Threat reportRansomwareTL-2026-4029
Bitdefender Threat Debrief June 2026: Ransomware Landscape (Qilin, The Gentlemen, DragonForce, KryBit) and Actively Exploited SolarWinds Serv-U Flaw CVE-2026-28318
Bitdefender Threat Debrief June 2026 (TL-2026-4029), also tracked as Operation Saffron, is a high-severity ransomware operation scored CVSS 7.5, first published 2026-10-21. It is attributed to Qilin with low confidence, affects SolarWinds Serv-U, references 1 CVE (CVE-2026-28318), maps to 12 MITRE ATT&CK techniques (T1003.001, T1003.003, T1003.004), and is covered by 9 detection rules and 23 indicators of compromise.
- CVSS
- 7.5/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 4Qilin
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-4029
- Threat ID
- TL-2026-4029
- Also known as
- Operation Saffron, First VPN takedown
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Qilin, The Gentlemen, DragonForce, Coinbase Cartel
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- construction, wholesale, manufacturing, technology, legal, finance, health, insurance
- Target regions
- netherlands, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Bitdefender Threat Debrief June 2026
Malware and tooling: AgendaCrypt, Clop, DragonForce, Lumma, MedusaLocker, Redline, coinbase cartel, krybit, nova, shadowbyt3$, the gentlemen, AnyDesk
How Bitdefender Threat Debrief June 2026 works
Bitdefender's June 2026 debrief reports 714 ransomware victims claimed on leak sites in May 2026, with Construction the top attacked industry and the Netherlands newly in the Top 10 regions. It also covers an actively exploited SolarWinds Serv-U flaw (CVE-2026-28318, KEV-listed 2026-06-05), Silent Ransom Group's vishing and on-site intrusion tactics, credential-theft precursors to ransomware, and the Operation Saffron takedown of the First VPN service.
Bitdefender's Threat Debrief for June 2026 analyses data-leak-site (DLS) postings for 1-31 May 2026 and counts 714 claimed ransomware victims. Qilin, The Gentlemen, DragonForce and Coinbase Cartel are re-claiming victims previously posted by other major groups, which Bitdefender reads as evidence of shared criminal supply chains rather than isolated incidents. KryBit dropped out of the Top 10 after public exposure but still claimed 15 victims. Nova and Bavacai (described as formerly MedusaLocker) entered the Top 10. ShadowByt3$ is promoting a BreachForums-affiliated domain. Clop is noted for historically exploiting critical flaws in third-party software. Construction overtook manufacturing and technology as the most attacked industry, Wholesale entered the industry Top 10, and the Netherlands entered the region Top 10 (normally under 4 victims a month), with The Gentlemen and DragonForce responsible for more than half of Dutch victims.
The debrief flags CVE-2026-28318 in SolarWinds Serv-U 15.5.4 and earlier as actively exploited, and Bitdefender describes it as an authentication flaw. NVD, the SolarWinds advisory and CISA KEV describe it differently: an unauthenticated denial-of-service (CWE-400, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/A:H). Specially crafted POST requests sent with 'Content-Encoding: deflate' crash the Serv-U service without credentials, and repeated exploitation keeps FTP, SFTP and HTTP/S file transfer offline. SolarWinds published the advisory on 2026-06-03, NVD on 2026-06-04 and CISA added it to KEV on 2026-06-05 with a federal due date of 2026-06-19. The fix is Serv-U 15.5.4 Hotfix 1; the vendor also suggests a WAF rule blocking POSTs carrying a Content-Encoding header, and limiting access to known addresses. The public sources reviewed do not name the exploiting actors, and none ties the Serv-U exploitation to a specific ransomware group. The debrief only notes that groups such as Clop have used similar file-transfer flaws.
Bitdefender MDR observations stress that credential theft usually precedes ransomware and domain takeover: LSASS dumping, NTDS extraction, LSA secret harvesting, SMB-based harvesting, Remote Registry abuse and browser credential theft, with attackers logging in with stolen valid credentials rather than using zero-days. Customised Lumma and Redline infostealer variants harvest session tokens, passwords and browser data, which is used to bypass MFA and the data is resold on criminal markets. GitHub repositories were targeted for intellectual property and infrastructure-security data. Silent Ransom Group (UNC3753, Luna Moth, Chatty Spider) is performing vishing and now sends staff posing as IT personnel into legal and financial offices; other reporting (FBI FLASH of 2026-05-26) lists RMM abuse (AnyDesk, Zoho Assist, Quick Assist, RustDesk, Splashtop, Atera) and exfiltration via WinSCP, renamed Rclone, cloud storage and USB drives, with no encryption payload. Finally, Operation Saffron (19-20 May 2026, led by France and the Netherlands) dismantled the First VPN anonymisation service used by ransomware actors, seizing 33 servers and the domains 1vpns.com, 1vpns.net and 1vpns.org. The Bitdefender debrief lists no IOCs; the IOCs recorded here come from the corroborating sources.
