Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to disrupt operations.
The post Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America appeared first on Unit 42.
The Americas carried the heaviest ransomware burden of any region on the planet in the first half of 2026. According to Cyble Research and Intelligence Labs (CRIL), North and South America combined experienced 2,188 documented ransomware attacks between January and June 2026.
That single figure — 2,188 attacks — represents more than 57% of the 3,836 ransomware incidents CRIL tracked worldwide, making the Americas the undisputed center of gravity for global ransomware operations.
But the Americas is not a single threat theatre — it is two. North America alone absorbed 1,981 attacks, driven by a mature, multi-group Ransomware-as-a-Service (RaaS) economy competing for market share. South America, by contrast, recorded 207 attacks concentrated around a much smaller set of operators, with one group — The Gentlemen — claiming nearly a quarter of all regional incidents outright. Understanding the Americas means understanding both halves of that story: a saturated northern market and a consolidating southern one.
Security leaders operating across the hemisphere cannot apply a single threat model to both sub-regions. The data shows meaningfully different attacker behavior, concentration, and monetization strategy north and south of the equator.
| Metric | North America | South America |
| Ransomware Attacks | 1,981 | 207 |
| Dominant Ransomware Actor | Qilin (370 attacks) | The Gentlemen (46 attacks) |
| Top Targeted Sector | Construction | IT & ITES |
| Top Targeted Nation | United States (1,721) | Brazil (71) |
| Distinct Ransomware Groups Active | 50+ | 30+ |
| % of Attacks from Top 3 Groups | ~40% (Qilin, Akira, INC Ransom) | ~57.5% (The Gentlemen, Qilin, LockBit) |
Why the split matters: North America's threat landscape is a genuine marketplace — dozens of RaaS operators compete for affiliate loyalty, and no single group commands more than a fifth of total volume. South America's landscape is more consolidated, with three groups controlling well over half of all attacks.
For defenders, that means North American organizations need broad-spectrum threat intelligence covering a long tail of active groups, while South American organizations can build highly specific defenses against a short list of named adversaries.
Across both sub-regions combined, five ransomware operators account for the overwhelming share of documented activity: Qilin, Akira, INC Ransom, Dragonforce, and The Gentlemen. Together, these five groups are linked to roughly 1,148 of the Americas' 2,188 attacks — approximately 52.5% of all regional ransomware activity.
Attack Volume: 410 documented incidents across the Americas (370 in North America, 40 in South America) — 18.7% of the regional total.
Qilin is the single most prolific ransomware actor operating in the hemisphere, and its dominance is not evenly spread — it is concentrated hardest in the United States.
Geographic Concentration:
Worldwide Sectoral Targeting: Qilin's targeting logic is deliberate rather than opportunistic:
Operational Characteristics:
Qilin's affiliate model is built for scale. Initial access brokers handle reconnaissance and compromise, mid-tier operators manage lateral movement, and dedicated crews execute encryption and exfiltration. This compartmentalization lets Qilin run dozens of concurrent operations across the United States without any single point of failure. The group's near-total dominance of the American ransomware market (323 of 1,721 US attacks) suggests either an unusually large affiliate roster or a payout structure attractive enough to pull operators away from competing platforms.
Why Qilin Dominates:
Americas Security Implications: Any organization in construction, professional services, manufacturing, or healthcare operating in the US or Canada should treat Qilin as a primary named threat, not a generic ransomware risk.
Attack Volume: 268 documented incidents, almost entirely concentrated in North America — 12.2% of the regional total
Akira is the second most active group in the Americas, and unlike Qilin, its footprint is almost exclusively North American. CRIL's data shows Akira's South American presence is negligible to date.
Geographic Concentration:
Worldwide Sectoral Targeting:
Operational Characteristics:
Akira has built a reliable playbook around compromising small-to-medium-sized businesses through unpatched public-facing network devices, then pivoting into construction and manufacturing environments where downtime tolerance is lowest. The group's consistency — rather than explosive growth — is its defining trait; it has neither the explosive scale of Qilin nor the geographic diversification of The Gentlemen, but it reliably executes against the same target profile month after month.
Americas Security Implications: North American SMBs in construction, manufacturing, and professional services should assume Akira is actively scanning for exposed remote access infrastructure. Its South American absence should not be mistaken for permanence — RaaS groups expand geographically once North American markets saturate.
Attack Volume: 171 documented incidents (164 in North America, 7 in South America) — 7.8% of the regional total
INC Ransom distinguishes itself through sector specialization rather than volume. The group shows a clear, repeated preference for Professional Services organizations — particularly law firms — leveraging the sensitive, high-stakes nature of legal client data.
Geographic Concentration:
Worldwide Sectoral Targeting:
Operational Characteristics:
INC Ransom's rapid operational pace and consistent targeting of law firms, healthcare providers, and transportation/energy operators reflects a strategy built entirely around double-extortion leverage. The sensitivity of the data matters more than the size of the victim. A regional law firm holding privileged client communications is, to INC Ransom, a more valuable target than a much larger manufacturer with less sensitive data.
Americas Security Implications: Law firms, accounting practices, and consulting shops across the US, Canada, and Brazil should assume INC Ransom is actively targeting client confidentiality as leverage — not just encrypting file servers for disruption.
Attack Volume: 153 documented incidents (148 in North America, 5 in South America) — 7.0% of the regional total
Dragonforce maintains an aggressive operational tempo focused heavily on the United States, with a strategy that suggests supply-chain-aware targeting rather than random opportunism.
Geographic Concentration:
Worldwide Sectoral Targeting:
Operational Characteristics:
Dragonforce's manufacturing and construction focus mirrors Qilin's and Akira's playbooks, but its concentration in the US combined with limited-but-present South American activity hints at interest in transnational manufacturing supply chains. North American organizations with manufacturing partners or subsidiaries in Latin America should treat this as a lateral-access risk, not just a direct-targeting one.
Americas Security Implications: Manufacturers and construction firms with cross-border operations — a common structure across USMCA supply chains — should extend Dragonforce-specific monitoring to subsidiaries and vendors, not just headquarters networks.
Attack Volume: 146 documented incidents (100 in North America, 46 in South America) — 6.7% of the regional total, but the single most active ransomware group in South America specifically.
While The Gentlemen rank fifth across the combined Americas, they are the #1 threat actor in South America on their own — responsible for roughly 22% of every ransomware attack recorded in that sub-region.
Geographic Concentration:
Worldwide Sectoral Targeting:
Operational Characteristics:
The Gentlemen are a relatively new operator that has achieved outsized scale in a short window, and their South American concentration is the most important regional signal in this dataset. Unlike Qilin or Akira — which built North American dominance first and are only beginning to diversify — The Gentlemen appear to have prioritized South America as a primary theatre from early in their operational life, an unusual strategic choice that may reflect lower defensive maturity, less aggressive law enforcement cooperation, or simply less competitive pressure from other RaaS operators in the sub-region.
Americas Security Implications: South American organizations — especially in healthcare, manufacturing, and IT services — should treat The Gentlemen as their single highest-priority named adversary. North American organizations should not discount them either; 100 US-focused attacks is a substantial footprint for a group still building its brand.
Three additional groups warrant inclusion in any Americas threat model:
Attack Volume: 1,721 ransomware attacks — 78.7% of all Americas ransomware activity, and roughly 45% of every ransomware attack recorded worldwide.
No other country on Earth comes close to the volume of ransomware activity absorbed by the United States in H1 2026. The country functions as the default target for nearly every major RaaS operator active today.
Threat Actor Concentration:
Sectoral Breakdown: Manufacturing, Professional Services, Construction, and Healthcare bear the brunt, consistent with the broader North American pattern of operationally sensitive, low-downtime-tolerance industries.
The scale of the US economy, its dense concentration of mid-market manufacturers, law firms, and healthcare providers, and its comparatively high ransom-payment history combine to make it the most economically rational target for every major ransomware operator. US organizations also frequently anchor cross-border supply chains stretching into Canada, Mexico, and South America — meaning a US compromise can cascade into lateral access against hemispheric partners.
