Perimeter 

Perhaps the biggest change over the past year has been the shift from malware-first breaches to attacks based on identities. Credential theft, MFA bypass, session hijacking, and third-party access abuses have all become key vectors. Instead of breaking in, attackers are logging in -- and that has some serious implications for the design of monitoring and access controls. 

The numbers back this up. In North America, technology and financial services accounted for 44% of all breach activity in the first half of 2026 — sectors where identity and access sit right at the center of daily operations. Nearly 300 domains were also hit by hacktivist campaigns in the region over that same time, reminding everyone that disruption doesn't always have to come from a super-sophisticated intrusion; sometimes all it takes is one exposed login or an edge system that's gone unpatched. 

Attackers don't always break in anymore—they simply log in. Learn how Cyble Brand Intelligence & Protection helps detect exposed credentials and identity-related threats before they're exploited.

Geopolitics Is Now a Cyber Multiplier 

State-sponsored activity has grown more strategic, with actors focused on mapping dependencies and pre-positioning access rather than pursuing immediate disruption. Regional tensions have accelerated this further, with hybrid operations blending cyberattacks, disinformation, and kinetic action in ways that ripple well beyond the immediate conflict zone.  

During the February 2026 escalation in the Middle East, internet connectivity in targeted regions dropped to as low as 1–4% of normal levels, more than 70 hacktivist groups joined the fray, and disruption to navigation systems affected over 1,100 vessels near the Strait of Hormuz. More than 8,000 conflict-themed domains were also registered during this period to run scams, malware, and disinformation campaigns.  

Critical infrastructure, energy, water, transportation, and communications have emerged as the common target across nearly every regional threat report published this year, and India's own H1 tally from 2024 (593 attacks, including 388 breaches, 107 leaks, and 39 ransomware incidents) shows the same dynamics playing out closer to home. 

AI Is Reshaping Both Sides of the Fight 

AI-driven tooling has moved from experimental to operational. An open-source AI-native testing framework was used to compromise more than 600 Fortinet FortiGate appliances across 55 countries, while 26 malicious npm packages linked to North Korean actors distributed RAT malware through Pastebin- and Vercel-based infrastructure. These incidents also reflect broader vulnerability exploitation trends, where exposed security infrastructure is weaponized rapidly after vulnerabilities become known. 

This tracks with a broader trend flagged going into the year: AI-driven ransomware activity jumped 50%, and October 2025 alone saw software supply chain attacks spike 32% above the previous record. On the defensive side, organizations are beginning to lean on AI-assisted monitoring to keep pace with attacks that no longer unfold on human timescales. 

Cyble Blaze AI accelerates these threat investigations with AI-powered analysis, helping security teams quickly understand, prioritize, and respond to cyber threats. 

Threats evolve every day. Your threat intelligence should too. See how Cyble Cyber Threat Intelligence delivers actionable insights across ransomware, identity, vulnerabilities, and emerging threats.

Conclusion 

The first half of the year highlights a few things about threat intelligence trends that need to be cleared up. First, threat actors are operating with more coordination. Second, less patience, and overlapping motives, financial, political, and strategic. And lastly, organizations that treat cybersecurity as a purely technical function are recalibrating, with boards and executives now directly involved in risk decisions. 

Taken together, these developments provide a clear mid-year threat intelligence trends forecast and shape the broader cyber risk outlook for 2026. Security teams should expect attackers to continue scaling operations, exploiting identities, and leveraging AI throughout the remainder of the year. 

Cyble's full H1 2026 Threat Landscape Report will bring together this data with deeper sector, regional, and actor-level analysis to help security teams prioritize what actually matters for the second half of the year. 

What happened in H1 2026 will define the threats of tomorrow.

From ransomware operations and underground access markets to AI-driven attacks and geopolitical cyber campaigns, the threat landscape is evolving faster than ever.

Download Cyble’s H1 2026 Threat Landscape Report to understand what security leaders should prepare for in the second half of the year.

Subscribe to get Cyble's ongoing threat intelligence coverage across ransomware, dark web activity, and emerging attack trends.   

References: 

• https://cyble.com/blog/monthly-threat-landscape-march-2026/ 

• https://cyble.com/blog/critical-infrastructure-cyberattack-threats-2026/ 

• https://cyble.com/blog/hybrid-warfare-2026-cyber-kinetic-threats/ 

The post Mid-Year Threat Trends: What H1 2026 Signals for the Rest of the Year appeared first on Cyble.

