# France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months

> CloudSEK's 24-month dark web monitoring of France-tagged activity (mid-2024 to spring 2026) documents a 4x rise in leaks, credential dumps, ransomware advisories, and hacktivist claims, peaking above 1,400 items/month in January 2026 (~17,800 items total). Qilin and MedusaLocker ransomware repeatedly hit under-resourced French municipalities, while pro-Russian hacktivist group NoName057(16) ran a sustained #BrokenByte DDoS/access-claim campaign tied to France's support for Ukraine, alongside commodity infostealer credential resale driving the bulk of volume.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2564
- **ID:** TL-2026-2564
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CloudSEK's "France Cyber Threat Outlook" report (published 2026-07-23, authors Abhishek Mathew and Prajwal Awasthi) analyzes 24 months of France-tagged dark web activity, finding roughly 17,800 total items across leaks, credential dumps, ransomware advisories, and hacktivist claims. Monthly volume held under 350 items through most of 2024, climbed steadily through 2025, roughly doubled between June and December 2025, and peaked above 1,400 items/month in January 2026 before plateauing above 1,000/month through spring 2026 -- an overall 4x baseline increase. Government (1,652 items), financial services (1,594), technology (1,491), telecommunications (1,480), and email (1,427) were the most-tagged sectors; account credentials and credential collections were the dominant data types (4,447 and 4,360 items respectively).

The ransomware track is dominated by RaaS groups repeatedly targeting under-resourced French local government bodies. Qilin (aka Agenda) posted 8 separate leak-site advisories re-listing the same victim, Commune d'Eyguieres, between 20-21 June 2026 -- a pressure/sustained-extortion pattern rather than eight distinct intrusions. MedusaLocker claimed an attack on Mairie Thiverval-Grignon, extracting 162 email addresses from the municipal administration. LockBit maintains a recurring, cross-sector opportunistic presence in France. Per CISA/FBI/Treasury/FinCEN joint advisory AA22-181A, MedusaLocker actors gain initial access via vulnerable RDP configurations and phishing, use a batch file to trigger a malicious PowerShell script for network propagation, and inhibit recovery by deleting shadow copies and backups before encryption. Qilin's documented technique set (MITRE ATT&CK software S1242) spans phishing and public-facing application exploitation for initial access, LSASS credential dumping, PowerShell/Windows Command Shell execution, and double-extortion data encryption.

The hacktivist track is led by NoName057(16), a pro-Russian group assessed by CISA (advisory AA25-343A) to have originated as a covert project within the Kremlin-linked Centre for the Study and Network Monitoring of the Youth Environment (CISM). Running its #BrokenByte campaign explicitly tied to France's support for Ukraine, the group claimed DDoS attacks against French drone manufacturers Xsun France and iDrone, against the Ministries of Economy, Justice, Finance, and Interior plus the Civil Aviation Authority and National Reception Office, and claimed unauthorized CCTV/video-surveillance access at the Musee National de l'Automobile (Mulhouse) and a Renault/Dacia dealership (Groupe GGP, Orange), framing the latter as part of a "special military operation in cyberspace." NoName057(16) coordinates its crowdsourced, cryptocurrency-incentivized DDoS tool DDoSia via Telegram; CISA's advisory further documents the wider pro-Russia hacktivist ecosystem (CARR, Z-Pentest, Sector16) scanning for and brute-forcing internet-exposed VNC services (port 5900+) to access OT/HMI interfaces at critical-infrastructure operators.

Commodity infostealer-driven credential resale accounts for the bulk of the volume increase rather than targeted campaigns: dark web actors SKYNET (635 France-tagged postings) and WhiteMelly (614) lead bulk PII/credential sale and leak distribution; actor 587306 sold ~2 million records described as belonging to French women for $399 via Mega; actor Saturne disclosed an 11GB Classic-Days.fr database (plaintext passwords, source code) exposed through an unsecured Apache directory listing with SQL injection attempts dating to 2024; and actor HiddenHq claimed a 1 billion+ record, 2.3TB dataset allegedly sourced via a Salesforce-linked supply-chain breach affecting 36 companies. Separately, Cegedim Sante's MonLogicielMedical.com platform exposed administrative data on ~15 million French patients.

The surge coincides with escalating French regulatory enforcement: CNIL fined Free Mobile/Free a combined EUR 42 million in January 2026 over a 2024 breach exposing 24.6 million subscriber contracts, and fined France Travail EUR 5 million over a breach exposing up to 43 million job seekers -- the largest breach in French history by record count. Under GDPR Article 33, breaches must be reported to CNIL within 72 hours; 2024 alone saw over 5,600 breach notifications covering more than 145 million records of French residents.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1595.002 Vulnerability Scanning
- T1583.003 Virtual Private Server
- T1566.001 Spearphishing Attachment
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.001 PowerShell
- T1110.003 Password Spraying
- T1003.001 LSASS Memory
- T1555 Credentials from Password Stores
- T1688 Safe Mode Boot
- T1021.005 VNC
- T1567.002 Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1498.001 Direct Network Flood
- T1491.001 Internal Defacement
- T1657 Financial Theft

## Sources

- [France Cyber Threat Outlook: Dark Web, Ransomware & Hacktivism Report](https://www.cloudsek.com/blog/france-dark-web-ransomware-hacktivism-report)
- [Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure (AA25-343A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a)
- [#StopRansomware: MedusaLocker (AA22-181A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-181a)
- [MedusaLocker - JOINT CYBERSECURITY ADVISORY (PDF)](https://www.cisa.gov/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf)
- [Qilin, Software S1242](https://attack.mitre.org/software/S1242/)
- [Qilin Ransomware Analysis: Critical TTPs and Defense](https://www.picussecurity.com/resource/blog/qilin-ransomware)
- [Unmasking NoName057(16): Botnets, DDoSia, and NATO](https://cybelangel.com/blog/unmasking-noname05716/)
- [Noname057(16)](https://en.wikipedia.org/wiki/Noname057(16))

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2564