Threat reportRansomwareTL-2026-3721
Bitdefender Threat Debrief May 2026: KryBit vs 0APT ransomware conflict, The Gentlemen/SystemBC, and cPanel/WHM auth bypass CVE-2026-41940
Bitdefender Threat Debrief May 2026 (TL-2026-3721), also tracked as Bitdefender Threat Debrief May 2026, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-10-16. It is attributed to KryBit with low confidence, affects cPanel cPanel & WHM, references 1 CVE (CVE-2026-41940), maps to 19 MITRE ATT&CK techniques (T1003.001, T1003.003, T1003.004), and is covered by 9 detection rules and 24 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 19MITRE ATT&CK
- Actors
- 4KryBit
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-3721
- Threat ID
- TL-2026-3721
- Also known as
- Bitdefender Threat Debrief May 2026, KryBit vs 0APT
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- KryBit, 0APT, The Gentlemen, MuddyWater
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, technology, health, construction, government administration, web-hosting
- Target regions
- North America, Europe, turkey, thailand, australia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Bitdefender Threat Debrief May 2026
Malware and tooling: 0apt, BlackCat (Windows), BlackCat - S1068, Chaos ransomware, Cobalt Strike, Filemanager, MimiKatz, Mirai, Sorry ransomware, SystemBC - S9001, the gentlemen, Cobalt Strike
How Bitdefender Threat Debrief May 2026 works
Bitdefender's May 2026 debrief (April 1-30, 2026) reports 725 claimed ransomware victims, the KryBit/0APT feud that exposed 0APT as a fraudulent operation, The Gentlemen RaaS (1,570+ SystemBC-linked victims), and the cPanel/WHM authentication bypass CVE-2026-41940 exploited since late February 2026 and added to CISA KEV on May 1, 2026.
Bitdefender's Threat Debrief for May 2026 (author Jade Brown, published 2026-05-12) summarizes ransomware activity for April 1-30, 2026, based on leak-site claims that the vendor notes are not independently verifiable. It recorded 725 claimed victims. Manufacturing led the most-attacked industries, followed closely by technology, healthcare and construction, and government returned to the top 10 for the second time in 2026. Thailand re-entered the top 10 regions. Bitdefender MDR observed compromised RDP/VPN credentials, LSASS/NTDS/LSA secrets dumping, SMB-based propagation and staging with archiving tools, and social engineering leading to user-executed compromise.
The featured story is the conflict between KryBit and 0APT. In April 2026, 0APT breached KryBit's RaaS infrastructure, obtained staff names, credentials, wallet addresses, location data, negotiation correspondence and affiliate lists, and demanded roughly $2 million while threatening to hand affiliate data to law enforcement. KryBit retaliated within one to two days, compromised 0APT's systems, locked out its staff, defaced the leak site and published 0APT's operational data. That data validated earlier reports that 0APT's claimed victim counts (190+ since its January 2026 launch) were fabricated; download links served random data and the operation was reportedly managed from an Android phone running Parrot OS from an SD card. KryBit is a RaaS that emerged weeks to months earlier, claims 25+ victims in the US, Germany, Austria and Turkey, pays affiliates 80%, and offers ESXi, Linux and Windows encryptors with 24/7 support. Its breach by a perceived inferior actor raises reputational and law-enforcement risk.
The debrief also covers The Gentlemen RaaS (emerged mid-2025; 320+ claimed leak-site victims). Check Point analyzed a SystemBC C2 server revealing 1,570+ infected victim networks. The Gentlemen uses Go (Windows/Linux/NAS/BSD) and C (ESXi) lockers with --spread and --gpo options, Cobalt Strike, SystemBC SOCKS5 proxying over an RC4-encrypted protocol, PsExec, WMI, scheduled tasks, Defender and firewall disabling, SMB1 re-enablement, event-log clearing and XChaCha20/X25519 encryption. The infrastructure was hosted at 4VPS, and the group was reportedly affected by a data breach it says exposed nothing critical. Bitdefender assesses that Iran's MuddyWater most likely affiliated with Chaos ransomware to camouflage espionage; Rapid7 reported a Microsoft Teams social-engineering intrusion with no encryption, a MuddyWater-linked code-signing certificate and the C2 domain moonzonet.com. Finally, former ALPHV/BlackCat affiliates Ryan Goldberg (incident response manager) and Kevin Martin (ransomware negotiator) were each sentenced to four years for 2023 attacks; co-conspirator Angelo Martino is due to be sentenced in July.
CVE-2026-41940 is a CVSS 9.8 pre-authentication bypass in cPanel & WHM (all versions after 11.40) and WP Squared (up to 11.136.1.6). It chains a CRLF injection in the Basic-auth path that bypasses an existing sanitizer, a session-encryption fallback when the cookie key segment is missing, and a raw-file/JSON-cache dual representation. This lets an attacker plant a successful_internal_auth_with_timestamp flag and obtain root-equivalent WHM access, including account creation and settings changes. Exploitation began around 2026-02-23 as a zero-day. cPanel confirmed the issue on 2026-04-27 and shipped patches on 2026-04-28; watchTowr published root-cause analysis on 2026-04-29, and CISA added the CVE to KEV on 2026-05-01. Reporting links mass compromise to the '.sorry' ransomware, Mirai variants and the Filemanager backdoor (attributed to Mr_Rot13). About 1.5 million cPanel instances were exposed and at least 44,000 IPs were reported compromised. The Bitdefender source itself gives no CVSS or IOCs.