Defensive Priority: US organizations across construction, manufacturing, professional services, and healthcare should assume Qilin, Akira, INC Ransom, Dragonforce, Play, and The Gentlemen are all actively scanning for exploitable entry points into their networks simultaneously — not sequentially.
Attack Volume: 179 ransomware attacks — 8.2% of the regional total.
Canada's threat profile closely tracks the United States, reflecting deep economic integration and shared supply chains rather than a distinct targeting logic of its own.
Sectoral Breakdown: Manufacturing, professional services, and construction dominate, mirroring the US pattern almost directly.
Canadian organizations are frequently subsidiaries, suppliers, or joint-venture partners of US enterprises, which means the same RaaS groups saturating the US market extend naturally northward. Cross-border manufacturing in particular creates lateral access opportunities that Dragonforce and Akira appear well-positioned to exploit.
Defensive Priority: Canadian organizations should not assume distance from US headquarters provides insulation — the same threat actors, exploiting the same vulnerability classes, are already active on both sides of the border.
Attack Volume: 71 ransomware attacks — 3.2% of the regional total, but the largest single concentration in South America.
Brazil represents South America's most complex threat environment, combining traditional ransomware pressure with a maturing, sophisticated financial malware ecosystem.
Threat Actor Concentration: The Gentlemen (15 attacks), LockBit, and a fragmented tail of smaller operators.
Sectoral Breakdown: Government & Law Enforcement, BFSI, and Healthcare are the most consistently targeted sectors.
Beyond ransomware, Brazil emerged in H1 2026 as a focal point for new Android banking trojan families — TCLBANKER and BTMOB RAT — which use self-propagation, evasion techniques, and Malware-as-a-Service (MaaS) distribution models to target banking and cryptocurrency users directly. Brazil also suffered an alleged 250-million-record breach of Serasa, one of the country's largest credit bureaus, alongside an access sale allegedly targeting the Central Bank of Brazil — a listing that, if genuine, represents one of the most significant initial-access offerings tracked anywhere in the report.
Defensive Priority: Brazilian financial institutions should treat mobile banking malware and ransomware as converging risks rather than separate problems — the same underground economy is monetizing both. Government and BFSI entities should assume access-broker listings referencing critical national infrastructure require immediate incident-response-level validation, not routine monitoring.
Attack Volume: 39 ransomware attacks — 1.8% of the regional total.
Mexico's attack volume is meaningfully lower than the US, Canada, or Brazil, but its position within North American manufacturing supply chains — accelerated by ongoing nearshoring trends — makes it a nation to watch closely rather than dismiss.
As global manufacturers continue relocating production closer to the US market, Mexican facilities increasingly sit inside the same supply chains that Dragonforce, Akira, and Qilin already target aggressively north of the border. Lower current attack volume may reflect earlier-stage targeting rather than lower risk — a pattern security teams should not mistake for durable safety.
Defensive Priority: Manufacturers with Mexican operations should extend the same OT/IT segmentation and vulnerability management discipline applied to US and Canadian facilities to their Mexican sites, rather than treating them as lower priority.
Attack Volume: 33 ransomware attacks — 1.5% of the regional total.
Colombia's ransomware volume is modest, but the country stands out for the density of ideologically motivated activity layered on top of financially driven attacks.
Groups such as Anonymous Colombia (#OpColombia) ran active campaigns throughout H1 2026 blending website defacement, DDoS attacks, and data leak activity — consistent with the broader South American pattern in which hacktivist-branded channels frequently overlap with financially motivated cybercrime infrastructure.
Defensive Priority: Colombian government and law enforcement entities — the most frequently targeted sector across South America overall — should treat hacktivist claims as credible threat intelligence signals rather than dismissing them as purely ideological noise.
Attack Volume: The second most heavily impacted sector in North America.
Professional services firms — law, accounting, and consulting practices — are one of the top jobs on North America's ransomware target list, driven overwhelmingly by INC Ransom and AiLock's aggressive targeting of client-confidential data.
Notable Incident Pattern: AiLock's activity stood out for a coordinated wave of victim disclosures on a single day — March 3, 2026 — a pattern consistent with mass-exploitation of a shared vulnerability rather than individually researched targeting.
Defensive Recommendations:
Attack Volume: Construction and Manufacturing rank first and third in North America; combined, they represent the largest share of Qilin, Akira, Dragonforce, and The Gentlemen's worldwide targeting.
Constructions and manufacturing share a common vulnerability across the Americas: both operate on tight, contractually enforced timelines where downtime translates directly into cascading financial penalties.
Defensive Recommendations:
Attack Volume: One of the top four most heavily impacted sectors in South America.
Healthcare organizations across the Americas — but particularly in South America — face a threat dynamic distinct from financial pressure alone: ransomware attacks against hospitals directly endanger patient safety.
Defensive Recommendations:
Attack Volume: 33% of all North American initial access listings — the second-most targeted sector in the region's access brokerage market.
A distinctive Americas finding: initial access brokers targeting the region show unusually strong interest in Agriculture & Livestock, second only to Technology.
North America's food supply chain increasingly depends on connected logistics, cold-chain monitoring, and precision agriculture technology — creating an attack surface that did not meaningfully exist a decade ago. Access brokers appear to be positioning themselves ahead of ransomware operators, selling footholds into agricultural operations before ransomware crews weaponize them. This mirrors a pattern seen elsewhere globally but is particularly pronounced in North America's access brokerage data.
Defensive Recommendations:
Unlike most hacktivist channels tracked in this report, SOLDADOS DIGITALES – UNIÓN AMERICANA operates across both North and South America, making it one of the few genuinely hemispheric threat actors identified in H1 2026 — a significant finding given how regionally siloed most hacktivist activity tends to be.
Combined Hacktivism Metrics (North + South America):
Notable Collectives by Sub-Region:
The Convergence Problem: As with hacktivist activity documented elsewhere in CRIL's global dataset, several Americas-based channels marketed as ideological collectives function as hybrid operations — logging DDoS attacks and defacement claims alongside stolen-data brokerage and DDoS-for-hire services. Security teams should treat these channels as credible threat intelligence sources rather than dismissing their claims as purely political theater.
If You're in Professional Services:
If You're in Manufacturing or Construction:
If You're in Healthcare:
If You're in BFSI:
If You're in Agriculture & Livestock:
If You're in Government & Law Enforcement (South America specifically):
Based on CRIL's H1 2026 regional data, Americas security leaders should prioritize defensive investment in the following sequence.
Phase 1: Critical Infrastructure Protection (30 days)
Phase 2: Data Protection (60 days)
Phase 3: Operational Resilience (90 days)
Phase 4: Threat Hunting and Detection (Ongoing)
The Americas is not just the largest ransomware theatre in the world by volume — it is two distinct threat environments operating under a single regional label. North America hosts a saturated, competitive RaaS marketplace where no single group dominates outright. South America is consolidating around a smaller set of operators, led decisively by The Gentlemen.
Key Takeaways:
For security leaders across North and South America, the strategic imperative is the same even where the tactical details diverge: know which named actors are active in your specific country and sector, prioritize risk-based patching over blanket cycles, treat data exfiltration as inevitable rather than optional, and build recovery infrastructure that assumes an attack will happen — not one that hopes it won't. The data confirms the Americas will remain the world's most heavily targeted ransomware region through the remainder of 2026. The only open question is how prepared each organization chooses to be.
How many ransomware attacks hit the Americas in H1 2026?
2,188 documented ransomware attacks were observed across North and South America in H1 2026, according to Cyble Research and Intelligence Labs (CRIL) findings.
Which ransomware group is most active in the Americas in H1 2026?
Qilin is the most active group across the combined Americas, with 410 documented attacks (370 in North America, 40 in South America). Within South America specifically, however, The Gentlemen — not Qilin — is the dominant actor.
How many ransomware attacks hit North America in H1 2026?
CRIL recorded 1,981 ransomware attacks in North America during H1 2026, representing roughly 52% of all ransomware activity tracked worldwide.
How many ransomware attacks targeted the US in H1 2026? Is it the highest?
Yes. CRIL observed 1,721 ransomware attacks targeted at the US — which is 78.7% of the American continent (North and South, both), and nearly 45% of every ransomware attack recorded worldwide.
