Q1 2026 Ransomware Landscape: Qilin Dominance, LockBit 5.0 Comeback, and FortiGate (CVE-2024-55591) / Oracle EBS (CVE-2025-61882) Mass Exploitation
Q1 2026 Ransomware Landscape (TL-2026-0758), also tracked as The State of Ransomware Q1 2026, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-06-10 and last reviewed 2026-09-08. It is attributed to Qilin with medium confidence, affects Oracle E-Business Suite (Concurrent Processing / BI Publisher, references 5 CVEs (CVE-2024-55591, CVE-2025-61882, CVE-2025-61884), maps to 50 MITRE ATT&CK techniques (T1005, T1016, T1018), and is covered by 9 detection rules and 51 indicators of compromise.
Key facts for TL-2026-0758
- Threat ID
- TL-2026-0758
- Also known as
- The State of Ransomware Q1 2026, Oracle EBS Cl0p extortion campaign, The Gentlemen FortiGate campaign
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-09-08
- Attribution
- Qilin
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- business services, healthcare, manufacturing, consumer goods, financial, government, technology
- Target regions
- North America, Europe, South America, Asia-Pacific, Australia
- Detection rules
- 9
- Indicators of compromise
- 51
- Updates
- 2026-09-08 · 2 updates · revalidated 2× · latest source
Malware and tooling in Q1 2026 Ransomware Landscape
Malware and tooling: GOLDVEIN.JAVA, LockBit 5.0, SAGEGIFT, SAGELEAF, SAGEWAVE, GOLDTOMB, MANSPIDER, NetExec, Slempo, ntlmrelayx / RelayKing
Check Point Research recorded 2,122 ransomware victims on data-leak sites in Q1 2026 (second-highest Q1 on record). Qilin led for a third straight quarter (338 victims), LockBit 5.0 rebuilt its affiliate base (+106%, 163 victims), and The Gentlemen surged +315% (166 victims) by weaponizing ~14,700 pre-compromised FortiGate devices via CVE-2024-55591, while Cl0p mass-exploited Oracle E-Business Suite via the zero-day CVE-2025-61882.
How Q1 2026 Ransomware Landscape works
Q1 2026 was the second-busiest first quarter on record for ransomware data-leak-site (DLS) extortion, with Check Point Research counting 2,122 victims posted across January (732), February (684) and March (706). The top 10 groups accounted for 71.1% of all DLS victims, and the ecosystem remained heavily US-weighted (~49.6% of victims).
Qilin remained the most prolific operation for a third consecutive quarter with 338 victims. The Gentlemen — a Ransomware-as-a-Service (RaaS) operation founded by former Qilin affiliate 'Hastalamuerte' after a dispute over an unpaid $48,000 commission — exploded +315% from 40 victims in Q4 2025 to 166, reaching third place globally and claiming 53% of all Thai victims. LockBit returned with LockBit 5.0 (launched September 2025), rebuilding its affiliate base +106% to 163 victims; the new build added multi-platform support (Windows, Linux, ESXi), required new affiliates to post a ~$500 Bitcoin deposit, and shifted ~21.2% of its targeting to the US. Play (121, +64%), DragonForce (101, +29%), Nightspire (82, +183%) and Akira rounded out the leaders, while Sinobi (-42%), SafePay (-77%) and Devman (-70%) declined — the Devman operator was added to Interpol's wanted list in January 2026.
Two CVEs drove much of the quarter's initial access. The Gentlemen leveraged CVE-2024-55591, a FortiOS/FortiProxy authentication-bypass (CWE-288, CVSS 9.8) allowing remote super-admin via crafted requests to the Node.js websocket module, maintaining an inventory of ~14,700 pre-exploited FortiGate devices plus 969 brute-forced VPN credentials. Post-exploitation, the group replaced commercial Cobalt Strike with a custom G-BOT C2 framework (per-beacon SOCKS5 tunneling), enumerated Active Directory with NetExec and MANSPIDER, and conducted NTLM relay attacks with ntlmrelayx/RelayKing — also tracking CVE-2025-32433 (Erlang/OTP SSH) and CVE-2025-33073 (NTLM relay). Separately, Cl0p (overlapping with FIN11) mass-exploited CVE-2025-61882, an unauthenticated RCE in Oracle E-Business Suite Concurrent Processing / BI Publisher Integration (CWE-287, CVSS 9.8), as a zero-day from as early as August 9, 2025. The exploit chains SSRF, CRLF injection, authentication bypass and XSL template injection (malicious templates written to the XDO_TEMPLATES_B table with TMP/DEF prefixes) to achieve in-memory RCE, deploying the SAGEGIFT → SAGELEAF → SAGEWAVE Java loader chain and the GOLDVEIN.JAVA downloader. A high-volume extortion-email wave began September 29, 2025; Oracle shipped emergency patches October 4 and October 11, 2025, after the exploit leaked via the 'SCATTERED LAPSUS$ HUNTERS' Telegram group on October 3.
