Rehub: Russian-Language Ransomware-as-a-Service Marketplace Absorbing RAMP's Displaced Operators

Key facts for Rehub post-RAMP marketplace

Detection coverage for Rehub post-RAMP marketplace

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2532 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ransomware Persistence, Privilege Escalation, and Encryption/Wiper Deployment (DragonForce/Gentlemen/Anubis/LockBit)

Detects the post-exploitation chain used by Rehub-hosted RaaS affiliates to entrench and detonate: scheduled-task and registry-run-key persistence, ADCS/AD enumeration via CertiHound and NetExec, access-token manipulation for privilege escalation, EDR/AV tampering, obfuscated PowerShell, shadow-copy/backup-catalog deletion, and ransomware detonation artifacts (ransom notes, encrypted-file extensions, Anubis's /WIPEMODE destructive parameter).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1053.005, T1547.001, T1574.011, T1134.002, T1562, T1027, T1057, T1059.001, T1485, T1490
• Data sources: windows_security_eventlog, sysmon, windows_system_eventlog
• Severity: critical
• Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698
  TaskContent="*.exe*" OR TaskContent="*powershell*" OR TaskContent="*cmd*"
| eval technique="T1053.005", stage="post-exploitation"
``` new scheduled task registered for payload execution/persistence ```
| append
    [ search index=wineventlog sourcetype="WinEventLog:Sysmon" EventCode=13
        TargetObject="*\\CurrentVersion\\Run\\*"
      | eval technique="T1547.001", stage="post-exploitation" ]
| append
    [ search index=wineventlog sourcetype="WinEventLog:Sysmon" EventCode=1
        (Image="*CertiHound*" OR Image="*netexec*" OR Image="*nxc.exe*" OR CommandLine="*--shares*" OR CommandLine="*--sam*" OR CommandLine="*certipy*")
      | eval technique="T1574.011,T1057", stage="post-exploitation"
      ``` The Gentlemen ADCS abuse (CertiHound) and AD/network enumeration (NetExec) ``` ]
| append
    [ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688
        CommandLine="*-EncodedCommand*"
      | eval technique="T1059.001,T1027", stage="post-exploitation" ]
| append
    [ search index=wineventlog sourcetype="WinEventLog:System" EventCode IN (7036,7040)
        ServiceName IN ("WinDefend","Sense","wuauserv") State="Stopped"
      | eval technique="T1562", stage="post-exploitation"
      ``` defense-impairment / EDR-Sense service tampering common to T1562 abuse across DragonForce/Gentlemen/CHAOS ``` ]
| append
    [ search index=wineventlog sourcetype="WinEventLog:Sysmon" EventCode=11
        (TargetFilename="*.dragonforce_encrypted" OR TargetFilename="*.anubis.*" OR TargetFilename="*README-GENTLEMEN.txt" OR TargetFilename="*gentlemen.bmp" OR TargetFilename="*RESTORE FILES.html")
      | eval technique="T1485,T1490", stage="post-exploitation"
      ``` ransom note / encrypted-extension detonation artifacts ``` ]
| append
    [ search index=wineventlog sourcetype="WinEventLog:Sysmon" EventCode=1
        CommandLine="*/WIPEMODE*"
      | eval technique="T1485", stage="post-exploitation"
      ``` Anubis destructive wiper flag ``` ]
| append
    [ search index=wineventlog sourcetype="WinEventLog:Sysmon" EventCode=1
        (CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wbadmin*delete*catalog*" OR CommandLine="*bcdedit*recoveryenabled*no*")
      | eval technique="T1490", stage="post-exploitation" ]
| table _time, host, user, Image, CommandLine, TargetFilename, technique, stage
| sort -_time

Microsoft KQL

let ScheduledTaskPersistence = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has_any ("/create", "/ru SYSTEM")
| extend Technique = "T1053.005";
let RegistryRunKeyPersistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"\CurrentVersion\Run" and ActionType == "RegistryValueSet"
| extend Technique = "T1547.001";
let ADCSAbuseRecon = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any ("CertiHound", "netexec", "nxc.exe") or ProcessCommandLine has_any ("--shares","--sam","certipy")
| extend Technique = "T1574.011,T1057";