Which sector was the most targeted in South America?
IT & ITES remained the most targeted sector in South America for H1 2026.
Ransomware actors targeted which country the most in South America?
Brazil. With 71 attacks, it was the prime target of ransomware actors in H1 2026.
Is Brazil a significant ransomware target?
Yes. Brazil recorded 71 ransomware attacks — the highest total in South America — and additionally faced an alleged 250 million record breach at credit bureau Serasa, an access sale allegedly targeting the Central Bank of Brazil, and new Android banking trojan families (TCLBANKER, BTMOB RAT) targeting financial and cryptocurrency users.
What is the most targeted industry in the Americas?
Construction tops North America's target list, while IT & ITES, Healthcare, and Professional Services top South America's. Across the whole Americas, Construction and Manufacturing remain consistently high-risk due to their low tolerance for operational downtime.
The post Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors appeared first on Cyble.
Ransomware stopped being an isolated incident type in 2025. It became the dominant force behind the modern breach landscape, and the ransomware data breach statistics from Cyble's own tracking make the shift impossible to ignore. For organizations facing this growing threat, having a ransomware incident response plan in place is becoming just as important as preventing an attack in the first place.
Cyble's Global Cybersecurity Report 2025 documented 5,967 ransomware attacks for the year, a 50% year-over-year jump. Against the 6,046 data breaches and leaks recorded in the same period, ransomware accounted for nearly half — 49.7% — of the combined ransomware-and-breach total tracked by Cyble Research and Intelligence Labs (CRIL). That's the "nearly half" this blog's title refers to, and it isn't a projection. It's what Cyble observed.
The pace hasn't slowed into 2026:
CRIL identified 57 new ransomware groups and 27 new extortion groups in 2025, alongside more than 350 new ransomware strains built largely on the MedusaLocker, Chaos, and Makop families.
This is the mechanics of RaaS: affiliates rent pre-built toolkits, and operational capacity scales faster than any single group's headcount. Between January and April 2025, this dynamic drove an 86% spike in global incidents, with Cl0P alone responsible for 28% of that quarter's activity, per Cyble's Ransomware Threat Landscape report.
Encrypt-and-leak is now standard operating procedure. CRIL's research into extortion technique evolution tracked groups layering in triple extortion (DDoS on top of encryption and data theft) and direct outreach to a victim's clients — a tactic CL0P has used to compound reputational damage beyond the initial breach. For a lean team, this means "we have backups" no longer neutralizes the threat; the data theft component still forces a decision.
Cyble's Europe Q1 2026 findings noted that attackers are deliberately targeting sectors with narrow downtime tolerance — manufacturing and construction firms face contract penalties and supply-chain breakage within days of an outage, which shortens the runway between intrusion and ransom decision. Lean security teams, by definition, have the least slack to absorb that pressure.
The October 2025 surge to 5,194 year-to-date attacks was fueled by a steady supply of critical vulnerabilities and unpatched internet-facing assets, per Cyble's analysis. For small teams, prevention priorities follow directly from that finding:
Zero trust doesn't require a full architecture overhaul on day one. The practical entry points for a lean team:
Given that Qilin and similar groups deploy Linux-based binaries on Windows hosts and harvest credentials via NirSoft and Mimikatz-style toolkits, EDR coverage across every endpoint — not just servers — is the difference between detection in hours versus discovery via a ransom note.
A working ransomware incident response plan and cybersecurity incident response checklist should cover, at minimum:
The ransomware incident response plan and recovery speed depend on preparation done months earlier: validated backup integrity, a pre-mapped list of critical systems in priority order, and a rehearsed communication plan for customers and regulators. Teams that treat recovery as an extension of the incident response plan — rather than an improvised scramble — cut both downtime and the pressure to pay.
Every ransomware statistic in this ransomware incident response plan playbook — the leak-site counts, the group rankings, the extortion techniques, the sector targeting — traces back to one thing: visibility into where attackers operate before they hit a victim's network. That's the gap Cyble Vision is built to close.
Cyble Vision is the threat intelligence platform behind CRIL's own research, continuously monitoring deep, dark, and surface web sources — ransomware leak sites, underground forums, and threat actor chatter — through its Blaze AI engine.
For a lean security team, that means the same early-warning signal CRIL uses to track Qilin, Akira, and every emerging RaaS affiliate becomes available as a live feed for their own organization: exposed credentials, brand mentions on cybercrime forums, ransomware group activity tied to their sector, and third-party breach exposure, all correlated and prioritized automatically instead of requiring a dedicated analyst to piece it together manually.
For a team that can't staff round-the-clock dark web monitoring or manually track which of the dozens of active ransomware groups is circling their industry, this is the difference between finding out from a leak site and finding out weeks earlier.
Lean teams can't out-staff ransomware operators, but they can out-see them. Request a Cyble Vision demo to get the same dark web and ransomware-tracking intelligence CRIL uses to build reports like this one — built for teams that need to know who's targeting them before the leak site does.
A ransomware incident response plan for small security teams isn't about matching enterprise headcount. It's about aligning limited resources against the specific mechanics CRIL has documented: patch the exploited CVEs first, lock down remote-access tools, deploy EDR broadly, and rehearse the incident response plan before the RaaS-fueled affiliate economy finds the gap.
The post Ransomware Now Shows Up in Nearly Half of All Breaches: A Survival Playbook for Lean Security Teams appeared first on Cyble.
Explore how passkey implementation gaps undermine security when relying parties fail to validate the User Verified flag, reducing MFA to a single factor.
The post Pass the Passkey: A Novel Attack Surface in Passwordless Authentication appeared first on Unit 42.
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite some tactic, technique, and procedure (TTP) similarities to the Forest Blizzard DNS hijacking operation that we publicly disclosed in April 2026, we attribute this campaign, which we call CaptiveCrunch, to Storm-2945. As reported by ReliaQuest on July 23, a portion of this activity leverages doppelganger domains mimicking Microsoft online services to conduct follow-on adversary-in-the-middle (AitM) phishing operations that abuse the device code authentication flow in Microsoft Entra ID. Microsoft Threat Intelligence has also identified active traffic manipulation attacks leading to the delivery of malware on impacted systems. Microsoft has observed Storm-2945 leveraging AI to support a significant portion of these operations.
Today, we are sharing our findings on these ongoing intrusions to raise awareness of this threat and enable customers to protect their devices, especially while traveling. We provide our assessment of Storm-2945’s relationship to Midnight Blizzard and analysis of the CaptiveCrunch campaign, detailing the malware and tradecraft used in these operations. We also provide mitigation, detection, and hunting guidance to help organizations identify and defend against Storm-2945 and related activity.
Microsoft Threat Intelligence would like to thank our partners at Anthropic and OpenAI for their collaboration and support during this investigation.
Since February 2026, Storm-2945 has conducted AI-augmented operations including targeted device code and OAuth code phishing campaigns leading to Entra device registration and subsequent data collection from Microsoft 365. Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945 manipulating DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. Although our investigation into the initial compromise vector for the captive portal networks is ongoing, we have observed notable commonalities in the equipment and management systems used across multiple affected networks. These similarities suggest that the activity might not be limited to isolated compromises of individual venues and could reflect access to shared services within portions of the captive portal ecosystem.
As part of the CaptiveCrunch campaign, Storm-2945 has leveraged their AitM position to redirect users through actor-controlled phishing infrastructure and has also delivered malware purporting to be browser or operating system updates in response to automated connectivity checks issued by users’ browsers. Multiple variants have been delivered, including fully-featured Windows remote access trojans (RAT) in compiled Golang, with functionality to conduct system enumeration, collect files and keystrokes, steal credentials and session tokens, conduct audio and video surveillance, monitor for removable media, and provide the threat actor a remote shell on infected systems.
The threat actor infrastructure leverages a variety of ClickFix techniques to elicit the user into downloading and executing the malware:
In addition to variants of malware targeting Windows systems, Microsoft Threat Intelligence is also aware of indications that the threat actor might be targeting Android devices with similar techniques as the ClickFix landings also include instructions for Android devices to download and install an APK file.
