Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices

Key facts for Ransomware cartel shared infrastructure

Detection coverage for Ransomware cartel shared infrastructure

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2517 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SonicWall SSL VPN Rapid Login-to-Internal-Access Pivot (CVE-2024-40766)

Detects the Akira-pattern exploitation of CVE-2024-40766 (improper access control letting local SonicWall SSL VPN accounts with passwords carried over from Gen5/Gen6 firmware migrations authenticate unexpectedly). Flags SSL VPN logins from local/legacy accounts that are immediately followed (within minutes) by internal SMB/RDP/WinRM connections from the VPN-assigned address -- the sub-hour login-to-encryption pattern CISA and Arctic Wolf documented, with some intrusions completing in under 55 minutes.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1133, T1078
• Data sources: sonicwall_ssl_vpn_logs, network_firewall_logs, windows_security
• Severity: critical
• Confidence: high

Splunk SPL

`comment("CVE-2024-40766: SonicWall SSL VPN local-account login followed by rapid internal pivot")`
index=network sourcetype=sonicwall:vpn OR sourcetype="cisco:cef" tag=vpn tag=authentication action=success user_type=local
| eval vpn_login_time=_time
| table _time, user, src_ip, dest_ip, vpn_assigned_ip, vpn_login_time
| join type=inner vpn_assigned_ip
    [ search index=network (sourcetype="cisco:asa" OR sourcetype="stream:tcp") dest_port IN (445,3389,5985,5986)
      | eval internal_conn_time=_time
      | table src_ip AS vpn_assigned_ip, dest_ip AS internal_dest, dest_port, internal_conn_time ]
| eval minutes_to_pivot=round((internal_conn_time-vpn_login_time)/60,1)
| where minutes_to_pivot>=0 AND minutes_to_pivot<=15
| table _time, user, src_ip, vpn_assigned_ip, internal_dest, dest_port, minutes_to_pivot
| sort - minutes_to_pivot

Microsoft KQL

// CVE-2024-40766: SonicWall SSL VPN (CEF/CommonSecurityLog) local-account login -> rapid internal pivot
let vpnLogins = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "SonicWall" and Activity has "SSLVPN" and DeviceEventClassID has "login"
| where AdditionalExtensions has "local" or SourceUserName !contains "@"
| project LoginTime = TimeGenerated, SourceUserName, SourceIP, DestinationIP;
let internalConns = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (445, 3389, 5985, 5986)
| project ConnTime = TimeGenerated, LocalIP, RemoteIP, RemotePort, DeviceName;
vpnLogins
| join kind=inner (internalConns) on $left.DestinationIP == $right.LocalIP
| extend MinutesToPivot = datetime_diff('minute', ConnTime, LoginTime)
| where MinutesToPivot between (0 .. 15)
| project LoginTime, SourceUserName, SourceIP, DestinationIP, ConnTime, RemoteIP, RemotePort, DeviceName, MinutesToPivot
| sort by MinutesToPivot asc

Sigma

title: SonicWall SSL VPN Local Account Login With Rapid Internal Pivot (CVE-2024-40766)
id: a1e4c9b2-7d3f-4a1e-9c5a-2f6b8d1e4a01
status: experimental
description: Detects a SonicWall SSL VPN authentication from a local/legacy account immediately followed by internal SMB/RDP/WinRM connections, consistent with CVE-2024-40766 exploitation and the Akira sub-hour login-to-encryption pattern.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766
    - https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1133
    - attack.t1078
    - cve.2024.40766
    - attack.group.akira
logsource:
    category: firewall
    product: sonicwall
detection:
    selection_login:
        Activity|contains: 'SSLVPN'
        AccountType: 'local'
        EventOutcome: 'success'
    selection_pivot:
        DestinationPort:
            - 445
            - 3389
            - 5985
            - 5986
    timeframe: 15m
    condition: selection_login | near selection_pivot
falsepositives:
    - Legitimate remote administrators using a documented local break-glass VPN account followed immediately by scheduled RDP/SMB maintenance
level: high

Known false positives:

• Documented break-glass local VPN accounts used by MSPs/admins performing legitimate rapid post-VPN RDP/SMB maintenance from the same session

Tuning notes: Baseline the normal population of local (non-SSO) SonicWall accounts per tenant and exclude known MSP break-glass accounts; tighten the pivot window to <5 minutes for high-confidence Akira-speed intrusions and widen to 60 minutes for a lower-severity hunting variant. Cross-reference source/assigned IPs against CISA KEV CVE-2024-40766 advisory guidance.