let ObfuscatedPowerShell = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "powershell.exe" and ProcessCommandLine has "-EncodedCommand"
| extend Technique = "T1059.001,T1027";
let DefenseImpairment = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("AntivirusDisabled","ServiceStopped") and AdditionalFields has_any ("WinDefend","Sense")
| extend Technique = "T1562";
let RansomwareArtifacts = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName has_any (".dragonforce_encrypted", ".anubis.", "README-GENTLEMEN.txt", "gentlemen.bmp", "RESTORE FILES.html")
| extend Technique = "T1485,T1490";
let WipeModeCommand = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "/WIPEMODE"
| extend Technique = "T1485";
let ShadowCopyDeletion = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("vssadmin.exe","wbadmin.exe","bcdedit.exe") and ProcessCommandLine has_any ("delete shadows","delete catalog","recoveryenabled no")
| extend Technique = "T1490";
ScheduledTaskPersistence
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Technique
| union (RegistryRunKeyPersistence | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Technique)
| union (ADCSAbuseRecon | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Technique)
| union (ObfuscatedPowerShell | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Technique)
| union (DefenseImpairment | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Technique)
| union (RansomwareArtifacts | project Timestamp, DeviceName, AccountName=RequestAccountName, Technique)
| union (WipeModeCommand | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Technique)
| union (ShadowCopyDeletion | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Technique)
| sort by Timestamp desc

Sigma

title: Ransomware Persistence, Defense Evasion, and Encryption/Wiper Deployment (DragonForce/Gentlemen/Anubis/LockBit)
id: ad4b5f73-7c3e-4eaf-cf6b-4c5d6e7f8091
status: experimental
description: Detects the post-exploitation chain used by Rehub-hosted RaaS affiliates (DragonForce, The Gentlemen, Anubis, LockBit) — scheduled-task and registry-run-key persistence, ADCS/AD enumeration tooling (CertiHound, NetExec), obfuscated PowerShell, EDR/AV tampering, and ransomware detonation artifacts including Anubis's /WIPEMODE destructive parameter.
references:
  - https://flashpoint.io/blog/understanding-illicit-ecosystems-inside-rehub-ransomware-marketplace/
  - https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-16
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-evasion
  - attack.impact
  - attack.t1053.005
  - attack.t1547.001
  - attack.t1574.011
  - attack.t1134.002
  - attack.t1562
  - attack.t1027
  - attack.t1057
  - attack.t1059.001
  - attack.t1485
  - attack.t1490
  - attack.tool.certihound
  - attack.tool.netexec
logsource:
  category: process_creation
  product: windows
detection:
  selection_wipemode:
    CommandLine|contains: '/WIPEMODE'
  selection_shadowdelete:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'delete catalog'
  selection_adtools:
    Image|contains:
      - 'CertiHound'
      - 'netexec'
      - 'nxc.exe'
  selection_encodedps:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-EncodedCommand'
  condition: 1 of selection_*
falsepositives:
  - Authorized backup/DR shadow-copy maintenance windows
  - Legitimate AD security-assessment or red-team engagements using the same tooling
  - Scripted administrative PowerShell that legitimately uses encoded commands
level: critical

Known false positives:

• Authorized backup/DR jobs deleting stale shadow copies
• Legitimate AD security-assessment/pentest engagements running CertiHound or NetExec
• IT-scripted administrative PowerShell using -EncodedCommand
• Planned EDR maintenance windows stopping WinDefend/Sense services

Tuning notes: Correlate the individual sub-searches with a short time window (e.g. 30 minutes) and require 2+ distinct techniques on the same host before high-severity alerting to suppress isolated benign admin activity; allowlist known red-team CertiHound/NetExec engagement windows.