To date, Microsoft has identified widespread compromise of Wi-Fi networks at hospitality-related organizations and other networks serviced by captive portal equipment in several countries. ReliaQuest has identified this activity not only at hotels, but also conference centers and other shared venues, and assesses that the goal of this activity is to access the accounts of corporate travelers.
Microsoft Threat Intelligence assesses that Storm-2945 is an operational sub-cluster of Midnight Blizzard based on distinctive technical and operational overlaps. These include technical similarities to Storm-2372, a Midnight Blizzard initial access operations sub-cluster, also notable for their device code and OAuth code phishing operations tracked throughout 2025, Microsoft Graph-based email exfiltration, social engineering delivered via commercial messaging apps, and significant similarities in victimology.
Midnight Blizzard is a Russia-based threat actor attributed by the US and UK governments to the Foreign Intelligence Service of the Russian Federation, also known as the SVR. This threat actor is known to primarily target governments, diplomatic entities, non-governmental organizations (NGOs), and information technology (IT) service providers, primarily in the US and Europe. Midnight Blizzard is consistent and persistent in their operational targeting, and their objectives rarely change. Their focus is to collect intelligence through longstanding and dedicated espionage in support of Russian foreign policy interests.
Midnight Blizzard operations often involve compromise of valid accounts and, in some highly targeted cases, advanced techniques to compromise authentication mechanisms within an organization to expand access and evade detection. They utilize diverse initial access methods, and Midnight Blizzard is also adept at identifying and abusing OAuth applications to move laterally across cloud environments and for post-compromise activity, such as email collection.
CornFlake is a full-featured Windows RAT written in Go that serves as Storm-2945’s primary persistent implant. Microsoft has observed the threat actor rapidly iterating on this malware layer, which features customizable capabilities from the social engineering user interface and data collection capabilities to anti-detection and evasion techniques.
On initial execution, CornFlake operates in dropper mode: it displays a convincing fake progress window designed to occupy the victim’s attention while the binary copies itself to %APPDATA%\svchost32\svchost32.exe and establishes persistence.
Fake window options configurable by the threat actor at build time:
CornFlake registers as a Windows service named svchost32 with the display name “Cloud Sync Service” and description “Synchronizes files with the cloud storage provider”, deliberately mimicking the legitimate svchost.exe process. It establishes redundant persistence mechanisms: Windows service registrations, Registry Run keys, named scheduled tasks, and a persistence watchdog routine that runs continuously to restore any persistence mechanism that is removed by defenders or endpoint protection.
For command and control (C2), CornFlake performs an Elliptic Curve Diffie-Hellman (ECDH) P-256 ephemeral key exchange with the C2 server, derives a session key via SHA-256, and communicates over a custom JSON protocol framed within the encrypted channel. This provides an encrypted channel to the C2 server, with each C2 session using a unique ephemeral key, making decryption of captured traffic impossible without the session-specific private key. The runtime configuration file sync.dat supports hot reconfiguration of C2 servers, watched directories, file targeting patterns, and Transport Layer Security (TLS) settings without requiring redeployment.
Once established on a victim system, CornFlake provides the operator with a comprehensive collection toolkit, gated by configuration flags that allow selective activation post-deployment:
| Capability | Description |
| Keylogging | Raw input API-based keylogger capturing all keystrokes, including password fields |
| Clipboard monitoring | Captures clipboard changes with SHA-256 deduplication and records the active window title at time of capture |
| Screenshot capture | Idle-triggered and on-demand screenshots with configurable idle threshold |
| Audio surveillance | Windows Audio Session API (WASAPI)-based microphone capture, encoded as WAV files |
| Video surveillance | Media Foundation-based webcam capture, encoded as JPEG |
| Browser credential theft | ChromeKatz-derived module supporting live cookie extraction from process memory (Chromium browsers) and stored password extraction from on-disk databases, including Chrome App-Bound Encryption (ABE) bypass and Firefox NSS/SDR decryption |
| File exfiltration | Targets files based on file extensions with real-time file system monitoring and an upload throttle (1,000 files or 500 MB per cycle). File extensions are categorized as Documents, Archives, Images, Code, Data, Emails, and Keys |
| USB drive monitoring | Detects and scans removable media when inserted |
| Security posture sweep | Collects 18 categories of host intelligence including installed software, antivirus (AV)/endpoint detection and response (EDR) products, Defender exclusions, User Account Control (UAC) level, Remote Desktop Protocol (RDP) history, Office most recently used (MRU) files, and credential hints |
| Remote shell | Arbitrary command execution via cmd.exe or PowerShell (with -NoP flag to suppress profile-based detection) |
CornFlake also exposes a localhost HTTP API server (/upload, /reload, /status) that transforms the RAT into a modular platform: companion or next-stage payloads such as ChocoShell could task file exfiltration, trigger configuration hot reloads or check C2 connectivity using the pre-established secure C2 channel for communication.
ChocoShell is the campaign’s Powershell-based infostealer, delivered and executed entirely in-memory. Its primary objective is the high-volume theft of browser session cookies, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems. Where CornFlake provides the operator with a persistent, long-running foothold on the device, ChocoShell is designed to extract the most operationally valuable credentials, giving the operator access to victim cloud environments.
The ChocoShell script was authored with full developer comments that reveal the operator’s intent behind each code decision, including explicit references to Microsoft detection signatures and the reasoning behind specific evasion choices. The consistent coding standard and descriptive commentary suggest the author might have leveraged AI-assisted code generation.
Defense evasion. Upon execution, ChocoShell beacons to a hardcoded C2 server at 213.145.86[.]112 and implements several evasion techniques in sequence. It disables the Antimalware Scan Interface (AMSI) via .NET reflection to prevent ScriptBlock scanning and evades Microsoft behavioral detection that triggers on suspicious PowerShell web request cmdlets. A timing-based sandbox detection check is also employed as a virtual machine (VM) detection mechanism, silently exiting without performing any collection if detected.
C2 communication. ChocoShell communicates with its C2 server using HTTPS with URI paths designed to blend in with legitimate web traffic. Beacons use /t/pixel.gif?m=<status>, mimicking an image tracking pixel. Additional tooling is fetched from /cdn/chunks/polyfill-7e2b.min.js, disguised as a JavaScript polyfill file. This downloaded module is Base64-decoded and executed in memory via [ScriptBlock]::Create(), providing browser encryption key extraction capabilities, SYSTEM token impersonation, and Defender signature locking. Exfiltrated data is sent by POST to /t/event as GZip-compressed, Base64-wrapped JSON.
Privilege escalation. ChocoShell requires administrative privileges for its most impactful capabilities: SYSTEM token impersonation for Chrome ABE decryption, Volume Shadow Copy Service (VSS) shadow copy creation, Defender signature locking. It implements three silent UAC bypass techniques with ordered fallback:
If none of the silent bypasses succeed (for example, the user is not a local administrator), ChocoShell falls back to a visible UAC prompt via Start-Process -Verb RunAs. Notably, the script also contains a variant designed to execute within the WinGet Desired State Configuration (DSC) host process (ConfigurationRemotingServer), suggesting an attack vector through malicious WinGet DSC configuration used in Windows machine provisioning.
Credential and session theft. Once running with elevated permissions, ChocoShell locks Defender signature updates and systematically harvests data from multiple sources. For Chromium-based browsers (Chrome, Edge, Brave, Opera, Opera GX, Vivaldi), it extracts the master encryption key from the browser’s Local State file, handling both the modern ABE scheme (Chrome v127+) and the legacy data protection API (DPAPI)-only scheme. ABE decryption requires SYSTEM-level DPAPI access, which the malware obtains by impersonating a SYSTEM process token borrowed from winlogon.exe, wininit.exe, or services.exe. Locked browser SQLite databases are accessed through three strategies: shared file access, Volume Shadow Service snapshots, and direct copy as a fallback.