• 🔒 Gladinet CentreStack/Triofox ViewState Deserialization RCE Chain (CVE-2025-30406/CVE-2025-11371/CVE-2025-14611) · unlock with TL Creds
• 🔒 High-Volume Rclone/SFTP Exfiltration to Cloud Storage or External SSH Endpoint · unlock with TL Creds
• 🔒 Chisel Tunnel Chained With Cloudflare Worker Reverse SOCKS Proxy / Tor and Multi-Hop Proxy Egress · unlock with TL Creds
• 🔒 FortiGate FortiBleed Mass Credential-Theft Scan Pattern Followed by VPN Logon · unlock with TL Creds
• 🔒 Unsanctioned SimpleHelp/AnyDesk RMM Install Followed by Rclone Staging · unlock with TL Creds
• 🔒 Cobalt Strike Named-Pipe Beacon Combined With SOCKS Proxy Egress to Reported C2 Infrastructure · unlock with TL Creds
• 🔒 Dual-Use RMM/Exfil Tool Install Chain Post-Exploitation (Rclone/AnyDesk/FileZilla/SimpleHelp) · unlock with TL Creds
• 🔒 RDP Brute-Force to Lateral Movement Chained With Cobalt Strike Beacon Pattern · unlock with TL Creds

Indicators of compromise for Ransomware cartel shared infrastructure

As of 2026-11-04, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-2517.

How Ransomware cartel shared infrastructure works

Team Cymru's Ransomware Infrastructure Analysis synthesizes 20+ incident investigations between April 2025 and April 2026 into cross-gang infrastructure and TTP patterns for seven active ransomware operations -- Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, and Lynx (a rebrand of INC Ransom sharing over 90% of its source code) -- with a LockBit3 (leaked-builder) incident also documented. The analysis, which primarily covers intrusions against UK small-to-medium enterprises, finds a decisive shift away from custom-coded malware toward abuse of legitimate dual-use tools: Rclone and FileZilla for exfiltration, Cobalt Strike for post-exploitation C2, and AnyDesk/SimpleHelp for hands-on-keyboard remote access -- a pattern Team Cymru's Scout platform tags consistently across all seven groups.

Initial access converges on three exploitation vectors. First, Akira's sustained 2025 campaign against SonicWall SonicOS SSL VPN devices via CVE-2024-40766 (CVSS 9.3), an improper access-control flaw in which local account passwords carried over from Gen5/Gen6 firmware migrations were never reset; CISA and Arctic Wolf documented dozens of intrusions moving from SSL VPN login to full encryption in under four hours, with some as fast as 55 minutes. Second, Clop's December 2025 mass-exploitation of internet-facing Gladinet CentreStack/Triofox managed file transfer servers, chaining a hardcoded IIS machineKey (CVE-2025-30406, CVE-2025-14611) with an unauthenticated local file inclusion flaw (CVE-2025-11371) into a ViewState deserialization remote code execution primitive, staged from commercial VPN egress (Cloudflare WARP, Private Internet Access) across AS396073, AS51852, and AS50049. Third, DragonForce's continued reliance on RDP brute-forcing for both initial access and lateral movement. Lynx's February 2026 incident followed exploitation of a Fortinet FortiGate appliance, a vector later connected to the wider 'FortiBleed' mass credential-theft campaign (86,644+ affected devices across 194 countries) that SOCRadar publicly attributed to INC Ransom and Lynx ransomware deployments in July 2026.

Post-compromise, the gangs converge again on VPN/Tor/SOCKS-proxy obfuscation: DragonForce anonymizes operator traffic over Tor; multiple groups route through commercial VPN services (1VPN, Cloudflare WARP, Private Internet Access) and low-reputation VPS hosting spread across dozens of distinct ASNs to frustrate attribution and takedown; and MedusaLocker's March 2026 incident chained an open-source Chisel tunneling implant with a Cloudflare Worker to stand up a reverse SOCKS proxy for covert command and control. Qilin and MedusaLocker both exfiltrated over SFTP/OpenSSH from single staging nodes supporting multiple post-compromise objectives, while Akira and INC Ransom relied on Rclone syncs to cloud storage. No group in this analysis window deployed custom-coded lateral-movement or C2 malware, consistent with CISA's Akira advisory (AA24-109A), which documents Akira's reliance on commodity tools (Mimikatz, AdFind, PowerTool/Zemana-driver AV killers, Cobalt Strike, AnyDesk) and living-off-the-land techniques -- including volume shadow copy deletion and EDR/AV tampering ahead of ChaCha20/RSA hybrid encryption -- over bespoke malware.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.004 Remote Services; T1570 Lateral Tool Transfer

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration to Cloud Storage

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1090.003 Multi-hop Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Credential Access

T1110 Brute Force

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft

Resource Development

T1583.003 Acquire Infrastructure; T1583.006 Web Services; T1588.002 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Remediation for Ransomware cartel shared infrastructure

Patches

• SonicWall SonicOS post-7.0.1-5035 (CVE-2024-40766)
• Gladinet CentreStack/Triofox 16.4.10315.56368 (CVE-2025-30406)
• Gladinet CentreStack/Triofox 16.12.10420.56791 (CVE-2025-11371, CVE-2025-14611)

Immediate actions

• Patch SonicWall SonicOS to a build beyond 7.0.1-5035 and force-reset all local SSL VPN account passwords, especially any migrated from Gen5/Gen6 firewalls (CVE-2024-40766)
• Enforce MFA on all SonicWall SSL VPN and other externally exposed VPN/RDP gateways
• Update Gladinet CentreStack/Triofox to 16.12.10420.56791 or later to remediate the hardcoded machineKey (CVE-2025-30406, CVE-2025-14611) and LFI (CVE-2025-11371) exploit chain
• Take internet-facing Gladinet CentreStack/Triofox instances offline or place them behind a VPN/IP allowlist until patched
• Disable direct internet exposure of RDP (TCP/3389); require VPN plus MFA for any remote desktop access
• Hunt for unauthorized installations of AnyDesk, SimpleHelp, and other RMM tools not sanctioned by IT

Workarounds

• Restrict SonicWall SSL VPN and Gladinet CentreStack/Triofox management interfaces to trusted IP allowlists
• Disable unused SSL VPN and legacy local accounts pending credential rotation
• Block outbound connections to known low-reputation VPS ASNs and alert on SOCKS/Tor egress at the perimeter

Longer-term hardening

• Deploy EDR/XDR with behavioral detection tuned for Rclone, Chisel, and Cobalt Strike beacon patterns rather than signature-only AV
• Implement egress filtering and alerting on outbound Tor, SOCKS proxy, and unexpected Cloudflare Worker/Tunnel traffic
• Establish a vulnerability management SLA that prioritizes internet-facing VPN/MFT/firewall appliances against the CISA KEV catalog
• Adopt zero-trust network segmentation to limit lateral movement via RDP/SSH between business units

Affected and fixed versions

• SonicWall — SonicOS (Gen5/Gen6/Gen7 TZ and NSa series SSL VPN)
  Vulnerable versions: Gen5; Gen6; Gen7 7.0.1-5035 and earlier
  Fixed in: Gen7 builds after 7.0.1-5035, with mandatory local password reset
• Gladinet — CentreStack and Triofox
  Vulnerable versions: up to and including 16.1.10296.56315; builds prior to 16.12.10420.56791
  Fixed in: 16.4.10315.56368; 16.12.10420.56791
• Fortinet — FortiGate SSL VPN / FortiClient EMS
  Vulnerable versions: pre-patch builds affected by the FortiBleed credential-theft campaign
  Fixed in: per Fortinet's January 2026 security advisories

Timeline of Ransomware cartel shared infrastructure

Last updated 2026-11-04 · revalidated 1× · latest source

• 2023-04-01 locked-ioc-28 ransomware is first observed in the wild, operating as a closed RaaS using double extortion
• 2024-05-01 locked-ioc-18's source code is reportedly sold for $300,000 on the RAMP underground forum, later forming the basis for the locked-ioc-31 rebrand
• 2024-07-01 Palo Alto Networks Unit 42 identifies locked-ioc-31 ransomware as a rebrand of locked-ioc-18, sharing over 90% of its source code
• 2024-08-23 SonicWall discloses CVE-2024-40766 (CVSS 9.3), an improper access-control flaw where local SSL VPN passwords carried over from Gen5/Gen6 migrations were never reset
• 2024-09-09 CISA adds CVE-2024-40766 to the Known Exploited Vulnerabilities catalog, confirming active exploitation
• 2025-03-01 locked-ioc-16 introduces its Ransomware Cartel model, letting affiliates run independent ransomware brands on locked-ioc-16's backend infrastructure
• 2025-04-03 Gladinet ships CentreStack/Triofox 16.4.10315.56368, fixing the hardcoded machineKey deserialization flaw CVE-2025-30406, which was already under active exploitation
• 2025-07-01 Arctic Wolf observes a sharp uptick in locked-ioc-28 ransomware activity against SonicWall SSL VPN devices, with roughly 40 attacks in July 2025 and some intrusions moving from initial access to full encryption in under an hour
• 2025-10-01 Huntress detects active exploitation of the unauthenticated Gladinet CentreStack/Triofox local file inclusion flaw CVE-2025-11371
• 2025-11-01 CISA adds CVE-2025-11371 to the Known Exploited Vulnerabilities catalog
• 2025-12-01 locked-ioc-30 launches a large-scale data-theft campaign against internet-facing Gladinet CentreStack servers, chaining hardcoded cryptographic keys into ViewState deserialization RCE; Team Cymru identifies five exploitation source IPs across AS396073, AS51852, and AS50049
• 2025-12-15 CISA adds CVE-2025-14611 (Gladinet hardcoded AES key) to the Known Exploited Vulnerabilities catalog, confirming locked-ioc-30's use of the flaw
• 2025-12-19 Curated Intelligence reports the large-scale locked-ioc-30 extortion campaign against Gladinet CentreStack servers, identifying 200+ exposed login portals.
• 2026-02-01 Team Cymru documents a locked-ioc-31 ransomware incident following exploitation of a Fortinet FortiGate appliance, using infrastructure on locked-ioc-23 and the 1VPN commercial VPN service
• 2026-03-01 Team Cymru documents a locked-ioc-13 incident chaining a locked-ioc-27 implant with a locked-ioc-7 to build a reverse locked-ioc-15, spanning AS56694, AS49505, AS50340, and AS62212
• 2026-06-15 FortiBleed is reportedly discovered in mid-June 2026. Per SOCRadar via SecurityWeek, it involves 110M+ credentials from 430,000+ FortiGate firewalls, linked to locked-ioc-18 and locked-ioc-31 operations.
• 2026-07-02 SOCRadar publicly links the FortiBleed mass FortiGate credential-theft campaign (active since at least February 2026, affecting 86,644+ devices across 194 countries) to locked-ioc-18 and locked-ioc-31 ransomware deployments