• 🔒 Rehub RaaS Initial-Access Exploitation Chain — FortiOS/Erlang-OTP/NTLM-Relay · unlock with TL Creds
• 🔒 Ransomware Persistence, Privilege Escalation, and Encryption/Wiper Deployment (DragonForce/Gentlemen/Anubis/LockBit) · unlock with TL Creds
• 🔒 DragonForce C2 Beaconing, Tor Leak-Site/Forum Communication, and NTLM-Relay Lateral Movement · unlock with TL Creds
• 🔒 Rehub RaaS Initial-Access Exploitation Chain — FortiOS/Erlang-OTP/NTLM-Relay · unlock with TL Creds
• 🔒 Ransomware Detonation Artifacts — Anubis /WIPEMODE and DragonForce/Gentlemen Ransom Notes · unlock with TL Creds
• 🔒 DragonForce C2 Beaconing, Tor Leak-Site/Forum Communication, and NTLM-Relay Lateral Movement · unlock with TL Creds
• 🔒 Rehub RaaS Initial-Access Exploitation Chain — FortiOS/Erlang-OTP/NTLM-Relay · unlock with TL Creds
• 🔒 DragonForce C2 Beaconing, Tor Leak-Site/Forum Communication, and NTLM-Relay Lateral Movement · unlock with TL Creds

Indicators of compromise for Rehub post-RAMP marketplace

As of 2026-09-16, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2532.

Sample indicators (3 of 29)

• IP address: 2.147.68[.]96
• Domain: ramp4u[.]io
• File hash: b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration for Rehub post-RAMP marketplace

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Rehub post-RAMP marketplace works

It now hosts multiple active RaaS programs -- DragonForce (assessed primary sponsor), The Gentlemen, CHAOS, Anubis, LockBit, and DevMan -- alongside initial-access brokerage, carding, and AI-enabled fraud discussion.

Rehub emerged from the collapse of the two-decade Russian-language cybercrime forum ecosystem. XSS.is, the dominant forum since the DaMaGeLaB era, was seized on July 22-23, 2025 by French and Ukrainian police (Operation Ratatouille, led by JUNALCO with SBU support) after a four-year investigation, resulting in the arrest of a 38-year-old administrator in Kyiv who Europol says earned over EUR 7 million as a trusted escrow middleman. Former XSS moderators launched a successor forum, DamageLib, on August 1, 2025, retaining roughly two-thirds of XSS's ~50,000 membership but with markedly lower engagement, amid member suspicion that the admin handle may be law-enforcement-controlled. A separate former XSS moderator launched Rehub (ReHubCom) on August 10, 2025 as a lower-friction, structured marketplace with tiered paid membership (free entry under a zero-trust policy added mid-April 2026; Premium/Gold at $100/year; Patron/Pink at $5,000/year) and dedicated forum sections for technical discussion, programming, a leaked-data/utility library, a 'Supermarket' for ransomware affiliate programs and stolen financial data, and an arbitration system with a scammer black list.

Rehub's significance sharpened after the FBI, working with the U.S. Attorney's Office for the Southern District of Florida and DOJ CCIPS, seized the RAMP (RAMP4U, ramp4u.io) forum's clearnet and Tor infrastructure on January 28, 2026. RAMP had operated since July 12, 2021 -- founded by Mikhail Matveev ('Orange') from the remnants of the Babuk operation and later run by an administrator using the handle 'Stallman' -- as a dedicated safe haven for ransomware discussion after XSS and Exploit.in banned it post-Colonial Pipeline, hosting Conti, ALPHV/BlackCat, Qilin, RansomHub, AvosLocker, and other affiliate programs plus access brokers selling government and critical-infrastructure network entry. The seizure gave the FBI access to member emails, IPs, and private messages, and rather than consolidating around one successor, displaced operators fragmented across two platform types: T1erOne, a gated forum requiring reputation vetting or a ~$450-500 entry fee that emerged in early February 2026, and Rehub, whose lower barrier to entry absorbed affiliates, initial-access brokers, and general forum regulars. DragonForce joined Rehub the same day RAMP went dark, an opportunistic migration; LockBit and The Gentlemen had maintained a presence on Rehub since September 2025, predating the RAMP disruption.