As a parallel collection path, ChocoShell launches Chrome, Edge, and Brave with the –remote-debugging-port flag and issues Network.getAllCookies through the Chrome DevTools Protocol (CDP). This completely bypasses ABE, enabling the browser to perform its own internal decryption and returns plaintext cookie values. To handle privilege issues (SYSTEM-launched browsers inherit the wrong token), the malware creates transient scheduled tasks with TASK_LOGON_INTERACTIVE_TOKEN to launch the browser under the signed-in user’s session. After extraction, the browser is stopped and relaunched with –restore-last-session to avoid alerting the user.
For Firefox family browsers (Firefox, Waterfox, LibreWolf, Floorp, Zen), the malware copies unencrypted cookies.sqlite databases from each profile. Additionally, ChocoShell collects Microsoft 365 and Azure Active Directory (AD) access tokens, refresh tokens, and Web Account Manager (WAM) tokens from .tbres files in the Token Broker cache. Collection of these tokens represents a significant threat to enterprise environments, as threat actors could replay SSO sessions without browser cookies. Additionally, Wi-Fi credentials are harvested via netsh wlan show profile with key=clear.
Exfiltration and cleanup. All collected data is aggregated into a JSON structure, GZip-compressed, Base64-encoded, and sent by POST to the C2’s /t/event endpoint. After exfiltration, all collected data variables are nulled, garbage collection is forced, VSS shadow copies are deleted via Windows Management Instrumentation (WMI), temporary elevation scripts are removed, and all UAC bypass registry keys (already cleaned during escalation) are verified removed.
FruitStone is the web-based C2 panel that Storm-2945 operators use to manage the entire CaptiveCrunch campaign infrastructure. Implemented as a single-page application (HTML and JavaScript) serving as the front-end of the C2 server with all functionality exposed without authentication, FruitStone provides a centralized dashboard for managing compromised endpoints, building and deploying new campaign payloads, and reviewing all collected data (such as screenshots, keystrokes, browser credentials).
Operational cover. The panel is branded as “CloudSync Console” with a footer reading “Acuity Systems, Inc. — Cloud Infrastructure Portal v3.2.1,” designed to appear as legitimate enterprise cloud management software if the panel URL is discovered by defenders or hosting providers. This masquerading extends to the CornFlake agent’s service name (Cloud Sync Service) and description (“Synchronizes files with the cloud storage provider”), creating a consistent cover story across the toolchain.
Session management and multi-operator support. FruitStone uses JSON Web Token (JWT)-based authentication, session revocation, and rate limiting with IP blocking to prevent brute force attacks against the panel sign in. Multiple operators could be provisioned with individual accounts, and all active sessions are visible with IP address, user-agent, and creation time to enable operational security awareness across the operators.
Agent management. The panel displays all registered CornFlake agents in a dashboard with real-time status updates via Server-Sent Events (SSE). Each agent card shows comprehensive system information including hostname, username, OS version, CPU, RAM, disk usage, screen resolution, timezone, domain membership, and camera/microphone presence, all collected during the CornFlake posture sweep. Agents are grouped by country and subnet, with geographic distribution visualized on a map.
Operators could interact with individual agents through:
Campaign builder. A step-by-step wizard enables operators to configure and build new CornFlake payloads directly from the panel:
Infrastructure management. FruitStone provides management interfaces for three layers of supporting infrastructure:
Since July 16, Microsoft has observed a portion of CaptiveCrunch landing pages redirecting users to device code authentication flow experiences. In these cases, users served these landings might be instructed to enter a device code into a legitimate Microsoft sign-in page, a technique commonly referred to as device code phishing.
Device code authentication is a legitimate OAuth workflow designed for devices that cannot support a traditional sign-in experience. However, threat actors could abuse this flow by initiating an authentication request on behalf of a user then convincing the user to enter an actor-controlled device code into a legitimate Microsoft authentication page. When successful, the victim authenticates the threat actor’s session rather than their own.
This activity is consistent with previously reported device code phishing operations conducted by Midnight Blizzard since August 2024. The observed technique does not appear fundamentally novel; however, integrating device code phishing into captive portal and traffic manipulation operations might increase the likelihood that users perceive the authentication request as legitimate. For additional details on Midnight Blizzard-related device code phishing techniques, see: Storm-2372 conducts device code phishing campaign. To understand other threat actors’ use of device code phishing and associated mitigations, see Inside an AI‑enabled device code phishing campaign.
When traveling, users should treat hotel, conference, airport, and other guest wireless networks as untrustworthy.
Organizations should assume that public and hospitality network infrastructure might not be trustworthy and should adopt controls that limit exposure to traffic manipulation, credential theft, and device code phishing.
Organizations should review what information employees provide to hospitality providers when connecting to guest networks.
Microsoft Defender customers can refer to the list of applicable detections below. Microsoft Defender coordinates detection, prevention, investigation, and response across endpoints, identities, email, apps to provide integrated protection against attacks like the threat discussed in this blog.
Microsoft Defender for Endpoint detects Storm-2945 activity under the detection Suspicious activity linked to a Russian state-sponsored threat actor has been detected. However, these alerts might be triggered by unrelated threat actor activity. The following chart lists Microsoft Defender detections specific to the TTPs utilized by Storm-2945 in this attack.
| Tactic | Observed activity | Microsoft Defender coverage |
| Initial access | File download via captive portal redirection | Microsoft Defender for Endpoint – Suspicious downloaded file |
| Initial access | ClickFix technique, fake browser or OS update, initial file download | Microsoft Defender for Endpoint – Possible initial access from an emerging threat – Possible ClickFix activity |
| Persistence | CornFlake registers a Windows service, a Registry Run key, a scheduled task | Microsoft Defender for Endpoint – Suspicious Scheduled Task Process Launched – Suspicious scheduled task – Suspicious file added to run key – Suspicious service registration Microsoft Entra ID Protection – Microsoft Entra threat intelligence – Verified threat actor IP |
| Stealth/Defense evasion | ChocoShell disables AMSI | Microsoft Defender for Endpoint – Possible Antimalware Scan Interface (AMSI) tampering |
| Credential access | ChocoShell’s theft of browser session cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials. Device code abuse. | Microsoft Defender for Endpoint – Possible theft of passwords and other sensitive web browser information – Suspicious DPAPI activity Microsoft Defender For Identity – Anomalous OAuth device code authentication activity Microsoft Defender XDR – User account compromise via OAuth device code phishing – Malicious sign in from an IP address associated with recognized attacker infrastructure – Suspicious Azure authentication through possible device code phishing |
| Collection | CornFlake monitoring and logging | Microsoft Defender for Endpoint – Activity that might lead to information stealer |
| Privilege escalation | ChocoShell UAC bypass techniques | Microsoft Defender for Endpoint – UAC bypass was detected – Possible Component Object Model (COM) hijacking |
Microsoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, and generate device summaries, hunting queries, and incident reports.
Customers can also deploy AI agents, including the following Microsoft Security Copilot agents, to perform security tasks efficiently:
Security Copilot is also available as a standalone experience where customers can perform specific security-related tasks, such as incident investigation, user analysis, and vulnerability impact assessment. In addition, Security Copilot offers developer scenarios that allow customers to build, test, publish, and integrate AI agents and plugins to meet unique security needs.
Microsoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide the intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.
Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat actor.
Microsoft Defender XDR customers can run the following advanced hunting queries to find related activity in their networks:
Detect file creation after Wi-Fi connectivity test on devices
The following query checks for a file creation on a device within two minutes of the device performing built‑in Network Connectivity Status Indicator (NCSI) test, which occurs when network connectivity is established to a Wi-Fi network with a captive portal. This activity might indicate an attacker’s initial access file presence on a device.
Please note that not all files discovered through this query might be malicious or related to this threat activity.
