# France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge

> CloudSEK reports a 4x surge in France-related dark web activity over 24 months (~17,800 items, dark-web volume rising from under 300/month mid-2024 to over 1,400/month January 2026), driven primarily by infostealer credential logs and resale rather than targeted intrusion. Ransomware groups Qilin (8 advisories, Commune d'Eyguières re-listed repeatedly), MedusaLocker (Mairie Thiverval-Grignon, 162 emails exfiltrated), and LockBit (recurring, opportunistic cross-sector) are active against French local government and small organizations, while pro-Russian hacktivist group NoName057(16) runs a sustained DDoS and access-claim campaign (742 France-tagged items in 6 months) against French government ministries, transport, energy, and defense-adjacent manufacturers tied to France's support for Ukraine.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1652
- **ID:** TL-2026-1652
- **Severity:** HIGH
- **Category:** RANSOMWARE_HACKTIVISM
- **Status:** ACTIVE
- **Actor:** Qilin (Russia)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CloudSEK's Global Threat Intelligence (GTI) platform documents a 4x increase in France-tagged dark web activity over the trailing 24 months, from under 300 items/month in mid-2024 to over 1,400 items/month in January 2026, settling above 1,000/month through spring 2026, for a cumulative total of approximately 17,800 items (data leaks, credential dumps, ransomware advisories, and hacktivist claims). The leading data types are account credentials (4,447), credential collections (4,360), combined datasets (4,011), and breached records (3,565), overwhelmingly the product of commodity infostealer malware harvesting logs at scale and reselling them through underground forums rather than sophisticated targeted intrusion. Top targeted sectors by volume are government (1,652), financial services (1,594), technology (1,491), telecommunications (1,480), and email (1,427).

Ransomware activity against France over the trailing six months totals 213 victim advisories, concentrated on local government and small organizations (0-10 employees). Qilin — a Rust-based (rebuilt from an earlier Go variant) RaaS operation offering affiliates up to 85% revenue share, operating a Tor-hosted double-extortion leak site, and ranked among the top-five ransomware groups globally by 2025 victim count — posted the Commune d'Eyguières across eight separate advisory listings within 24 hours (June 20-21, 2026), a re-listing pattern used to maximize negotiation pressure. Qilin's initial access relies on VPN credential theft (via infostealer logs, credential stuffing, and exploitation of unpatched VPN appliances) and spear-phishing against high-privilege staff; it has been observed harvesting Chrome browser credentials domain-wide via GPO-distributed scripts and, since October 2025, abusing Windows Subsystem for Linux (WSL) to execute ransomware payloads and evade Windows-native EDR. Lateral movement leverages RDP, PsExec, WMI, and Mimikatz.

MedusaLocker — a distinct RaaS lineage from the unrelated 'Medusa' ransomware (subject of CISA/FBI/MS-ISAC advisory AA25-071A) — claimed Mairie Thiverval-Grignon, extracting and threatening to publish 162 internal municipal email addresses under dual-attribution posting. MedusaLocker's documented TTPs (per joint CISA/FBI/Treasury/FinCEN advisory) center on brute-forcing and exploiting exposed RDP (External Remote Services, Valid Accounts) for initial access, followed by PowerShell/batch-script execution and network-wide file encryption targeting shared drives.

LockBit maintains a recurring, opportunistic, cross-sector presence against French targets; the group's most recent iteration, LockBit 5.0, ships Windows (AES-256-CTR/RSA-2048), Linux (AES-256-CBC/Curve25519), and VMware ESXi-specific payloads, uses randomized 9-character encrypted file extensions, employs BYOVD techniques (RTCore64.sys, dbutil_2_3.sys) to disable EDR/AV, and terminates backup and security-tool processes (Veeam, SQL, Oracle, Exchange, VSS, Sophos, CrowdStrike, SentinelOne, Carbon Black, Cylance) prior to encryption. LockBit has a documented history against French high-value targets including the French Ministry of Justice, and French law enforcement has participated in coordinated international arrests of LockBit-affiliated developers.

