France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months

Key facts for France cyber threat outlook

Detection coverage for France cyber threat outlook

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2564 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LSASS Credential Dumping and Password Store Access — Ransomware Post-Exploitation

Detects process access to lsass.exe memory with credential-dumping-grade access rights and access to browser/OS password store files, matching Qilin's (S1242) documented LSASS credential dumping technique used during post-exploitation prior to lateral movement and double-extortion encryption.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1555
• Data sources: sysmon, windows_security, endpoint_edr_process_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1410", "0x147a", "0x1438", "0x1fffff")
NOT SourceImage IN ("*\\MsMpEng.exe", "*\\ProcExp*.exe", "*\\Taskmgr.exe")
| stats count values(GrantedAccess) as access_rights by Computer, SourceImage, TargetImage
| append
    [ search index=sysmon EventCode=11
      TargetFilename IN ("*\\AppData\\Local\\Google\\Chrome\\User Data\\*\\Login Data", "*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*\\logins.json", "*\\ntds.dit")
      | stats count by Computer, Image, TargetFilename ]
| sort -count

Microsoft KQL

DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType == "ProcessAccessedByLsass" or (ActionType == "ProcessAccess" and TargetProcessFileName =~ "lsass.exe")
| where GrantedAccess in ("0x1010", "0x1410", "0x147a", "0x1438", "0x1fffff")
| summarize AccessCount=count() by DeviceName, InitiatingProcessFileName, GrantedAccess
| union (
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FileName in~ ("Login Data", "logins.json", "ntds.dit")
    | project DeviceName, InitiatingProcessFileName, FileName
)
| order by AccessCount desc

Sigma

title: LSASS Memory Access With Credential Dumping Access Rights
id: 4f8b1c7e-2a6d-4b3f-9e0c-7a1d5f8c2b44
status: experimental
description: Detects processes requesting known credential-dumping access rights to lsass.exe, matching Qilin ransomware (S1242) and generic Mimikatz-style LSASS credential dumping behavior used prior to double-extortion encryption
references:
  - https://attack.mitre.org/software/S1242/
  - https://attack.mitre.org/techniques/T1003/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-18
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.t1555
  - attack.tool.mimikatz
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1410'
      - '0x147a'
      - '0x1438'
      - '0x1fffff'
  filter:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\Taskmgr.exe'
  condition: selection and not filter
falsepositives:
  - Endpoint protection or diagnostic tools performing legitimate LSASS inspection
level: critical

Known false positives:

• Endpoint protection, backup, or diagnostic agents performing legitimate LSASS memory inspection (exclude by verified vendor process)

Tuning notes: Maintain an allow-list of verified EDR/AV vendor processes that legitimately touch lsass.exe; alert immediately (do not batch) given this is a high-confidence pre-ransomware indicator.

• 🔒 RDP/VNC Brute-Force and Password-Spray Against Internet-Exposed Remote Services · unlock with TL Creds
• 🔒 Malicious PowerShell Execution for Ransomware Propagation and Safe-Mode Defense Evasion · unlock with TL Creds
• 🔒 High-Volume Exfiltration to Cloud File-Sharing and Telegram Prior to Extortion · unlock with TL Creds
• 🔒 Spearphishing Attachment Spawning Command Interpreter — Initial Access · unlock with TL Creds
• 🔒 Shadow Copy and Backup Deletion Preceding Ransomware Encryption · unlock with TL Creds
• 🔒 Unauthorized External VNC Access to OT/HMI/CCTV Interfaces — Lateral Movement and Defacement Precursor · unlock with TL Creds
• 🔒 Public-Facing Web Application SQL Injection Exploitation Attempt · unlock with TL Creds
• 🔒 DDoSia Volumetric Flood Against Public-Facing Government/Critical-Infrastructure Web Infrastructure · unlock with TL Creds

Indicators of compromise for France cyber threat outlook

As of 2026-09-18, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2564.

Sample indicators (3 of 24)

• Domain: classic-days[.]fr
• Domain: monlogicielmedical[.]com
• Domain: pointenergy31[.]fr

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How France cyber threat outlook works

CloudSEK's "France Cyber Threat Outlook" report (published 2026-07-23, authors Abhishek Mathew and Prajwal Awasthi) analyzes 24 months of France-tagged dark web activity, finding roughly 17,800 total items across leaks, credential dumps, ransomware advisories, and hacktivist claims. Monthly volume held under 350 items through most of 2024, climbed steadily through 2025, roughly doubled between June and December 2025, and peaked above 1,400 items/month in January 2026 before plateauing above 1,000/month through spring 2026 -- an overall 4x baseline increase. Government (1,652 items), financial services (1,594), technology (1,491), telecommunications (1,480), and email (1,427) were the most-tagged sectors; account credentials and credential collections were the dominant data types (4,447 and 4,360 items respectively).