Entrar
let ncsi_endpoints = dynamic(["msftconnecttest.com","edge-http.microsoft.com","msftncsi.com","captive.apple.com","clients1.google.com",
"clients3.google.com","clients4.google.com","clients6.google.com","connectivitycheck.gstatic.com","connectivitycheck.android.com",
"android.clients.google.com","www.gstatic.com","detectportal.firefox.com","detectportal.brave-http-only.com","cloudflareportal.com",
"cloudflarecp.com","cloudflareok.com","connectivity-check.warp-svc","connectivity.cloudflareclient.com","spectrum.s3.amazonaws.com",
"nmcheck.gnome.org"]);
let NCSIEvents = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (ncsi_endpoints)
| project NCSI_Timestamp = Timestamp, DeviceId, DeviceName, RemoteUrl, NCSI_ReportId = ReportId, NCSI_InitiatingProcessFileName = InitiatingProcessFileName, NCSI_InitiatingProcessCommandLine = InitiatingProcessCommandLine, NCSI_AccountName = InitiatingProcessAccountName;
let FileDownloadEvents = DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FileName has_any (".exe",".msi",".zip",".rar",".7z")
| project Download_Timestamp = Timestamp, DeviceId, FileName, FolderPath, Download_ReportId = ReportId, Download_InitiatingProcessFileName = InitiatingProcessFileName, Download_InitiatingProcessCommandLine = InitiatingProcessCommandLine, Download_AccountName = InitiatingProcessAccountName;
NCSIEvents
| join kind=inner (
FileDownloadEvents
) on DeviceId
| where Download_Timestamp >= NCSI_Timestamp and Download_Timestamp <= NCSI_Timestamp + 2m
| project
NCSI_Timestamp,
Download_Timestamp,
DeviceName,
DeviceId,
RemoteUrl,
FileName,
FolderPath,
InitiatingProcessFileName = Download_InitiatingProcessFileName,
InitiatingProcessCommandLine = Download_InitiatingProcessCommandLine,
AccountName = Download_AccountName,
NCSI_ReportId,
Download_ReportId
Detect connectivity to Storm-2945 infrastructure
The following query checks for connectivity to Storm-2945 infrastructure observed in this attack activity.
let target_domains = dynamic(["ms365-device.com", "ms365-live.com", "m365-owa.com", "owa-ms365.com"]);
let target_ips = dynamic(["31.57.243.154", "38.146.28.75", "38.146.28.132", "104.194.159.150", "107.189.26.194", "213.145.86.112"]);
DeviceNetworkEvents
| where RemoteUrl has_any(target_domains) or RemoteIP in (target_ips)
| project
Timestamp,
DeviceName,
DeviceId,
RemoteUrl,
RemoteIP,
LocalIP,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
AccountName = InitiatingProcessAccountName,
ReportId
Detect CornFlake RAT presence on affected systems
The following query checks for the presence of the CornFlake RAT binary.
DeviceProcessEvents | where FolderPath == "%APPDATA%\\svchost32\\svchost32.exe" or FolderPath endswith @"\svchost32\svchost32.exe" | project Timestamp, DeviceName, DeviceId, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ReportId
Detect CornFlake RAT Windows service registration
The following query checks for the CornFlake RAT Windows service registration.
DeviceRegistryEvents
| where RegistryKey has @"\SYSTEM\CurrentControlSet\Services\svchost32"
| where ActionType == "RegistryValueSet"
| where (RegistryValueName == "DisplayName" and RegistryValueData == "Cloud Sync Service")
or (RegistryValueName == "Description" and RegistryValueData == "Synchronizes files with the cloud storage provider")
| project
Timestamp,
DeviceName,
DeviceId,
RegistryKey,
RegistryValueName,
RegistryValueData,
ActionType,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
InitiatingProcessAccountName,
ReportId
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.
Detect network IP and domain indicators of compromise using ASIM
The following query checks IP addresses and domain IOCs across data sources supported by ASIM network session parser:
//IP list and domain list- _Im_NetworkSession let lookback = 30d; let ioc_ip_addr = dynamic(["213.145.86.112"]); let ioc_domains = dynamic(["213.145.86.112/t/pixel.gif", "213.145.86.112/cdn/chunks/polyfill-7e2b.min.js", "213.145.86.112/t/event"]); _Im_NetworkSession(starttime=todatetime(ago(lookback)), endtime=now()) | where DstIpAddr in (ioc_ip_addr) or DstDomain has_any (ioc_domains) | summarize imNWS_mintime=min(TimeGenerated), imNWS_maxtime=max(TimeGenerated), EventCount=count() by SrcIpAddr, DstIpAddr, DstDomain, Dvc, EventProduct, EventVendor
Detect web sessions IP and file hash indicators of compromise using ASIM
The following query checks IP addresses, domains, and file hash IOCs across data sources supported by ASIM web session parser:
//IP list - _Im_WebSession let lookback = 30d; let ioc_ip_addr = dynamic(["213.145.86.112"]); let ioc_sha_hashes =dynamic([“918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593”, “be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c”]); _Im_WebSession(starttime=todatetime(ago(lookback)), endtime=now()) | where DstIpAddr in (ioc_ip_addr) or FileSHA256 in (ioc_sha_hashes) | summarize imWS_mintime=min(TimeGenerated), imWS_maxtime=max(TimeGenerated), EventCount=count() by SrcIpAddr, DstIpAddr, Url, Dvc, EventProduct, EventVendor
Detect domain and URL indicators of compromise using ASIM
The following query checks domain and URL IOCs across data sources supported by ASIM web session parser:
// file hash list - imFileEvent // Domain list - _Im_WebSession let ioc_domains = dynamic(["https://213.145.86.112/t/pixel.gif", "https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js", "https://213.145.86.112/t/event"]); _Im_WebSession (url_has_any = ioc_domains)
ChocoShell C2 communications
The following query detects ChocoShell communications with its C2 server using HTTPS with URI paths designed to blend in with legitimate web traffic. Beacons use /t/pixel.gif?m=<status>, mimicking an image tracking pixel.
let lookback = 30d; let ioc_url_artifacts = dynamic(["/t/pixel.gif?m="]); _Im_WebSession(starttime=todatetime(ago(lookback)), endtime=now()) | where DstDomain in (ioc_url_artifacts) | summarize imWS_mintime=min(TimeGenerated), imWS_maxtime=max(TimeGenerated), EventCount=count() by SrcIpAddr, DstIpAddr, Url, Dvc, EventProduct, EventVendor
| Indicator | Type | Description | First seen |
| ms365-device[.]com | Domain | CaptiveCrunch DCF redirect | 2026-07-23 |
| ms365-live[.]com | Domain | CaptiveCrunch DCF redirect | 2026-05-14 |
| m365-owa[.]com | Domain | CaptiveCrunch AitM infrastructure | 2026-07-20 |
| owa-ms365[.]com | Domain | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 31.57.243[.]154 | IP address | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 38.146.28[.]75 | IP address | CaptiveCrunch AitM infrastructure | 2026-07-01 |
| 38.146.28[.]132 | IP address | CaptiveCrunch DNS Resolver | 2026-07-15 |
| 104.194.159[.]150 | IP address | CaptiveCrunch AitM infrastructure | 2026-04-28 |
| 107.189.26[.]194 | IP address | ChocoShell C2 / CaptiveCrunch DNS Resolver | 2026-02-27 |
| 213.145.86[.]112 | IP address | ChocoShell C2 | 2026-07-01 |
| 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 | File hash | CornFlake | 2026-07-03 |
| be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | File hash | ChocoShell | 2026-07-10 |
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.
To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft appeared first on Microsoft Security Blog.
You may have heard your peers say, “Cybercrime has become industrialized.” But did you have any proof?
We do.
Cyble Research and Intelligence Labs (CRIL) closed out its tracking for the first half of 2026 with a deep analysis of the Global Threat Landscape spanning ransomware, initial access brokers, data breaches and leaks, nation-state espionage, and hacktivism, among others.
One of the most striking analyses that puts the threat landscape severity in perspective was the number of distinct threat actor profiles active worldwide between January and June. 261 — that’s how many identifiable groups and individuals, each with its own tradecraft, targeting logic, and operational rhythm, running campaigns simultaneously across nation-state espionage, ransomware, hacktivism, and cybercrime.
What makes this data set valuable isn't just the headline count. It's what the composition reveals. A threat landscape dominated by nation-state APT groups tells a very different story than one dominated by ransomware crews — and as Cyble's regional breakdown shows, that composition shifts dramatically depending on where you're standing.
