# SantaAd

> As of 2026-10-06, SantaAd is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ransomware, threat intel. Also known as Lynx, Payload ransomware affiliates. ATT&CK coverage spans 35 techniques across 12 tactics in 2 of 2 tracked threats. Most-observed techniques: T1040 (Network Sniffing), T1078 (Valid Accounts), T1110.004 (Brute Force: Credential Stuffing).

- **Tracked threats:** 2
- **Categories:** RANSOMWARE, THREAT_INTEL
- **Also known as:** Lynx, Payload ransomware affiliates
- **As of:** 2026-10-06

## ATT&CK techniques observed

35 techniques observed across 2 of 2 tracked threats. Tactics: Credential Access (6), Lateral Movement (5), Reconnaissance (5), Collection (3), Discovery (3), Initial Access (3).

- [T1040](https://intel.threadlinqs.com/technique/T1040) Network Sniffing — Credential Access — observed in 2 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [T1110.004](https://intel.threadlinqs.com/technique/T1110.004) Brute Force: Credential Stuffing — Credential Access — observed in 2 of 2 tracked threats
- [T1133](https://intel.threadlinqs.com/technique/T1133) External Remote Services — Initial Access — observed in 2 of 2 tracked threats
- [T1550.004](https://intel.threadlinqs.com/technique/T1550.004) Use Alternate Authentication Material: Web Session Cookie — Lateral Movement — observed in 2 of 2 tracked threats
- [T1595](https://intel.threadlinqs.com/technique/T1595) Active Scanning — Reconnaissance — observed in 2 of 2 tracked threats
- [T1018](https://intel.threadlinqs.com/technique/T1018) Remote System Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 1 of 2 tracked threats
- [T1021.001](https://intel.threadlinqs.com/technique/T1021.001) Remote Desktop Protocol — Lateral Movement — observed in 1 of 2 tracked threats
- [T1021.002](https://intel.threadlinqs.com/technique/T1021.002) SMB/Windows Admin Shares — Lateral Movement — observed in 1 of 2 tracked threats
- [T1039](https://intel.threadlinqs.com/technique/T1039) Data from Network Shared Drive — Collection — observed in 1 of 2 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 1 of 2 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1056](https://intel.threadlinqs.com/technique/T1056) Input Capture — Collection — observed in 1 of 2 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 1 of 2 tracked threats

## Tracked threats

- [FortiBleed: Ongoing Credential-Harvesting Campaign Against Fortinet FortiGate Firewalls and SSL VPN Gateways Feeds INC/Lynx and Payload Ransomware Access (FBI/USSS Alert)](https://intel.threadlinqs.com/threat/TL-2026-2989) — HIGH
- [FortiBleed: Russian-Speaking Initial Access Broker Weaponizes FortiOS 'diagnose sniffer packet' (FortigateSniffer) to Harvest 110M+ Credentials From ~430,000 FortiGate Firewalls](https://intel.threadlinqs.com/threat/TL-2026-0927) — CRITICAL

## Related CVEs

3 CVEs referenced by tracked SantaAd activity.

- [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858)
- [CVE-2025-59719](https://intel.threadlinqs.com/cve/CVE-2025-59719)
- [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/SantaAd