MITRE ATT&CK techniques used in TL-2026-0758
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Discovery
T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1482 Domain Trust Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation
Command and Control
T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
T1098 Account Manipulation; T1505 Server Software Component; T1505.003 Server Software Component: Web Shell
Credential Access
T1110 Brute Force; T1187 Forced Authentication; T1555 Credentials from Password Stores
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft
stealth
Resource Development
T1583.004 Acquire Infrastructure: Server; T1586.002 Compromise Accounts: Email Accounts
Reconnaissance
T1595.002 Active Scanning: Vulnerability Scanning
defense-impairment
Affected products and versions in Q1 2026 Ransomware Landscape
- Oracle — E-Business Suite (Concurrent Processing / BI Publisher Integration)
Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
Fixed in: Patched via Oracle Security Alert CVE-2025-61882 (2025-10-04); requires October 2023 CPU as prerequisite - Fortinet — FortiOS
Vulnerable versions: 7.0.0 through 7.0.16
Fixed in: 7.0.17 - Fortinet — FortiProxy
Vulnerable versions: 7.0.0 through 7.0.19; 7.2.0 through 7.2.12
Fixed in: 7.0.20; 7.2.13 - VMware — ESXi
Vulnerable versions: Targeted by LockBit 5.0 ESXi encryptor
Remediation for Q1 2026 Ransomware Landscape
Patches
- Oracle Security Alert CVE-2025-61882 emergency patch (2025-10-04)
- Oracle CVE-2025-61884 patch (2025-10-11)
- Fortinet FG-IR-24-535: FortiOS 7.0.17, FortiProxy 7.0.20 / 7.2.13
Immediate actions
- Apply Oracle emergency patch for CVE-2025-61882 (released 2025-10-04) and the follow-up CVE-2025-61884 patch (2025-10-11) to all Oracle EBS 12.2.3-12.2.14 instances
- Upgrade FortiOS to 7.0.17+ and FortiProxy to 7.0.20+ / 7.2.13+ to remediate CVE-2024-55591; treat all internet-facing FortiGate management interfaces as potentially compromised
- Block known C2/exploitation IPs (200.107.207.26, 161.97.99.49, 162.55.17.215, 104.194.11.200, 185.181.60.11) at the perimeter
- Hunt for malicious XSL templates in XDO_TEMPLATES_B (TemplateCode prefixed TMP/DEF, TemplateType XSL-TEXT/XML) and inspect XDO_LOBS for recent rows
Workarounds
- Restrict access to the FortiGate administrative interface to trusted management networks only
- Disable internet exposure of Oracle EBS /OA_HTML endpoints (UiServlet, SyncServlet, TemplatePreviewPG) where not required
Longer-term hardening
- Deploy EDR with behavioral detection for reverse shells, ETW patching, process hollowing and reflective DLL loading
- Remove direct internet exposure of Oracle EBS and FortiGate management planes; place behind VPN/ZTNA with MFA
- Reset all FortiGate VPN/local credentials and enforce phishing-resistant MFA after CVE-2024-55591 exposure
- Implement network segmentation and tiered admin to blunt NTLM relay and ADCS-based privilege escalation
CVEs associated with Q1 2026 Ransomware Landscape
CVE-2024-55591, CVE-2025-61882, CVE-2025-61884, CVE-2025-32433, CVE-2025-33073
Weaknesses (CWE) in Q1 2026 Ransomware Landscape
CWE-288, CWE-287, CWE-918, CWE-93, CWE-91, CWE-22, CWE-444, CWE-501, CWE-95, CWE-94
Timeline of Q1 2026 Ransomware Landscape
Showing the 20 most recent tracked events.
- Trend Micro documents LockBit 5.0, a cross-platform variant targeting Windows, Linux and ESXi using XChaCha20/Curve25519 encryption.
- Google Threat Intelligence Group and Mandiant begin tracking a large-scale Cl0p extortion-email campaign against Oracle EBS executives.
- Oracle publicly acknowledges potential active exploitation of the then-unpatched EBS vulnerability, two days before the emergency patch.
- The Oracle EBS exploit (exp.py, server.py) leaks via the 'SCATTERED LAPSUS$ HUNTERS' Telegram group.
- Oracle releases an emergency Security Alert and patch for CVE-2025-61882; CISA adds it to the KEV catalog (mitigation deadline 2025-10-27).
- Google Threat Intelligence Group publishes the full technical analysis of the exploit chain, GOLDVEIN.JAVA, and the SAGEGIFT/SAGELEAF/SAGEWAVE backdoor chain, including YARA rules.
- CISA adds CVE-2025-61882 to the Known Exploited Vulnerabilities catalog with an October 27, 2025 remediation deadline.