Across all 261 profiles tracked globally, nation-state Advanced Persistent Threat (APT) groups were the single largest category — accounting for 118 profiles, or just over 45% of the total. Ransomware operators came second at 75 profiles (29%), followed by hacktivist collectives (34), cybercriminal groups (31), and dedicated extortion-only gangs, which remained a niche category at just 3.
| Threat Actor Category | Profiles Tracked | Share of Total |
| Nation-State APT Groups | 118 | 45.2% |
| Ransomware Groups | 75 | 28.7% |
| Hacktivist Collectives | 34 | 13.0% |
| Cybercriminal Groups | 31 | 11.9% |
| Extortion-Only Groups | 3 | 1.1% |
| Total | 261 | 100% |
That APT dominance reflects the sheer number of state-sponsored programs China, North Korea, Iran, and Russia field simultaneously across espionage, intellectual property theft, and pre-positioning operations.
The extortion-only category being almost statistically irrelevant is telling too — it confirms that pure extortion has essentially been absorbed into the ransomware business model rather than surviving as an independent specialty. Double extortion is now just how ransomware works.
CRIL flagged five groups worldwide as carrying the highest confidence and activity levels for security teams to track through the rest of 2026:
| Actor | Origin | Primary Targets | Sectors Targeted |
| Bluenoroff | North Korea (Lazarus subgroup) | Global — cryptocurrency sector | Cryptocurrency, Financial Services |
| UNC6508 | China (PRC-nexus espionage) | US, Canada | Education, Healthcare, Government, Aerospace & Defense |
| Volt Typhoon | China (state-sponsored) | US (incl. Guam) and allies | Communications, Energy, Manufacturing, Government, IT |
| Desert Falcons | Palestine | UAE, Israel, Jordan, and 12+ other MEA nations | Aerospace & Defense, Government, Law Enforcement, Media |
| SideCopy | Pakistan | India, Afghanistan | Government, Defense/military |
Two of these deserve particular attention for how they operate.
Bluenoroff, a financially motivated Lazarus Group subgroup, funds North Korean state operations by impersonating established crypto investors and planting malicious links inside victims' Calendly scheduling accounts. This fraud vector blends social engineering with a tool most professionals trust implicitly.
Volt Typhoon continues to favor "living off the land" techniques that blend into normal network activity, prioritizing long-term undetected access over rapid data theft — a profile consistent with pre-positioning for a future disruption event rather than opportunistic espionage.
UNC6508 is worth flagging separately: the group compromises externally accessible REDCap research environments and has been observed creating malicious mail-forwarding rules to silently exfiltrate correspondence — all routed through US-based residential proxies and compromised routers specifically to obscure attribution.
The threat actor profiles, targeting patterns, and regional breakdowns in this analysis are drawn from Cyble's H1 2026 Global Threat Landscape Report, built on continuous monitoring across dark web forums, ransomware leak sites, and threat actor communications worldwide.
Cyble Vision provides ongoing tracking of these groups — including new actor emergence, TTP shifts, and targeting changes — as they develop.
Request a demo to see how continuous threat actor intelligence can sharpen your regional security priorities.
The post APTs Top the List of Most Active Threat Actors in H1 2026 appeared first on Cyble.
The conversation around ANZ ransomware threats has shifted noticeably over the past year. What once looked like sporadic, high-profile incidents has evolved into a sustained and structured campaign against organizations across Australia and New Zealand. Signals emerging from underground forums and marketplaces reveal a sobering reality: ransomware is no longer just a technical problem; it is an economic strategy driven by efficiency, specialization, and scale.
At the center of this shift is ransomware dark web intelligence, which paints a clear picture of attacker intent. Threat actors are not simply increasing volume; they are refining their focus. The ANZ region, with its high-value economy and deeply digitized infrastructure, has become a preferred hunting ground.
Australia’s economic profile plays directly into the hands of ransomware operators. A strong GDP, combined with a relatively small population, creates a high-return environment. Attackers don’t need to cast a wide net; each successful breach can yield significant payouts.
By mid-2025, 71 ransomware incidents had been publicly claimed in Australia, compared to nine in New Zealand. On the surface, those figures may seem moderate. However, when adjusted for population, the rate of ransomware attacks in Australia and New Zealand stands out globally. Even larger economies have not experienced the same intensity relative to their size.
This imbalance reflects a fundamental principle driving ANZ organizations cybersecurity risks: attackers prioritize value over volume. In practical terms, fewer victims can still mean higher profits.
Unlike regions where one ransomware group dominates headlines, the dark web ANZ cyber threats ecosystem is notably fragmented. Multiple groups, including Qilin, Akira, INC, Lynx, and Dragonforce, operate concurrently, each claiming a similar share of attacks.
This decentralization complicates defense strategies. Organizations are not facing a predictable adversary with a consistent playbook. Instead, they must prepare for a rotating cast of threat actors, each bringing different techniques, timelines, and negotiation tactics.
From a ransomware dark web intelligence perspective, this fragmentation signals a competitive market. Threat actors are actively testing sectors, probing defenses, and adapting quickly based on what works.
The distribution of ANZ ransomware threats is far from uniform. Certain sectors continue to absorb the majority of attacks due to the nature of their operations.
Healthcare and professional services sit at the top of the list. In healthcare, the urgency of patient care creates a near-zero tolerance for downtime, increasing the likelihood of ransom payments. Professional services firms, on the other hand, hold large volumes of sensitive client data, making them lucrative targets.
However, the scope is broader than these two sectors alone. Aviation software providers, pharmaceutical companies, engineering firms, and even steel manufacturers have all been affected. This pattern reinforces a key insight: ransomware attacks in Australia and New Zealand are opportunistic but calculated, targeting environments where disruption carries tangible consequences.
Several incidents in 2025 highlight how attackers are evolving their methods.
The Akira group compromised an Australian industrial technology provider, exfiltrating approximately 10GB of sensitive data, including financial records and employee identification documents. This case highlights the growing overlap between ransomware and critical infrastructure risk.
In another breach, a political organization suffered exposure to communications, identity records, and financial data, highlighting that ANZ organizations' cybersecurity risks extend beyond the private sector.
Meanwhile, Dragonforce leaked over 100GB of data from an engineering firm, including technical drawings and internal reports. The long-term implications of such intellectual property theft often exceed immediate financial damage.
These cases share a common thread: encryption is no longer the sole objective. Data exfiltration and double extortion have become standard practices.
One of the most important developments in shaping dark web ANZ cyber threats is the growth of the initial access market. In 2025 alone, 92 instances of compromised access sales were observed across Australia and New Zealand.
Retail organizations accounted for roughly 34% of these cases, followed by BFSI and professional services. The implications are significant. Attackers no longer need to breach networks themselves; they can simply purchase access.
This shift has redefined how ANZ ransomware threats materialize. The most complex phase of an attack—initial intrusion—is now outsourced, accelerating timelines and increasing overall attack volume.
It also introduces indirect risk. Organizations may be compromised through vendors, partners, or shared platforms, expanding the attack surface beyond traditional boundaries.
The emergence of affiliate-driven models, particularly groups like INC Ransom, has further amplified ransomware attacks in Australia and New Zealand. Operating under a Ransomware-as-a-Service structure, these groups separate responsibilities: affiliates handle intrusions, while core operators manage ransom negotiations.
This model enables rapid scaling. Multiple attacks can be executed simultaneously, each leveraging shared infrastructure and tooling.
INC Ransom’s activity across healthcare and professional services highlights how effective this approach has become. Their operations often involve credential compromise, privilege escalation, lateral movement, and eventual deployment of ransomware—frequently paired with data exfiltration.
From a ransomware dark web intelligence standpoint, this reflects a mature ecosystem where roles are specialized, and efficiency is maximized.
Although Australia is the primary target, the broader region is not immune. A ransomware attack on Tonga’s Ministry of Health disrupted national healthcare services, while a major breach in New Zealand’s healthcare sector involved both data theft and system encryption.
These incidents reinforce the interconnected nature of ANZ organizations' cybersecurity risks. Threat actors operate without regard for national boundaries, shifting focus wherever defenses appear weakest.
Despite the evolving ecosystem, many attack methods remain consistent. Spear-phishing campaigns, exploitation of unpatched systems, and the use of stolen credentials continue to dominate.