The ransomware track is dominated by RaaS groups repeatedly targeting under-resourced French local government bodies. Qilin (aka Agenda) posted 8 separate leak-site advisories re-listing the same victim, Commune d'Eyguieres, between 20-21 June 2026 -- a pressure/sustained-extortion pattern rather than eight distinct intrusions. MedusaLocker claimed an attack on Mairie Thiverval-Grignon, extracting 162 email addresses from the municipal administration. LockBit maintains a recurring, cross-sector opportunistic presence in France. Per CISA/FBI/Treasury/FinCEN joint advisory AA22-181A, MedusaLocker actors gain initial access via vulnerable RDP configurations and phishing, use a batch file to trigger a malicious PowerShell script for network propagation, and inhibit recovery by deleting shadow copies and backups before encryption. Qilin's documented technique set (MITRE ATT&CK software S1242) spans phishing and public-facing application exploitation for initial access, LSASS credential dumping, PowerShell/Windows Command Shell execution, and double-extortion data encryption.

The hacktivist track is led by NoName057(16), a pro-Russian group assessed by CISA (advisory AA25-343A) to have originated as a covert project within the Kremlin-linked Centre for the Study and Network Monitoring of the Youth Environment (CISM). Running its #BrokenByte campaign explicitly tied to France's support for Ukraine, the group claimed DDoS attacks against French drone manufacturers Xsun France and iDrone, against the Ministries of Economy, Justice, Finance, and Interior plus the Civil Aviation Authority and National Reception Office, and claimed unauthorized CCTV/video-surveillance access at the Musee National de l'Automobile (Mulhouse) and a Renault/Dacia dealership (Groupe GGP, Orange), framing the latter as part of a "special military operation in cyberspace." NoName057(16) coordinates its crowdsourced, cryptocurrency-incentivized DDoS tool DDoSia via Telegram; CISA's advisory further documents the wider pro-Russia hacktivist ecosystem (CARR, Z-Pentest, Sector16) scanning for and brute-forcing internet-exposed VNC services (port 5900+) to access OT/HMI interfaces at critical-infrastructure operators.

Commodity infostealer-driven credential resale accounts for the bulk of the volume increase rather than targeted campaigns: dark web actors SKYNET (635 France-tagged postings) and WhiteMelly (614) lead bulk PII/credential sale and leak distribution; actor 587306 sold ~2 million records described as belonging to French women for $399 via Mega; actor Saturne disclosed an 11GB Classic-Days.fr database (plaintext passwords, source code) exposed through an unsecured Apache directory listing with SQL injection attempts dating to 2024; and actor HiddenHq claimed a 1 billion+ record, 2.3TB dataset allegedly sourced via a Salesforce-linked supply-chain breach affecting 36 companies. Separately, Cegedim Sante's MonLogicielMedical.com platform exposed administrative data on ~15 million French patients.

The surge coincides with escalating French regulatory enforcement: CNIL fined Free Mobile/Free a combined EUR 42 million in January 2026 over a 2024 breach exposing 24.6 million subscriber contracts, and fined France Travail EUR 5 million over a breach exposing up to 43 million job seekers -- the largest breach in French history by record count. Under GDPR Article 33, breaches must be reported to CNIL within 72 hours; 2024 alone saw over 5,600 breach notifications covering more than 145 million records of French residents.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1110.003 Password Spraying; T1555 Credentials from Password Stores

Lateral Movement

T1021.005 VNC

Execution

T1059.001 PowerShell

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment

Impact

T1490 Inhibit System Recovery; T1491.001 Internal Defacement; T1498.001 Direct Network Flood; T1657 Financial Theft

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Resource Development

T1583.003 Virtual Private Server

Reconnaissance

T1591 Gather Victim Org Information; T1595.002 Vulnerability Scanning

defense-impairment

T1688 Safe Mode Boot

Remediation for France cyber threat outlook

Patches

• No CVE or vendor patch applies to this multi-actor threat landscape report; mitigation is configuration- and process-based (RDP/VNC exposure reduction, credential hygiene, backup resilience, input validation against SQL injection)

Immediate actions

• Disable or restrict internet-facing RDP and VNC services; where required, enforce MFA and source-IP allow-listing (per CISA AA22-181A and AA25-343A)
• Rotate credentials and audit for default, weak, or reused passwords on any internet-accessible remote administration or OT/HMI interface
• Remediate exposed directory listings and SQL injection vectors on public-facing web/e-commerce applications (per the Classic-Days.fr breach root cause)

Workarounds

• Restrict RDP/VNC access to VPN-only connections with MFA enforced; disable direct internet exposure of HMI, CCTV, and other OT-adjacent interfaces per CISA AA25-343A guidance