Executive Summary 

The FIFA World Cup 2026 has become more than a global sporting event. It has evolved into a large-scale cybercrime opportunity exploited by threat actors through a coordinated ecosystem of fraudulent domains, social media channels, messaging platforms, pirated streaming services, and dark web activity. Since May 2026, Cyble Research and Intelligence Labs (CRIL) has identified nearly 4,000 domains impersonating FIFA-related brands, ticketing platforms, streaming services, and fan-facing resources. 
 
Operation FanTrap reveals how threat actors are building end-to-end fraud operations designed to attract, engage, and monetize football fans worldwide. Victims are lured through fake ticket offers, VIP access schemes, counterfeit hospitality portals, and unauthorized streaming platforms. Evidence also shows victims being redirected to private communication channels such as Telegram and WhatsApp, where payment fraud, credential theft, and identity harvesting occur. 
 
CRIL’s investigation also identified growing dark web activity linked to the tournament, including claims of football-sector identity data leaks and discussions around ticket resale opportunities. While the authenticity of some leak claims remains under investigation, their circulation highlights the increasing convergence of fan-targeted fraud, identity theft, and cyber-enabled financial crime. 
 
The campaign demonstrates how major international events create a scalable environment for cybercriminal operations. Through multilingual targeting, extensive infrastructure deployment, and diversified monetization strategies, threat actors are transforming global sporting events into sustained cybercrime ecosystems. 

Key Takeaways 

• Operation FanTrap is a coordinated investigation into the broader fraud ecosystem exploiting global interest in FIFA events 

• Nearly 4,000 FIFA-themed domains were identified supporting phishing, ticket fraud, VIP scams, streaming lures, and brand impersonation. 

• The websites used a multilingual infrastructure to maximize victim reach, with a particularly strong focus on Chinese-speaking audiences. 

• Telegram and WhatsApp function as transaction layers where victims are moved from public-facing infrastructure into private fraud workflows. 

• Pirated streaming platforms serve as credential theft and payment fraud funnels rather than simple copyright violations. 

• Dark web discussions and alleged football-sector identity leaks create opportunities for targeted social engineering and secondary monetization. 

Campaign overview 

The FIFA World Cup 2026 will span the US, Canada, and Mexico, with a 48-team format and global broadcast reach. CRIL's monitoring uncovered significant spikes in malicious domain registrations mapped to specific attack themes, demonstrating how threat actors rapidly adapted their infrastructure to capitalize on tournament-related interest. 

Anatomy of the FIFA 2026 Fraud Ecosystem 

Domain Patterns - The Fraud Ecosystem 

Threat actors leveraged ticketing, VIP access, official branding, and live streaming to broaden their victim pool. Examples of these domain patterns are shown in the table below. 

The extensive use of zh-, cn-, and Chinese-language World Cup labels such as shijiebei, pankou, and maiqiu highlights a deliberate focus on Mandarin-speaking audiences. This targeting extends beyond traditional ticket fraud to encompass betting platforms, media-themed credential theft, piracy lures, prize scams, and counterfeit merchandise. This signals a persistent and organized fraud ecosystem designed to capitalize on China's large football fanbase and strong demand for World Cup-related content and services. 

Dark Web Intelligence 

We also identified a growing ecosystem of ticket resale fraud on Telegram and WhatsApp, as well as pirated streaming lures. Both are actively used to monetize fan interest and facilitate fraud, credential harvesting, and other malicious activity. 

Resell Traps on Messaging Services. 

Monitoring of deep- and dark-web sources identified numerous advertisements and reseller communities promoting FIFA World Cup tickets via Telegram and WhatsApp. Fraudsters frequently use these platforms because they facilitate private, direct communication while limiting oversight and accountability.  

Threat actors often establish credibility through fabricated testimonials, forged purchase confirmations, edited screenshots, recycled ticket images, and scripted customer-support interactions. However, such indicators of legitimacy can be easily manufactured and should not be considered proof of ticket ownership or delivery capability. Additionally, the closed nature of these channels enables attackers to create a sense of urgency, collect payments, and disengage victims with minimal traceability. 

The example below illustrates a Telegram-based ticket resale advertisement identified during monitoring, highlighting the use of unofficial and potentially fraudulent sales channels. 