By July 2026, Flashpoint assessed Rehub at over 8,300 active users, ~15,000 posts, and nearly 3,000 threads, with DragonForce holding a permanent home-page banner as the forum's primary sponsor or partner. The other RaaS operations advertised on the forum are independently well-documented and dangerous: DragonForce (RaaS since late 2023, built on leaked LockBit 3.0/Conti code, 645+ claimed victims across 65 countries by end of August 2026, and a Go-based Microsoft-Teams-relay backdoor named Backdoor.Turn); The Gentlemen (active since July 2025, the most active RaaS operation of Q2 2026 with ~332 published victims in the first five months of the year, exploiting FortiOS and Erlang/OTP SSH CVEs and NTLM relay for initial access/lateral movement, using a large offensive tool suite including NetExec, CertiHound, and MANSPIDER, and suffering its own backend 'Rocket Database' leak in May 2026 that exposed admin and affiliate TOX IDs); CHAOS (assessed with moderate confidence to be operated by former BlackSuit/Royal members, using email-bombing and Quick-Assist vishing for initial access, RMM tools for persistence, and GoodSync disguised as a legitimate binary for exfiltration); Anubis (RaaS since December 2024 offering encryption, data-theft-only, or hybrid extortion splits, notable for an optional /WIPEMODE destructive wiper that zeroes file contents beyond recovery); LockBit (revived as LockBit 5.0 in September 2025 post-Operation Cronos, cross-platform Windows/Linux/ESXi payloads, 335+ claimed victims across 68 countries by August 2026); and DevMan (emerged April 2025 from the DragonForce/Conti lineage, a closed multi-RaaS-affiliate operation targeting APAC/African mid-market and critical-infrastructure organizations, 116+ compromised organizations). Beyond ransomware, the hunt rationale notes Rehub's Technical section hosts AI-jailbreaking and deepfake social-engineering discussion, and its Supermarket section trades network access, carding data, and forged documents -- positioning the forum as general-purpose criminal infrastructure rather than a single-actor threat. For defenders, Rehub itself is not an intrusion vector; its significance is as durable coordination infrastructure that keeps the affiliate pool, tooling, and initial-access supply chain feeding into DragonForce, The Gentlemen, CHAOS, Anubis, LockBit, and DevMan intrusions operational despite law-enforcement pressure on RAMP and XSS.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Stealth

T1027 Obfuscated Files or Information

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Discovery

T1057 Process Discovery

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment

Privilege Escalation

T1134.002 Create Process with Token

Impact

T1485 Data Destruction; T1490 Inhibit System Recovery

stealth

T1574.011 Services Registry Permissions Weakness

defense-impairment

T1685 Disable or Modify Tools

Remediation for Rehub post-RAMP marketplace

Patches

• Apply Fortinet patches for CVE-2024-55591 (FortiOS/FortiProxy authentication bypass)
• Apply Erlang/OTP patches for CVE-2025-32433 (SSH pre-authentication RCE)
• Apply Microsoft guidance/patches mitigating CVE-2025-33073 (NTLM reflection/relay)

Immediate actions

• Block known DragonForce C2 IPs and Tor leak-site domains at perimeter/DNS layer
• Subscribe to dark-web forum monitoring for Rehub, T1erOne, and DamageLib chatter referencing your sector or vendors
• Hunt for Anubis's /WIPEMODE and /KEY= command-line parameters in EDR telemetry
• Audit and restrict RMM tool installs (AnyDesk, ScreenConnect, Syncro, Splashtop) to an allowlist; alert on new/unexpected installs

Workarounds

• Disable or restrict external RDP/VPN exposure (T1133) where MFA cannot be enforced
• Restrict PowerShell execution policy and enable script-block logging to catch T1059.001 abuse
• Enforce MFA and conditional access on all valid-account (T1078) remote access paths

Longer-term hardening

• Deploy EDR with tamper protection against T1562 Impair Defenses techniques used across DragonForce/Gentlemen/CHAOS intrusions
• Implement NTLM relay mitigations (SMB/LDAP signing, EPA) given The Gentlemen's use of CVE-2025-33073
• Harden Active Directory Certificate Services against CertiHound/ADCS abuse
• Establish immutable, offline backups resilient to both encryption (T1486) and destructive wiping (T1485)

Timeline of Rehub post-RAMP marketplace

• 2021-07-12 RAMP (Russian Anonymous Marketplace) forum founded by Mikhail Matveev ('Orange') from the infrastructure of the defunct Babuk operation, as a dedicated ransomware-discussion safe haven after XSS and Exploit.in banned the topic.
• 2025-07-22 French and Ukrainian police (Operation Ratatouille, JUNALCO with SBU) seize XSS.is and arrest a 38-year-old administrator in Kyiv after a four-year investigation; Europol estimates the suspect earned over EUR 7 million as an escrow middleman.