Update history

• 2026-11-04 — Ransomware Infrastructure Analysis: Shared Tooling and Hosting Patterns Across locked-ioc-28, locked-ioc-16, locked-ioc-30, locked-ioc-13, locked-ioc-29, locked-ioc-18, locked-ioc-31, locked-ioc-21: What changed No severity, exploitability, status or attribution fields change. The record already has HIGH / ACTIVE / ACTIVE. The newer report is a refined restatement of the same Team Cymru analysis, with additional tooling and technique d

Sources cited for Ransomware cartel shared infrastructure

Showing 15 of 20 sources, primary sources first.

• #StopRansomware: Akira Ransomware CISA · Government advisory · 2024-04-18
• CISA Known Exploited Vulnerabilities Catalog - CVE-2024-40766 CISA · Government advisory · 2024-09-09
• #StopRansomware: Medusa Ransomware CISA · Government advisory · 2025-03-12
• Profile: TA505 / CL0P ransomware cyber.gc.ca · Advisory · 2023-01-01
• #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability CISA · Government advisory · 2023-06-07
• Ransomware Infrastructure Analysis team-cymru.com · Research · 2026-04-01
• CVE-2025-30406: Investigating a CVSS Score That Didn't Add Up intruder.io · Research · 2025-04-09
• Lynx Ransomware: A Rebranding of INC Ransomware Unit 42 · Research · 2024-08-01
• DragonForce: a ransomware cartel reinventing RaaS sosransomware.com · Research · 2025-09-01
• Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs arcticwolf.com · Blog · 2025-09-01
• FortiBleed: The Campaign That Cracked 86,644 Firewalls socradar.io · Blog · 2026-07-02
• The Evolution of Qilin RaaS sans.org · Blog · 2025-06-01
• SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers The Hacker News · News · 2025-09-01
• Akira ransomware exploiting critical SonicWall SSLVPN bug again BleepingComputer · News · 2025-07-01
• RCE flaw in MSP-friendly file sharing platform exploited by attackers (CVE-2025-30406) Help Net Security · News · 2025-04-09

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

More from Akira

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• Ransomware Targeting of Backup Infrastructure: Akira/Fog/Frag Exploiting Veeam CVE-2024-40711, Plus CVE-2025-23120 and March 2026 Backup & Replication Flaws (CVE-2026-21666/21667/21708)
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• Akira Ransomware Attack Collapses 158-Year-Old UK Logistics Firm KNP (Knights of Old) After Guessed Employee Password
• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• Akira Ransomware Attack Reconstructed: RDP Access, Procdump Credential Dumping, GOST Tunnel, Rclone Exfiltration

Other reports on CVE-2024-40766

• ThreatsDay Roundup: AI API Key Leaks (OpenCode Console), PingCAP Source Code Theft, Zeabur Breach, NVIDIA AIStore CVE-2026-65162, Signal CVE-2026-113380, Laravel CVE-2026-114509
• #StopRansomware: SafePay Ransomware (CISA AA26-293A) — Exploitation of Cisco ASA/FTD, Veeam B&R and SonicWall SonicOS
• The First 24 Hours of a Ransomware Intrusion: Exfiltration, Credential Theft and Backup Targeting (Akira, REDBIKE, AGENDA)
• Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender
• SEO Poisoning Supply Chain Campaign Distributing Akira Ransomware via Trojanized Enterprise Software
• Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)

Other reports on CVE-2025-30406

• Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)

Previous and next in ransomware

• Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation Previous report
• Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed Next report

Further reading

• Ransomware C2 Hosting Abuse: LockBit, BianLian