The pirated stream trap: free football, expensive consequences 

Pirated streaming sites exploit fans seeking free access to World Cup matches, using geo-restrictions, subscription costs, and broadcast limitations as bait. Rather than delivering live streams, many function as fraud and malware distribution platforms, employing fake video players, deceptive download prompts, browser notification prompts, and fraudulent free-trial offers to harvest credentials, payment information, and user data.  

To evade detection, we identified domains that avoid FIFA- or World Cup-related keywords in domain names. These links are promoted through fan forums, Discord servers, Telegram channels, and WhatsApp groups, lending credibility to malicious infrastructure. 

Examples identified during monitoring include: 

• footybite[.]vc 

• epicsports[.]in 

• footballnewslive[.]online 

• totalsportek[.]online 

• sportshub[.]fan 

• streameast[.]im 

The risk is beyond legal or copyright concerns. For many fans, the real danger lay in the broader cybersecurity ecosystem surrounding these platforms. Pirated streaming sites and services often acted as data collection points, quietly harvesting email addresses, passwords, payment details, phone numbers, and device information. 

Unofficial streaming apps and APK files added another layer of risk. They frequently requested excessive permissions, delivered intrusive ads, tracked user activity, and in some cases, served as entry points for malware. What seemed like a convenient way to watch a match could quickly turn into a channel for data exposure and system compromise. 

Ticket Scams and VIP Access Fraud  

Forum-based ticket promotions added another layer of risk to World Cup scams by combining resale listings with the appearance of community trust. Sellers often seemed more credible than random social media accounts, as consistent posting, forum history, and visible profile activity created a sense of legitimacy. However, this credibility could be misleading. Fans should remain cautious, as an active profile did not guarantee ticket authenticity, official authorization, secure payments, or a successful transfer—even within seemingly trusted communities. 

Identity and PII leak claims  

CRIL also observed forum discussions about leaked football-related identity data, highlighting how World Cup–related cybercrime can extend beyond fan scams into the broader football ecosystem. For example, one post titled “150k+ football passports leaked weeks before FIFA World Cup” claimed that passport scans and personal details of over 150,000 AFC and Al Nassr FC players and coaches had been exposed. The alleged leak included sensitive information such as full names, passport numbers, scans, dates of birth, nationalities, player roles, club affiliations, email addresses, contracts, AFC IDs, and even match or venue details.  

Such claims require independent forensic verification before a confirmed breach status can be assigned. Regardless of authenticity, the circulation of this data in the pre-tournament window confirms threat actors are actively seeking to monetize football-sector identity assets. If the record set is genuine, it enables targeted spear-phishing against club staff, agent impersonation in transfer fraud, contract manipulation, and abuse of venue access credentials. 

Connecting the Ecosystem – Attack Lifecycle 

By correlating our findings and research, we reconstructed the end-to-end attack chain used by threat actors. The analysis demonstrates how these seemingly independent activities are strategically aligned around the global popularity of FIFA events, enabling attackers to exploit fan enthusiasm, urgency, and trust. Together, these components form a coordinated FIFA-themed fraud ecosystem designed to attract victims, harvest sensitive information, facilitate financial fraud, and generate sustained criminal revenue.

The stages are as follows: 

• Stage 1 – Infrastructure Preparation: Registration of FIFA-themed domains and supporting online assets. 
• Stage 2 – Victim Acquisition: Promotion through search engines, social platforms, forums, messaging communities, and streaming portals. 
• Stage 3 – Engagement and Conversion: Fake ticket sales, VIP packages, hospitality offers, and streaming access are used to build trust. 
• Stage 4 – Data Collection: Harvesting of credentials, payment information, personal identifiers, and communication details. 
• Stage 5 – Monetization: Fraudulent payments, resale scams, credential abuse, phishing campaigns, and potential resale on the dark web of collected information. 

Conclusion 

Operation FanTrap demonstrates how global sporting events have evolved into highly attractive targets for organized cybercriminal activity. Rather than relying on isolated phishing campaigns or opportunistic scams, threat actors are building interconnected ecosystems that combine malicious infrastructure, social engineering, messaging platforms, streaming lures, and dark web activity to maximize financial returns. 

The nearly 4,000 domains identified by CRIL represent only one layer of a broader operation designed to exploit fan enthusiasm, event urgency, and global online engagement. Ticket scams, VIP access fraud, streaming lures, and alleged football-sector identity leaks collectively illustrate how attackers are diversifying their monetization strategies throughout the tournament lifecycle. 

As the FIFA World Cup 2026 continues, organizations, broadcasters, ticketing providers, and fans should view these activities not as isolated incidents but as components of an active and evolving cybercrime ecosystem. Continuous monitoring, rapid infrastructure disruption, dark web visibility, and proactive user awareness will remain critical to reducing risk throughout the tournament. 

CRIL will continue tracking this cluster and updating IoCs as new infrastructure emerges. All indicators are submitted to Cyble's threat feeds and accessible to Vision platform customers. Fan-facing brands, ticketing platforms, and event organizers should treat this as an active threat and prioritize domain monitoring and takedown workflows throughout the tournament. 

Recommendations 

Based on the findings presented above, CRIL recommends the following actions for immediate consideration by security teams and organizations: 

• Implement keyword-aware domain monitoring that flags FIFA, tournament branding, and language-prefix patterns (zh-, cn-, kr-) as compounding risk signals alongside registrar identity, TLD, and domain age. 

• Build takedown workflows that account for Cloudflare-proxied infrastructure — abuse requests must target the underlying origin, not the CDN layer, to be operationally effective. 

• Integrate campaign-cluster pivoting from confirmed IoCs into threat hunting workflows, using shared IP subnets and registrar concentration as primary pivot axes. 

• Apply multi-platform fraud funnel awareness: detection should extend beyond domains to Telegram and WhatsApp channels used for off-platform transaction completion. 

• For ticketing platforms and official broadcasters: issue proactive fan advisories confirming that legitimate ticket transactions will never be negotiated via private messaging apps or unverified resale portals. 

• Revise security awareness materials to teach structural URL interpretation — with specific focus on identifying lookalike FIFA domains that embed official terminology in subdomains or hyphenated strings rather than the root registered domain. 

• Monitor dark web forums for emerging data leak claims targeting football organizations, and treat leaked PII — particularly passport and contract data — as an active social engineering enabler requiring targeted victim notification. 

The need for a proactive cyberdefense stance 

The current threat landscape includes a multitude of Social Engineering campaigns. Security teams need more than reactive controls to keep ahead of these. 

Solutions such as Cyble Vision deliver operational intelligence that enables defenders to stay ahead of adversaries through early detection, campaign-level visibility, and infrastructure mapping. 

Cyble Vision specifically empowers security teams to move beyond isolated detection, providing the strategic insight needed to anticipate threats, monitor adversary activity, and respond with precision at every stage of the attack lifecycle. Security teams can take necessary preventive action with the help of: 

• Real-Time IOC Monitoring 
  Enable continuous tracking of indicators tied to adversary infrastructure before they reach end users. 

• Credential Phishing Infrastructure Mapping 
  Map attacker-controlled infrastructure, including fake authentication portals, dynamic exfiltration endpoints, and backend logic designed to capture credentials. 

• Brand and Executive Impersonation Monitoring 
  Detect domain spoofing and impersonation attempts targeting internal functions such as HR and Finance—often used to increase trust and exploit user familiarity. 

• Deep and Dark Web Visibility 
  Surface chatter, leaked credentials, and phishing toolkits from deep/dark web sources, offering early insight into attacker preparation and target selection. 

• Global Targeting Intelligence 
  Track phishing activity across global regions—including North America, EMEA, and APAC—as well as over 70 industry sectors, providing defenders with contextual understanding of targeting patterns. 

• Threat Actor Attribution and TTP Correlation 
  Associate infrastructure, techniques, and behavioral patterns with known threat actors, empowering security teams to prioritize response based on adversary capability and intent. 

MITRE ATT&CK® Techniques 

Indicators of Compromise (IOCs) 

The IOCs have been added to this GitHub repository. Please review and integrate them into your Threat Intelligence feed to enhance protection and improve your overall security posture. 

The post Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem appeared first on Cyble.

The FIFA World Cup 2026 kicks off on June 11, and the world's biggest sporting event is drawing more than just fans — it is already attracting a wave of cybercriminals targeting ticket buyers, job seekers, streaming viewers, and corporate brands alike. 

The FBI has issued a formal Public Service Announcement warning that threat actors are creating fraudulent versions of FIFA-affiliated websites to steal personal information, conduct financial fraud, and sell fake products and services. Cyble researchers independently analyzed the domains flagged by the FBI and confirmed that many remained active and operational at the time of publishing this report. 