Separately, pro-Russian hacktivist collective NoName057(16) (active since March 2022, operating the crowdsourced 'DDoSia' volunteer-DDoS platform, successor to the earlier 'Bobik' botnet) generated 742 France-tagged dark-web items over six months, explicitly motivated by France's support for Ukraine. Campaigns under the '#BrokenByte' banner targeted drone manufacturers Xsun France and iDrone with application-layer DDoS; the group also claimed unauthorized CCTV access against the Musée National de l'Automobile (Mulhouse) and a Renault/Dacia dealership (video surveillance and client PII access claims), and ran coordinated DDoS against French government ministries (Economy, Justice, Finance, Interior), the Civil Aviation Authority, and the National Reception Office. In January 2026 the group additionally claimed attacks on La Poste/La Banque Postale, the Rennes Metro, the Angers Tramway, French airports, the national road-safety agency, and multiple EDF (national energy utility) portals — a coordinated multi-sector critical-infrastructure campaign. NoName057(16)'s DDoSia client is a Go-based tool distributed via Telegram (t.me/DDosiabot), where volunteers register for a unique 'User Hash' and receive cryptocurrency rewards for participation; the client authenticates to a multi-tiered C2 infrastructure (Tier-1 servers refresh roughly every nine days, proxying to access-controlled Tier-2 servers) using AES-GCM-encrypted JSON payloads over HTTP POST /client/login and GET /client/get_targets, with randomized User-Agent strings and Base32-encoded padding to evade filtering. Attack activity clusters in two daily waves (05:00-07:00 UTC and around 11:00 UTC on weekdays), consistent with a standard Russian working schedule. Across a prior 12-month window (July 2024-July 2025), France accounted for 6.09% of the group's global targeting, concentrated in government/public sector (41.09%), transportation/logistics (12.44%), and technology/media/communications (10.19%). International law enforcement action (Eurojust-coordinated) has produced two arrests (including one preliminary arrest in France) and 24 house searches across Europe, without disrupting operational tempo.

The surge is compounded by regulatory findings underscoring systemic weaknesses in French data protection: CNIL fined Free Mobile/Free EUR 42M in January 2026 for inadequate security controls after 24.6 million subscriber contracts were exposed, and fined France Travail EUR 5M the same month after 43 million job-seeker records were exposed due to weak authentication and excessive access permissions — both incidents feeding the same infostealer/credential-resale ecosystem CloudSEK tracks.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1566 Phishing
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1072 Software Deployment Tools
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1484 Domain or Tenant Policy Modification
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1110 Brute Force
- T1083 File and Directory Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1498 Network Denial of Service
- T1499 Endpoint Denial of Service
- T1491 Defacement
- T1583 Acquire Infrastructure

## Sources

- [France Dark Web, Ransomware & Hacktivism Report](https://www.cloudsek.com/blog/france-dark-web-ransomware-hacktivism-report)
- [Qilin Ransomware Attack Targets French IT Distributor Exclusive Networks](https://www.dexpose.io/qilin-ransomware-attack-targets-french-it-distributor-exclusive-networks/)
- [Qilin Ransomware: Group Profile, TTPs, IOCs & Defense (2026)](https://www.dexpose.io/qilin-ransomware/)
- [Qilin ransomware surges into 2026](https://blog.barracuda.com/2026/01/15/qilin-ransomware-surges-into-2026)
- [Dark Web Profile: Qilin (Agenda) Ransomware](https://socradar.io/blog/dark-web-profile-qilin-agenda-ransomware/)
- [Ransomware.live: Qilin group tracker](https://www.ransomware.live/group/qilin)
- [Inside DDoSia: NoName057(16)'s Pro-Russian DDoS Campaign Infrastructure](https://www.recordedfuture.com/research/anatomy-of-ddosia)
- [Pro-Russian hackers claim attack on French postal service operator](https://therecord.media/pro-russia-hackers-claim-attack-la-poste)
- [NoName057/NoName05716: DDoS Threat Intel & Defense Guide](https://www.bitsight.com/blog/noname057-16-ddos-threat-intelligence)
- [La France est elle vraiment ciblée par NoName057(16) ?](https://www.solutions-numeriques.com/la-france-est-elle-vraiment-ciblee-par-noname05716/)
- [Noname057(16) - Wikipedia](https://en.wikipedia.org/wiki/Noname057(16))
- [The La Poste attack in France was a coordinated campaign that targeted critical infrastructure](https://www.scworld.com/perspective/the-la-poste-attack-in-france-was-a-coordinated-campaign-that-targeted-critical-infrastructure)
- [Hacktivist group responsible for cyberattacks on critical infrastructure in Europe taken down](https://www.eurojust.europa.eu/news/hacktivist-group-responsible-cyberattacks-critical-infrastructure-europe-taken-down)
- [#StopRansomware: Medusa Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a)
- [Medusa Ransomware: IOCs, MITRE TTPs & Detection](https://www.manageengine.com/malware-protection/adversaries/medusa-ransomware.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1652