MITRE ATT&CK techniques used in TL-2026-3721
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS; T1003.004 OS Credential Dumping: LSA Secrets
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1569.002 System Services: Service Execution
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1136.001 Create Account: Local Account
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
T1490 Inhibit System Recovery; T1491.002 Defacement: External Defacement
Collection
T1560.001 Archive Collected Data: Archive via Utility
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in Bitdefender Threat Debrief May 2026
- cPanel — cPanel & WHM
Vulnerable versions: All versions after 11.40 prior to the fixed builds
Fixed in: 11.86.0.41; 11.110.0.97; 11.118.0.63; 11.126.0.54; 11.130.0.19; 11.132.0.29; 11.134.0.20; 11.136.0.5 - cPanel — WP Squared
Vulnerable versions: Up to 11.136.1.6
Fixed in: 11.136.1.7
Remediation for Bitdefender Threat Debrief May 2026
Patches
- cPanel security update of 2026-04-28 for all supported tiers (LTS, STABLE, RELEASE, CURRENT, EDGE)
Immediate actions
- Patch cPanel & WHM to the fixed build for your branch (e.g. 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5) and WP Squared to 11.136.1.7
- Run cPanel's published indicators-of-compromise script and review /var/cpanel/sessions/raw and /var/cpanel/sessions/cache for CRLF-tainted sessions
- Restrict cPanel/WHM ports 2082, 2083, 2086, 2087, 2095, 2096, 2077 and 2078 to trusted IP ranges
- Hunt for '.sorry' files, Mirai variants and the Filemanager backdoor on cPanel hosts
- Reset credentials and rotate secrets on any server that was exposed before 2026-04-28
Workarounds
- Block the cpsrvd service ports from the internet
- Apply the ModSecurity rules documented in cPanel KB 40073787579671
Longer-term hardening
- Enforce MFA on all RDP/VPN access and monitor for use of compromised credentials
- Alert on LSASS, NTDS.dit and LSA secrets access, and on SMB propagation and archive-tool staging
- Patch and monitor network edge devices, the Gentlemen's reported attack vector
- Maintain offline, tested backups including ESXi hosts, and train users against Teams-based social engineering
CVEs associated with Bitdefender Threat Debrief May 2026
Weaknesses (CWE) in Bitdefender Threat Debrief May 2026
Timeline of Bitdefender Threat Debrief May 2026
- The Gentlemen RaaS emerges (July 2025 per press reporting; mid-2025 per Check Point).
- 0APT launches in January 2026 with hundreds of claimed victims, later shown to be fabricated.
- Earliest suspected in-the-wild exploitation of the cPanel/WHM authentication bypass (CVE-2026-41940), about two months before the patch.
- 0APT breaches KryBit's RaaS infrastructure and threatens to expose affiliates and leak data to law enforcement (reported by The Register on 2026-04-14, which dates the incident to the preceding Sunday).
- KryBit compromises 0APT within one to two days, locks out its staff, defaces the leak site and publishes data showing 0APT's victim claims were fabricated.
- Check Point publishes its DFIR report on The Gentlemen; a SystemBC C2 server reveals 1,570+ infected victims (press coverage 2026-04-21).
- cPanel confirms CVE-2026-41940 internally (10:47 CDT).
- cPanel releases emergency security updates across all supported tiers and publishes mitigation guidance.
- watchTowr Labs publishes root-cause analysis; a public proof of concept follows.
- CISA adds CVE-2026-41940 to the KEV catalog; Censys and others observe mass compromise and '.sorry' ransomware activity.
- Bitdefender publishes the May 2026 Threat Debrief covering April 1-30, 2026 (725 claimed victims).
Sources cited for Bitdefender Threat Debrief May 2026
- Bitdefender Threat Debrief | May 2026
- cPanel Security Update CVE-2026-41940
- cPanel KB: Security CVE-2026-41940 cPanel/WHM/WP2 Security Update 04-28-2026
- Rapid7 ETR: CVE-2026-41940 cPanel & WHM Authentication Bypass
- watchTowr Rapid Reaction: cPanel Authentication Bypass (CVE-2026-41940)
- Picus: CVE-2026-41940 Explained
- Check Point Research: DFIR Report - The Gentlemen
- The Hacker News: SystemBC C2 Server Reveals 1,570 Victims
- The Register: 0APT vs KryBit spat
- Infosecurity Magazine: Ransomware Turf War as 0APT and KryBit Trade Blows
- SC World: Iranian threat group used Chaos ransomware as a false flag
- Security Affairs: Iranian cyber espionage disguised as a Chaos Ransomware attack
- DOJ: Two Americans who attacked multiple US victims using ALPHV/BlackCat ransomware sentenced
- Expert Insights: cPanel flaw goes from disclosure to mass compromise as '.sorry' ransomware spreads
Detection coverage for TL-2026-3721
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3721 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3721
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.