MITRE ATT&CK techniques used in TL-2026-4029
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS; T1003.004 OS Credential Dumping: LSA Secrets; T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.004 Phishing: Spearphishing Voice
Command and Control
Exfiltration
T1567 Exfiltration Over Web Service
Impact
Affected products and versions in Bitdefender Threat Debrief June 2026
- SolarWinds — Serv-U
Vulnerable versions: 15.5.4 and earlier (Windows and Linux)
Fixed in: 15.5.4 Hotfix 1
Remediation for Bitdefender Threat Debrief June 2026
Patches
- SolarWinds Serv-U 15.5.4 Hotfix 1 (CVE-2026-28318)
Immediate actions
- Upgrade SolarWinds Serv-U to 15.5.4 Hotfix 1 and review Serv-U logs for POST requests carrying Content-Encoding: deflate and for unexplained service crashes
- Add a WAF rule blocking POST requests with a Content-Encoding header in front of Serv-U (not required by the service) and limit Serv-U exposure to known addresses
- Hunt for LSASS access, NTDS.dit copies, LSA secret and SAM hive dumping, and SMB/Remote Registry credential harvesting
- Alert on RMM tools (AnyDesk, Zoho Assist, Quick Assist, RustDesk, Splashtop, Atera) launched after unsolicited IT-support calls or emails
- Revoke and reissue session tokens and passwords for accounts showing infostealer exposure
Workarounds
- WAF rule blocking POST requests with a Content-Encoding header, per the SolarWinds advisory
- Restrict Serv-U access to known source addresses
Longer-term hardening
- Monitor credential and session-token use behaviourally and enforce phishing-resistant MFA
- Allow-list approved remote-support tools and block the rest
- Verify the identity of on-site IT visitors and enforce physical access controls, especially in legal and financial offices
- Harden cloud resources and API access, and protect GitHub repositories holding IP and infrastructure data
- Subscribe to threat intelligence on infostealers and leak-site activity
CVEs associated with Bitdefender Threat Debrief June 2026
Weaknesses (CWE) in Bitdefender Threat Debrief June 2026
Timeline of Bitdefender Threat Debrief June 2026
- Silent Ransom Group (UNC3753) begins a sustained data-theft extortion campaign against US legal and financial firms (since at least January 2026, per CSA research note)
- Operation Saffron begins: France- and Netherlands-led action dismantles the First VPN service, seizing 33 servers and the domains 1vpns.com, 1vpns.net and 1vpns.org (continues 2026-05-20)
- FBI issues a FLASH advisory on Silent Ransom Group adding physical office intrusion to its vishing and RMM-abuse tactics
- Close of the 1-31 May 2026 data-leak-site window in which 714 ransomware victims were claimed; Construction is the top industry and the Netherlands enters the Top 10 regions
- SolarWinds publishes the CVE-2026-28318 advisory for Serv-U 15.5.4 and earlier and releases Serv-U 15.5.4 Hotfix 1
- NVD publishes CVE-2026-28318 (CVSS 3.1 7.5, CWE-400, unauthenticated DoS via POST with Content-Encoding: deflate)
- CISA adds CVE-2026-28318 to the Known Exploited Vulnerabilities catalog on evidence of active exploitation
- Bitdefender publishes the June 2026 Threat Debrief covering the May ransomware landscape, CVE-2026-28318, credential-theft tradecraft and Operation Saffron
- CISA KEV remediation deadline for Federal Civilian Executive Branch agencies to patch CVE-2026-28318
Sources cited for Bitdefender Threat Debrief June 2026
- Bitdefender Threat Debrief | June 2026
- SolarWinds Security Advisory CVE-2026-28318
- SolarWinds Serv-U 15.5.4 Hotfix 1 Release Notes
- NVD - CVE-2026-28318
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-28318
- CISA Adds Actively Exploited SolarWinds Serv-U Vulnerability to KEV Catalog (ThaiCERT / The Hacker News)
- Silent Ransom Group: Vishing and Physical Intrusion at Law Firms (CSA research note)
- Silent Ransom Group Targets Law Firms With IT Impersonation Attacks
- FBI: crooks enter legal offices and steal data via USB drive (The Register)
- Authorities dismantle First VPN, used by ransomware actors (Help Net Security)
Detection coverage for TL-2026-4029
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4029 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.