With 48 teams, 16 host cities across the United States, Canada, and Mexico, and an estimated global audience of billions, the FIFA World Cup 2026 is set to be the largest men's World Cup in history. That scale is precisely why cybercriminals are prying on it — and why the threat is arriving earlier and more aggressively than in previous tournaments. 

See which domains targeting your brand are active right now
Run a Free External Threat Report

How FIFA World Cup 2026 Scams Work 

The FBI warns that threat actors are building fraudulent versions of FIFA's official website, www.fifa.com, designed to closely mimic the legitimate experience. These sites are engineered to collect personally identifiable information (PII), including full names, home addresses, phone numbers, email addresses, banking information, and payment card details. 

The same fraudulent infrastructure is used to run a range of operations simultaneously: FIFA ticket scams, fake hospitality package sales, fraudulent job listings, and other forms of financial fraud. 

The most common technical method is typosquatting — registering domains with subtle spelling changes or different extensions that trick users into believing they have landed on an official page. A single missing letter, a swapped extension, or a hyphenated variant can be enough to deceive even vigilant users, especially when the site is dressed with FIFA branding, tournament schedules, and professional-looking navigation menus. 

The FBI flagged the following domains as fraudulent FIFA-related sites: 

Source: FBI PSA — Domains defanged for safety 

Is your brand being spoofed? Cyble tracks typosquatted domains in real time
Request a demo

Cyble researchers tracked these domains and confirmed that many were still operational at the time of publishing. Notably, even when a malicious domain is taken down, new ones tend to appear almost instantaneously. The fraudulent infrastructure is not a one-time campaign — it is continuously regenerating. 

Fake FIFA Hospitality, Ticket, and Sale Sites 

One of the most convincing examples identified by Cyble researchers was ww-fifa[.]com — a classic typosquatting attack that removes a single "w" from the legitimate FIFA URL. The site presents itself as an official FIFA World Cup 2026 portal, complete with tournament branding, navigation menus, ticket information, and hospitality package offers. 

Visitors to this site are encouraged to purchase premium packages that include tickets, food, beverages, lounge access, and related services — all fraudulent. 

Cyble researchers identified several indicators that expose the site as illegitimate: 

• Duplicate page titles appearing twice in the browser tab 

• Missing or broken images throughout the site 

• Navigation links leading to attacker-controlled pages 

• Ticket purchase prompts requesting personal and financial information with no legitimate payment processing 

What makes these sites especially dangerous is the sophistication of the presentation. Unlike the crude phishing pages of a decade ago, modern FIFA 2026 scam sites replicate the visual design of official sports portals convincingly enough to pass a casual inspection. 

Security Vendors Have Already Flagged FIFA-Related Domains 

Cyble researchers analyzed the domain fifa[.]help using VirusTotal and found that, at the time of analysis, 15 out of 92 security vendors had classified it as malicious. Vendor classifications included phishing, fraud, and related threat categories. 

While a detection rate of 15/92 may seem modest, it represents significant early-stage flagging. Many security vendors lag in classifying newly registered domains, so the fact that multiple established providers had already flagged this domain confirms a credible threat.  

As these domains age and accumulate more malicious activity reports, detection rates will rise — but by then, victims will already have been targeted. 

Download Cyble's Annual Threat Landscape Report to track global scam trends

Fake FIFA Recruitment Sites Are Also Active 

Not all FIFA World Cup 2026 scams target ticket buyers or fans. Cyble researchers identified an entirely separate fraud vector targeting job seekers: the domain fifaworldcup-careers[.]com, which presents itself as a FIFA employment portal for World Cup-related positions. 

VirusTotal data revealed: 

• www.fifaworldcup-careers[.]com was flagged by 8 out of 91 vendors 

• The root domain was flagged by 14 out of 91 vendors 

• The domain resolved to multiple IP addresses, including 3.71.180.249, 13.249.91.65, and 13.249.91.101 

The use of multiple IP addresses suggests the domain may be operating behind content delivery or load-balancing infrastructure, which makes takedowns significantly more difficult to execute. 

WHOIS data shows the domain was registered and updated in mid-to-late April 2026, with the registrant's identity hidden behind a privacy shield. Two SSL certificates were also issued on April 15 and April 16, including a wildcard certificate covering *.fifaworldcup-careers[.]com — a sign of deliberate, technically capable infrastructure setup rather than an opportunistic amateur operation. 

