# Bitdefender Threat Debrief May 2026: KryBit vs 0APT ransomware conflict, The Gentlemen/SystemBC, and cPanel/WHM auth bypass CVE-2026-41940

> Bitdefender's May 2026 debrief (April 1-30, 2026) reports 725 claimed ransomware victims, the KryBit/0APT feud that exposed 0APT as a fraudulent operation, The Gentlemen RaaS (1,570+ SystemBC-linked victims), and the cPanel/WHM authentication bypass CVE-2026-41940 exploited since late February 2026 and added to CISA KEV on May 1, 2026.

- **Published:** 2026-10-16T09:49:18Z
- **Last reviewed:** 2026-10-16T09:49:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3721
- **ID:** TL-2026-3721
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** KryBit
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41940

## Description

Bitdefender's Threat Debrief for May 2026 (author Jade Brown, published 2026-05-12) summarizes ransomware activity for April 1-30, 2026, based on leak-site claims that the vendor notes are not independently verifiable. It recorded 725 claimed victims. Manufacturing led the most-attacked industries, followed closely by technology, healthcare and construction, and government returned to the top 10 for the second time in 2026. Thailand re-entered the top 10 regions. Bitdefender MDR observed compromised RDP/VPN credentials, LSASS/NTDS/LSA secrets dumping, SMB-based propagation and staging with archiving tools, and social engineering leading to user-executed compromise.

The featured story is the conflict between KryBit and 0APT. In April 2026, 0APT breached KryBit's RaaS infrastructure, obtained staff names, credentials, wallet addresses, location data, negotiation correspondence and affiliate lists, and demanded roughly $2 million while threatening to hand affiliate data to law enforcement. KryBit retaliated within one to two days, compromised 0APT's systems, locked out its staff, defaced the leak site and published 0APT's operational data. That data validated earlier reports that 0APT's claimed victim counts (190+ since its January 2026 launch) were fabricated; download links served random data and the operation was reportedly managed from an Android phone running Parrot OS from an SD card. KryBit is a RaaS that emerged weeks to months earlier, claims 25+ victims in the US, Germany, Austria and Turkey, pays affiliates 80%, and offers ESXi, Linux and Windows encryptors with 24/7 support. Its breach by a perceived inferior actor raises reputational and law-enforcement risk.

The debrief also covers The Gentlemen RaaS (emerged mid-2025; 320+ claimed leak-site victims). Check Point analyzed a SystemBC C2 server revealing 1,570+ infected victim networks. The Gentlemen uses Go (Windows/Linux/NAS/BSD) and C (ESXi) lockers with --spread and --gpo options, Cobalt Strike, SystemBC SOCKS5 proxying over an RC4-encrypted protocol, PsExec, WMI, scheduled tasks, Defender and firewall disabling, SMB1 re-enablement, event-log clearing and XChaCha20/X25519 encryption. The infrastructure was hosted at 4VPS, and the group was reportedly affected by a data breach it says exposed nothing critical. Bitdefender assesses that Iran's MuddyWater most likely affiliated with Chaos ransomware to camouflage espionage; Rapid7 reported a Microsoft Teams social-engineering intrusion with no encryption, a MuddyWater-linked code-signing certificate and the C2 domain moonzonet.com. Finally, former ALPHV/BlackCat affiliates Ryan Goldberg (incident response manager) and Kevin Martin (ransomware negotiator) were each sentenced to four years for 2023 attacks; co-conspirator Angelo Martino is due to be sentenced in July.

CVE-2026-41940 is a CVSS 9.8 pre-authentication bypass in cPanel & WHM (all versions after 11.40) and WP Squared (up to 11.136.1.6). It chains a CRLF injection in the Basic-auth path that bypasses an existing sanitizer, a session-encryption fallback when the cookie key segment is missing, and a raw-file/JSON-cache dual representation. This lets an attacker plant a successful_internal_auth_with_timestamp flag and obtain root-equivalent WHM access, including account creation and settings changes. Exploitation began around 2026-02-23 as a zero-day. cPanel confirmed the issue on 2026-04-27 and shipped patches on 2026-04-28; watchTowr published root-cause analysis on 2026-04-29, and CISA added the CVE to KEV on 2026-05-01. Reporting links mass compromise to the '.sorry' ransomware, Mirai variants and the Filemanager backdoor (attributed to Mr_Rot13). About 1.5 million cPanel instances were exposed and at least 44,000 IPs were reported compromised. The Bitdefender source itself gives no CVSS or IOCs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1569.002 System Services: Service Execution
- T1136.001 Create Account: Local Account
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1003.004 OS Credential Dumping: LSA Secrets
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1560.001 Archive Collected Data: Archive via Utility
- T1090 Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1490 Inhibit System Recovery
- T1491.002 Defacement: External Defacement

## Sources

- [Bitdefender Threat Debrief | May 2026](https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-may-2026)
- [cPanel Security Update CVE-2026-41940](https://www.cpanel.net/blog/security/security-update-cve-2026-41940/)
- [cPanel KB: Security CVE-2026-41940 cPanel/WHM/WP2 Security Update 04-28-2026](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026)
- [Rapid7 ETR: CVE-2026-41940 cPanel & WHM Authentication Bypass](https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/)
- [watchTowr Rapid Reaction: cPanel Authentication Bypass (CVE-2026-41940)](https://watchtowr.com/?p=2765)
- [Picus: CVE-2026-41940 Explained](https://www.picussecurity.com/resource/blog/cve-2026-41940-explained-cpanel-whm-authentication-bypass-hit-1-5m-servers)
- [Check Point Research: DFIR Report - The Gentlemen](https://research.checkpoint.com/2026/dfir-report-the-gentlemen/)
- [The Hacker News: SystemBC C2 Server Reveals 1,570 Victims](https://thehackernews.com/2026/04/systembc-c2-server-reveals-1570-victims.html)
- [The Register: 0APT vs KryBit spat](https://www.theregister.com/2026/04/14/0apt_krybit_spat/)
- [Infosecurity Magazine: Ransomware Turf War as 0APT and KryBit Trade Blows](https://infosecurity-magazine.com/news/ransomware-turf-war-0apt-krybit)
- [SC World: Iranian threat group used Chaos ransomware as a false flag](https://www.scworld.com/news/iranian-threat-group-used-chaos-ransomware-as-a-false-flag-researchers-say)
- [Security Affairs: Iranian cyber espionage disguised as a Chaos Ransomware attack](https://securityaffairs.com/191765/breaking-news/iranian-cyber-espionage-disguised-as-a-chaos-ransomware-attack.html)
- [DOJ: Two Americans who attacked multiple US victims using ALPHV/BlackCat ransomware sentenced](https://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced)
- [Expert Insights: cPanel flaw goes from disclosure to mass compromise as '.sorry' ransomware spreads](https://expertinsights.com/?p=55207)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3721