Once inside, attackers often rely on legitimate tools—file compression utilities, remote management software, and standard data transfer mechanisms—to blend into normal operations. This “living off the land” approach makes detection significantly more difficult.
The steady rise of ANZ ransomware threats signals a need for strategic change. Perimeter-based defenses are no longer sufficient in an environment where access can be purchased, and attacks can be outsourced.
As access is bought and attacks are outsourced, organizations must shift toward stronger identity controls, continuous monitoring, rapid patching, and tighter third-party risk management.
Cybersecurity is no longer just about prevention—it’s about resilience. Attacks are inevitable, but their impact doesn’t have to be. Cyble helps organizations stay ahead with AI-powered threat intelligence, dark web monitoring, and predictive defense through its AI-native platform, Cyble Blaze.
Stay ahead of ransomware threats—book a free demo and build a more resilient security posture.
The post ANZ Organizations Are in the Ransomware Crosshairs— What the Dark Web Is Telling Us appeared first on Cyble.
The modern enterprise attack surface is no longer confined to corporate networks and endpoints; it now stretches across cloud workloads, supply chains, remote devices, and even operational technology environments.
Within this fragmented landscape, the activities of the APT41 threat group stand out as a signal of how hackers and adversaries are adapting. Known for blending state-sponsored espionage with financially motivated operations, APT41 represents a dual-purpose threat model that security teams can no longer afford to treat as an edge case.
Unlike many threat actors that operate with a singular objective, China APT41 cyber-attacks are notable for their breadth of intent. Active since 2012, the group has consistently targeted industries ranging from healthcare and telecommunications to gaming, logistics, and finance. This diversity is not accidental; it reflects a deliberate strategy to exploit both high-value intelligence targets and monetization opportunities.
Operating under aliases such as Wicked Panda, Brass Typhoon, and BARIUM, the APT41 threat group has demonstrated a level of operational maturity that blends long-term persistence with opportunistic intrusion.
Their campaigns often involve supply chain compromises, credential harvesting, and stealthy lateral movement, techniques that align closely with the realities of today’s sprawling enterprise environments.
One of the more telling examples of this evolution is the maritime industry. Responsible for roughly 90% of global trade, it has become a focal point for cyber operations. Recent threat intelligence findings have documented over a hundred cyber incidents targeting shipping and logistics organizations, with multiple advanced persistent threat groups involved.
Within this context, China APT41 cyber attacks have impacted shipping entities across Europe and Asia, including targets in the UK, Italy, Spain, Turkey, Taiwan, and Thailand. What makes these attacks particularly concerning is not just their frequency, but their depth.
Malware frameworks such as DUSTTRAP have been deployed to evade forensic analysis, while tools like ShadowPad and VELVETSHELL enable persistent access and data exfiltration. The maritime sector also highlights a new issue in enterprise attack surface security: the convergence of IT and operational technology. Cargo systems, navigation tools, and logistics platforms are interconnected, creating new entry points that traditional security models often overlook.
The operational toolkit associated with APT41 is extensive, spanning more than 90 identified malware families and utilities. These range from widely available tools like Cobalt Strike and Mimikatz to custom-built backdoors, loaders, and rootkits. This combination allows the group to remain flexible, often blending into legitimate administrative activity while maintaining persistence within compromised networks.
Credential theft tools such as Impacket and pwdump are frequently used to escalate privileges, while reconnaissance frameworks like PowerSploit and PlugX help map internal environments. In parallel, custom implants like KEYPLUG and MoonBounce demonstrate a high degree of technical sophistication, particularly in evading detection.
The global footprint of the APT41 threat group has not gone unnoticed. In 2019 and 2020, U.S. authorities unsealed indictments against several individuals allegedly linked to the group, including Zhang Haoran, Tan Dailin, Qian Chuan, Fu Qiang, and Jiang Lizhi. The charges ranged from unauthorized access and identity theft to money laundering and racketeering.
These cases revealed the scale of APT41’s operations, including attacks on hundreds of organizations worldwide. Victims spanned continents and sectors, with telecommunications providers, social media platforms, and government entities among those impacted. Notably, the group has also been linked to ransomware deployment, further blurring the line between espionage and cybercrime.
The APT41 threat group stands out for its adaptability, shifting between espionage and financially driven operations while exploiting gaps across the modern enterprise. Defending against APT41 and broader China APT41 cyber attacks requires more than point solutions; it demands strong enterprise attack surface security and continuous attack surface management to understand and reduce exposure across interconnected systems.
Platforms like Cyble help organizations stay ahead with real-time threat intelligence and AI-driven security. Explore Cyble or schedule a demo to strengthen defenses against evolving threats like APT41.
The post China’s APT41 and the Expanding Enterprise Attack Surface: What Security Teams Must Prepare For appeared first on Cyble.
The India cyber threat landscape 2026 is no longer defined by isolated incidents or opportunistic attacks. It has become a dynamic, constantly shifting battleground shaped by geopolitical tensions, rapid digitization, and highly advanced hackers. What once looked like sporadic cybercrime has matured into a layered ecosystem of state-sponsored cyber attacks, organized ransomware groups, and a growing wave of Hacktivism in India.
Recent threat intelligence observations reveal a new pattern: attackers are not only becoming more capable, but also more strategic. They are targeting supply chains, exploiting systemic weaknesses, and adapting their methods faster than most organizations can respond. As a result, understanding India cybersecurity trends in 2026 requires looking beyond raw numbers and examining how intent, capability, and opportunity are converging.
India’s exposure to cyber risk has expanded dramatically. In the first half of 2024 alone, the country experienced 593 cyberattacks, including 388 data breaches, 107 data leaks, and 39 ransomware incidents. These figures highlight not just frequency, but diversity in attack types.
By October 2025, the threat environment had intensified further. Cybersecurity teams faced a sharp escalation marked by:
One of the most defining aspects of the Indian cyber threat landscape in 2026 is the growing footprint of state-backed threat actors. These groups operate with long-term objectives, often aligned with geopolitical interests rather than immediate financial gain.
Unlike conventional cybercriminals, state-sponsored cyber attacks in India tend to:
What makes these actors particularly dangerous is their patience. They are not looking for quick wins; they are embedding themselves within systems, studying operational patterns, and waiting for the right moment to act. This shift has forced Indian organizations to rethink cybersecurity not just as an IT concern, but as a matter of national and economic security.
Parallel to state-backed threats, Hacktivism in India has gained noticeable momentum. Unlike financially motivated attackers, hacktivist groups are driven by political, ideological, or social causes.
In recent years, these actors have:
What’s changing in 2026 is the level of coordination and technical maturity. Hacktivist groups are no longer limited to basic disruptions; they are leveraging tools and tactics once associated with more advanced threat actors. This convergence is blurring the lines between activism and cyber warfare.
A notable trend shaping India's cybersecurity trends in 2026 is the rise of supply chain attacks. Instead of targeting a single organization directly, attackers compromise with a trusted vendor or service provider to gain access to multiple downstream systems.
This approach has proven particularly effective in sectors undergoing rapid digital transformation, such as healthcare. India’s healthcare industry, for instance, has embraced digitization at scale, improving efficiency and accessibility. However, this expanded digital footprint has also introduced new vulnerabilities.
Threat actors targeting this sector are:
In response to the growing complexity of cyber attacks in India 2026, organizations are turning to threat intelligence as a core defense mechanism. This goes beyond basic monitoring and involves a multi-layered approach:
Looking forward, the India cyber threat landscape 2026 will likely be shaped by three key forces:
The India cyber threat landscape 2026 has made cybersecurity a strategic priority, not just an IT function. With rising state sponsored cyber attacks India and coordinated Hacktivism in India, organizations must shift to intelligence-driven, proactive defense to keep up with cyber attacks in India 2026.
Cyble addresses this need with AI-native threat intelligence and real-time response capabilities that help teams stay ahead of evolving risks. To see how this approach works in practice, book a Personalized Demo today!
The post India’s Evolving Cyber Threat Landscape: State-Sponsored Attacks, Hacktivism, and What’s Next in 2026 appeared first on Cyble.