- No campaign victims yet publicly posted to the Cl0p data-leak site, consistent with the group's historical multi-week delay before public shaming.
- Oracle releases a follow-up patch addressing CVE-2025-61884 in the same EBS component family.
- Active exploitation of CVE-2025-61884 confirmed; CISA sets a November 10, 2025 KEV remediation deadline.
- University of Phoenix discloses a related CVE-2025-61882 Oracle EBS breach affecting roughly 3.5 million people, including SSNs and bank/routing numbers, after Clop listed it on its leak site.
- Bimbo Bakeries USA's investigation determines unauthorized parties acquired files stored in its Oracle EBS application, accessed via a third-party vendor relationship now under re-evaluation.
- The Devman ransomware operator is added to Interpol's wanted list (January 2026).
- Q1 2026 closes with 2,122 DLS victims (Jan 732, Feb 684, Mar 706); Qilin leads at 338, The Gentlemen +315% (166), LockBit 5.0 +106% (163).
- Check Point Research publishes 'The State of Ransomware in Q1 2026' summarizing the quarter's DLS activity and exploitation campaigns.
- Estée Lauder publicly discloses an Oracle EBS zero-day intrusion dating to August 9, 2025 that exposed employee SSNs, government IDs, financial account codes, and health/payroll records.
- Bimbo Bakeries USA completes its forensic file review, confirming a stolen file contained customer/employee names and Social Security numbers.
- Bimbo dates its data-breach notification letter, offering 12 months of free single-bureau credit monitoring and fraud assistance via Cyberscout (TransUnion).
- Bimbo files the data-breach notification with the California Attorney General's office.
- Public reporting confirms the Bimbo Bakeries USA breach as part of the Clop Oracle EBS zero-day extortion campaign, alongside other named victims (Harvard University, The Washington Post, Logitech, Cox Enterprises, Envoy Air, Schneider Electric, Emerson, LKQ, Copeland).
Update history for TL-2026-0758
- 2026-09-08 — Bimbo Bakeries USA Confirms Data Breach via Oracle EBS Zero-Day (CVE-2025-61882) Attributed to Clop: What changed Severity/exploitability/status unchanged (already CRITICAL/ACTIVE). The Cl0p/Oracle-EBS sub-narrative gains a confirmed named victim: Bimbo Bakeries USA confirmed on 2026-08-19 that a stolen file contained customer and employee
- 2026-07-19 — Oracle E-Business Suite Zero-Day (CVE-2025-61882) Chained with CVE-2025-61884 Exploited by CL0P-Linked Actor for Mass Extortion: What changed Severity escalated HIGH → CRITICAL for the Oracle EBS/Cl0p thread based on the newly detailed pre-auth exploit chain (SSRF+CRLF+path-traversal+XSLT/ScriptEngine RCE), confirmed CISA KEV listing, and a 100-organization mass exto
Sources cited for Q1 2026 Ransomware Landscape
- The State of Ransomware in Q1 2026
- CVE-2024-55591 Detail
- CVE-2025-61882 Detail
- Fortinet PSIRT FG-IR-24-535
- Oracle Security Alert Advisory CVE-2025-61882
- Oracle E-Business Suite Zero-Day Exploitation (Google Threat Intelligence Group / Mandiant)
- CVE-2025-61882: Oracle EBS Zero-Day Exploited in Clop Extortion Campaigns (Oligo Security)
- CVE-2025-61882: Critical 0day in Oracle E-Business Suite exploited in-the-wild (Rapid7)
- Oracle EBS CVE-2025-61882 Exploited in Extortion Attacks (VulnCheck)
- The Gentlemen Ransomware Group Uses Fortinet Exploits, AI, and Custom C2 Frameworks
- The Gentlemen Ransomware: Defense Evasion TTPs Uncovered (Huntress)
- New LockBit 5.0 Targets Windows, Linux, ESXi (Trend Micro)
- CrowdStrike ties Oracle EBS RCE (CVE-2025-61882) to Cl0p attacks began Aug 9, 2025 (Security Affairs)
- CVE-2025-61882 FAQ: Oracle EBS Zero-Day, Cl0p (Tenable)
Threats related to Q1 2026 Ransomware Landscape
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
- The Gentlemen Ransomware — FortiOS CVE-2024-55591 Authentication Bypass + Custom G-BOT C2 Framework
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
- Estée Lauder Data Breach via Oracle E-Business Suite Zero-Day (CVE-2025-61882) — Clop Exploitation
- The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts
- The Gentlemen RaaS (Storm-2697) — Multi-Platform Ransomware-as-a-Service with BYOVD Defense Evasion and Self-Propagating Go Encryptor
Detection coverage for TL-2026-0758
As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0758 across Splunk SPL, Microsoft KQL and Sigma, covering 51 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0758
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.