# Q1 2026 Ransomware Landscape: Qilin Dominance, LockBit 5.0 Comeback, and FortiGate (CVE-2024-55591) / Oracle EBS (CVE-2025-61882) Mass Exploitation

> Check Point Research recorded 2,122 ransomware victims on data-leak sites in Q1 2026 (second-highest Q1 on record). Qilin led for a third straight quarter (338 victims), LockBit 5.0 rebuilt its affiliate base (+106%, 163 victims), and The Gentlemen surged +315% (166 victims) by weaponizing ~14,700 pre-compromised FortiGate devices via CVE-2024-55591, while Cl0p mass-exploited Oracle E-Business Suite via the zero-day CVE-2025-61882.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-09-08T02:48:39.620Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0758
- **ID:** TL-2026-0758
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 51 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-61882, CVE-2025-61884, CVE-2025-32433, CVE-2025-33073

## Description

Q1 2026 was the second-busiest first quarter on record for ransomware data-leak-site (DLS) extortion, with Check Point Research counting 2,122 victims posted across January (732), February (684) and March (706). The top 10 groups accounted for 71.1% of all DLS victims, and the ecosystem remained heavily US-weighted (~49.6% of victims).

Qilin remained the most prolific operation for a third consecutive quarter with 338 victims. The Gentlemen — a Ransomware-as-a-Service (RaaS) operation founded by former Qilin affiliate 'Hastalamuerte' after a dispute over an unpaid $48,000 commission — exploded +315% from 40 victims in Q4 2025 to 166, reaching third place globally and claiming 53% of all Thai victims. LockBit returned with LockBit 5.0 (launched September 2025), rebuilding its affiliate base +106% to 163 victims; the new build added multi-platform support (Windows, Linux, ESXi), required new affiliates to post a ~$500 Bitcoin deposit, and shifted ~21.2% of its targeting to the US. Play (121, +64%), DragonForce (101, +29%), Nightspire (82, +183%) and Akira rounded out the leaders, while Sinobi (-42%), SafePay (-77%) and Devman (-70%) declined — the Devman operator was added to Interpol's wanted list in January 2026.

Two CVEs drove much of the quarter's initial access. The Gentlemen leveraged CVE-2024-55591, a FortiOS/FortiProxy authentication-bypass (CWE-288, CVSS 9.8) allowing remote super-admin via crafted requests to the Node.js websocket module, maintaining an inventory of ~14,700 pre-exploited FortiGate devices plus 969 brute-forced VPN credentials. Post-exploitation, the group replaced commercial Cobalt Strike with a custom G-BOT C2 framework (per-beacon SOCKS5 tunneling), enumerated Active Directory with NetExec and MANSPIDER, and conducted NTLM relay attacks with ntlmrelayx/RelayKing — also tracking CVE-2025-32433 (Erlang/OTP SSH) and CVE-2025-33073 (NTLM relay). Separately, Cl0p (overlapping with FIN11) mass-exploited CVE-2025-61882, an unauthenticated RCE in Oracle E-Business Suite Concurrent Processing / BI Publisher Integration (CWE-287, CVSS 9.8), as a zero-day from as early as August 9, 2025. The exploit chains SSRF, CRLF injection, authentication bypass and XSL template injection (malicious templates written to the XDO_TEMPLATES_B table with TMP/DEF prefixes) to achieve in-memory RCE, deploying the SAGEGIFT → SAGELEAF → SAGEWAVE Java loader chain and the GOLDVEIN.JAVA downloader. A high-volume extortion-email wave began September 29, 2025; Oracle shipped emergency patches October 4 and October 11, 2025, after the exploit leaked via the 'SCATTERED LAPSUS$ HUNTERS' Telegram group on October 3.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1110 Brute Force
- T1187 Forced Authentication
- T1555 Credentials from Password Stores
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1505 Server Software Component
- T1098 Account Manipulation
- T1134 Access Token Manipulation
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1016 System Network Configuration Discovery
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1490 Inhibit System Recovery
- T1595.002 Active Scanning: Vulnerability Scanning
- T1586.002 Compromise Accounts: Email Accounts
- T1583.004 Acquire Infrastructure: Server
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1203 Exploitation for Client Execution
- T1574 Hijack Execution Flow
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery

## Sources

- [The State of Ransomware in Q1 2026](https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/)
- [CVE-2024-55591 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-55591)
- [CVE-2025-61882 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-61882)
- [Fortinet PSIRT FG-IR-24-535](https://fortiguard.fortinet.com/psirt/FG-IR-24-535)
- [Oracle Security Alert Advisory CVE-2025-61882](https://www.oracle.com/security-alerts/alert-cve-2025-61882.html)
- [Oracle E-Business Suite Zero-Day Exploitation (Google Threat Intelligence Group / Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation/)
- [CVE-2025-61882: Oracle EBS Zero-Day Exploited in Clop Extortion Campaigns (Oligo Security)](https://www.oligo.security/blog/cve-2025-61882-oracle-e-business-suite-zero-day-exploited-in-clop-extortion-campaigns)
- [CVE-2025-61882: Critical 0day in Oracle E-Business Suite exploited in-the-wild (Rapid7)](https://www.rapid7.com/blog/post/etr-cve-2025-61882-critical-0day-in-oracle-e-business-suite-exploited-in-the-wild/)
- [Oracle EBS CVE-2025-61882 Exploited in Extortion Attacks (VulnCheck)](https://www.vulncheck.com/blog/oracle-e-business-suite-cve-2025-61882-exploited-in-extortion-attacks)
- [The Gentlemen Ransomware Group Uses Fortinet Exploits, AI, and Custom C2 Frameworks](https://cybersecuritynews.com/the-gentlemen-ransomware-group-uses-fortinet-exploits/)
- [The Gentlemen Ransomware: Defense Evasion TTPs Uncovered (Huntress)](https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps)
- [New LockBit 5.0 Targets Windows, Linux, ESXi (Trend Micro)](https://www.trendmicro.com/en_us/research/25/i/lockbit-5-targets-windows-linux-esxi.html)
- [CrowdStrike ties Oracle EBS RCE (CVE-2025-61882) to Cl0p attacks began Aug 9, 2025 (Security Affairs)](https://securityaffairs.com/183065/cyber-crime/crowdstrike-ties-oracle-ebs-rce-cve-2025-61882-to-cl0p-attacks-began-aug-9-2025.html)
- [CVE-2025-61882 FAQ: Oracle EBS Zero-Day, Cl0p (Tenable)](https://www.tenable.com/blog/cve-2025-61882-faq-oracle-e-business-suite-zero-day-cl0p-and-july-2025-cpu)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0758