• 2025-08-01 Former XSS moderators launch locked-ioc-17 as a Tor-based successor forum, retaining roughly two-thirds of XSS's ~50,000 membership but with markedly lower engagement.
• 2025-08-10 Rehub (ReHubCom) founded by a separate former XSS moderator as a lower-friction, structured Russian-language marketplace for ransomware programs and stolen data.
• 2025-09-01 locked-ioc-22 and locked-ioc-12 establish an existing presence on Rehub, predating the RAMP forum disruption.
• 2026-01-28 FBI, with the U.S. Attorney's Office (SDFL) and DOJ CCIPS, seizes the RAMP forum's clearnet (locked-ioc-16) and Tor infrastructure; locked-ioc-14 joins Rehub the same day in an opportunistic migration.
• 2026-02-01 locked-ioc-25 emerges as a gated, reputation- or payment-vetted successor forum, positioning itself as an explicit ransomware-permissive alternative to Rehub's lower barrier to entry.
• 2026-04-15 Rehub implements a zero-trust registration policy for free-tier entry, alongside its existing $100/year Premium and $5,000/year Patron paid membership tiers.
• 2026-05-01 locked-ioc-12's backend infrastructure ('Rocket Database') is breached and partially leaked (~16.22 GB claimed, ~44.4 MB obtained), exposing admin/affiliate TOX IDs and internal coordination channels; offered for sale by broker 'n7778' for $10,000.
• 2026-07-21 Flashpoint publishes 'Understanding Illicit Ecosystems: Inside Rehub Ransomware Marketplace,' assessing Rehub at 8,300+ active users, ~15,000 posts, and locked-ioc-14 as primary sponsor, hosting locked-ioc-12, locked-ioc-29, locked-ioc-26, locked-ioc-22, and locked-ioc-27.

Sources cited for Rehub post-RAMP marketplace

• The Rise and Fall of RAMP: Inside the Forum Where Ransomware Was Always Welcome cloudsek.com · Research · 2026-03-01
• The Post-RAMP Era: Allegations, Fragmentation, and the Rebuilding of the Ransomware Underground Rapid7 · Research · 2026-02-15
• XSS Forum After Takedown: DamageLib Emerges kelacyber.com · Research · 2025-08-27
• Thus Spoke...The Gentlemen Check Point Research · Research · 2026-06-01
• DragonForce Ransomware Attack Analysis - Targets, TTPs and IoCs cybersecuritynews.com · Research · 2026-03-01
• Chaos Ransomware: RaaS Resurgence & Detection attackiq.com · Research · 2026-07-16
• Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper Trend Micro · Research · 2025-06-01
• Understanding Illicit Ecosystems: Inside Rehub Ransomware Marketplace flashpoint.io · Blog · 2026-07-21
• Darknet forum RAMP4U seized by FBI darkowl.com · Blog · 2026-01-29
• FBI Seizes RAMP Cybercrime Forum Used By Ransomware Gangs BleepingComputer · News · 2026-01-28

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

Other reports on CVE-2024-55591

• Ransomware Surge in Q3 2026: The Gentlemen Overtakes Qilin as Rival Gangs Compete for Market Share
• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• Japan October 2026 Data Breach Surge: Web/API Compromises, Supplier Breaches, IDC Frontier Ransomware and AI-Assisted Probing (ARTEX)
• Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and GPO-Based Mass Deployment
• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• Q3 2026 Record Ransomware Surge: 2,627 Claimed Attacks, Qilin and The Gentlemen Lead, Clop Resurgence via PTC Windchill CVE-2026-12569

Other reports on CVE-2025-32433

• The Gentlemen RaaS (GOLD SHERWOOD / hastalamuerte): FortiGate/VPN Intrusion Chain, GentleKiller BYOVD EDR Killers, and Rclone Exfiltration
• The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts
• The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
• Q1 2026 Ransomware Landscape: Qilin Dominance, LockBit 5.0 Comeback, and FortiGate (CVE-2024-55591) / Oracle EBS (CVE-2025-61882) Mass Exploitation

Previous and next in threat intel

• VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft Previous report
• FBI, DOJ, and RCMP Seize NightmareStresser DDoS-for-Hire Domains in Latest Operation PowerOFF Action Next report