Threat actors target employees too. See how Cyble detects campaigns early.
Protect Your Organization!

Why this matters: Job seekers searching for World Cup-related employment — hospitality roles, security staff, event coordinators, media positions — are a highly vulnerable and largely overlooked audience. These individuals are not on guard for ticket scams; they are in application mode, and they will willingly submit full personal information, resumes, and even government ID to what they believe is a legitimate employer. 

How to Avoid FIFA World Cup 2026 Ticket Scams 

As fans search for how to watch the FIFA World Cup 2026 or purchase tickets, the FBI recommends the following precautions: 

• Type fifa.com directly into your browser's address bar — never rely on search results or links in messages 

• Avoid sponsored search results, which can be purchased by attackers to appear above legitimate results 

• Confirm that the URL is exactly www.fifa.com before entering any information 

• Use saved bookmarks or browser favorites when revisiting FIFA websites 

• Access FIFA subdomains only through the official homepage, not by typing them directly 

• Be cautious of websites with broken graphics, poor-quality branding, or duplicate content 

• Do not provide sensitive information unless the site's legitimacy has been independently verified 

• Review URLs carefully before clicking any advertisements 

These steps are especially important for avoiding FIFA 2026 ticket price scams, where attackers create a false sense of urgency through fake discounts, exclusive hospitality offers, or limited-time deals that pressure users into making fast payment decisions. 

How to Watch FIFA World Cup 2026 Safely 

Scammers are targeting not only ticket buyers but viewers as well. Fraudulent streaming platforms are expected to proliferate as the tournament approaches, exploiting the high demand for match access — particularly from fans in regions where official broadcasts are expensive or limited. 

To reduce risk when looking for FIFA World Cup 2026 streaming options: 

• Use only official FIFA channels and licensed regional broadcasters for tournament information 

• Watch matches exclusively through broadcasters licensed for your region 

• Avoid streaming links shared through unsolicited emails, social media messages, or WhatsApp groups 

• Verify URLs carefully before creating accounts or entering any payment information 

• Be cautious of websites offering heavily discounted subscription packages or "exclusive" access to all matches 

Many fake streaming platforms use the same tactics seen in FIFA ticket scams: they exploit demand for tournament content to harvest personal and financial information, either immediately or through credential-stuffing attacks down the line. 

What To Do If You Become a Victim of a FIFA World Cup 2026 Scam 

The FBI expects additional spoofed domains to appear throughout the tournament period — before, during, and after matches. If you encounter a suspected FIFA World Cup 2026 scam, document as much information as possible before the site disappears, including: 

• The fraudulent domain name 

• Screenshots of the website 

• Any communication records (emails, SMS, chat logs) 

• Payment details if a transaction occurred 

• Cryptocurrency wallet addresses, if applicable 

Victims can file a complaint with the Internet Crime Complaint Center (IC3) at ic3.gov and should include the fake domain involved, details of all interactions with the site, information submitted to the scammers, payment records, receiving financial institution information, and any cryptocurrency transaction details. 

Reporting promptly not only helps your case but also contributes to the broader effort to get these domains flagged and taken down faster. 

Protect Your Brand from Fake FIFA World Cup 2026 Phishing Campaigns 

Major global events like the FIFA World Cup create a concentrated window of opportunity for cybercriminals to launch phishing campaigns, register fraudulent domains, and impersonate trusted brands. As the active FIFA-related scam infrastructure identified by Cyble researchers demonstrates, this is not a theoretical risk — it is a live and expanding threat landscape. 

Organizations operating in travel, hospitality, ticketing, media, and any sector adjacent to the FIFA World Cup 2026 need proactive brand protection measures in place now — not after the first incident. 

Cyble's Brand Intelligence solution helps organizations detect malicious domains, phishing websites, brand impersonation attempts, and other forms of digital abuse in real time. Combined with Dark Web and Cyber Crime Monitoring and Takedown & Disruption services, security teams can identify threats early, investigate malicious activity, and accelerate the removal of fraudulent infrastructure before it causes financial or reputational damage. 

Deploy Brand Protection Now

Check out how Cyble helps organizations detect, monitor, and disrupt phishing campaigns, fraudulent domains, and brand abuse before they lead to financial loss or reputational damage. 

Frequently Asked Questions 

The post FIFA World Cup 2026 Scams Are Already Active: Fake Domains, Phishing Sites, and How to Stay Safe appeared first on Cyble.