Longer-term hardening

• Maintain offline, immutable, and tested backups to blunt ransomware double-extortion leverage from Qilin and MedusaLocker
• Deploy DDoS mitigation/scrubbing and CDN protection for public-facing government and critical-infrastructure sites against DDoSia-style volumetric floods (T1498.001)
• Segment OT/ICS and physical-security (CCTV/video surveillance) networks from IT and the public internet; remove default credentials from HMI and camera systems

Affected and fixed versions

• Commune d'Eyguieres — Municipal administrative network
  Vulnerable versions: Qilin ransomware target, 8 advisories 20-21 June 2026
• Mairie Thiverval-Grignon — Municipal administrative network
  Vulnerable versions: MedusaLocker ransomware target, 162 emails extracted
• Xsun France / iDrone — Corporate web infrastructure
  Vulnerable versions: NoName057(16) #BrokenByte DDoS target
• Musee National de l'Automobile — CCTV / video surveillance system
  Vulnerable versions: Unauthorized access claimed by NoName057(16)
• Groupe GGP (Renault/Dacia dealership, Orange) — Video surveillance and internal client-data systems
  Vulnerable versions: Unauthorized access claimed by NoName057(16)
• French government ministries (Economy, Justice, Finance, Interior); Civil Aviation Authority; National Reception Office — Public-facing web infrastructure
  Vulnerable versions: DDoS target of NoName057(16) via DDoSia
• Cegedim Sante — MonLogicielMedical.com medical practice software
  Vulnerable versions: ~15 million French patient administrative records exposed
• Classic-Days.fr — E-commerce web application
  Vulnerable versions: Exposed Apache directory listing; SQL injection attempts since 2024; 11GB database breach June 2026

Timeline of France cyber threat outlook

• 2024-07-01 CloudSEK's monitoring window begins with France-tagged dark web activity under 300 items/month (mid-2024 baseline).
• 2024-12-31 CY2024 closes with over 5,600 breach notifications to CNIL, covering more than 145 million records belonging to French residents.
• 2025-12-01 France-tagged dark web volume roughly doubles between June 2025 and December 2025 per CloudSEK's monthly trend data.
• 2026-01-01 CNIL fines locked-ioc-9 EUR 5 million over a breach exposing up to 43 million job seekers' data, the largest breach in French history by record count.
• 2026-01-01 CNIL fines Free Mobile/Free a combined EUR 42 million for inadequate security measures contributing to a 2024 breach exposing 24.6 million subscriber contracts.
• 2026-01-31 France-tagged dark web activity peaks above 1,400 items/month, the highest point in CloudSEK's 24-month dataset.
• 2026-04-01 Volume plateaus above 1,000 items/month through spring 2026, holding well above the mid-2024 baseline.
• 2026-06-01 Dark web actor locked-ioc-18 discloses an 11GB locked-ioc-8 database breach (plaintext passwords, activation keys, internal source code) traced to an exposed Apache directory listing with SQL injection attempts dating back to 2024.
• 2026-06-20 locked-ioc-23 begins re-listing locked-ioc-5 across at least 8 separate ransomware leak-site advisory postings, continuing through 2026-06-21.
• 2026-07-23 CloudSEK publishes the "France Cyber Threat Outlook: Dark Web, Ransomware & Hacktivism Report," documenting the full 24-month trend.

Sources cited for France cyber threat outlook

• Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure (AA25-343A) CISA · Advisory · 2025-12-09
• #StopRansomware: MedusaLocker (AA22-181A) CISA · Advisory · 2022-06-30
• MedusaLocker - JOINT CYBERSECURITY ADVISORY (PDF) CISA · Advisory · 2022-06-30
• Qilin, Software S1242 MITRE · Research · 2026-01-01
• Noname057(16) en.wikipedia.org · Research · 2026-01-01
• Qilin Ransomware Analysis: Critical TTPs and Defense picussecurity.com · Blog · 2026-01-01
• Unmasking NoName057(16): Botnets, DDoSia, and NATO cybelangel.com · Blog · 2026-01-01
• France Cyber Threat Outlook: Dark Web, Ransomware & Hacktivism Report cloudsek.com · Report · 2026-07-23

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

Related coverage of this activity

• Qilin LockBit France ransomware

More from Qilin

• October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• Qilin (Agenda) Ransomware: ESXi/vCenter Targeting, Affiliate Networks and Double Extortion
• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• Bitdefender Threat Debrief June 2026: Ransomware Landscape (Qilin, The Gentlemen, DragonForce, KryBit) and Actively Exploited SolarWinds Serv-U Flaw CVE-2026-28318
• Ransomware Gangs Escalate to Personal Threats Against Employees and Families; Identity Infrastructure (AD/Entra ID/Okta) Targeted

Previous and next in threat intel

• FBI, DOJ, and RCMP Seize NightmareStresser DDoS-for-Hire Domains in Latest Operation PowerOFF Action Previous report
• LLM-Driven Reverse Engineering of Palo Alto Cortex XDR Yields Working EDR Evasion (SpecterOps) Next report

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors