# Bitdefender Threat Debrief June 2026: Ransomware Landscape (Qilin, The Gentlemen, DragonForce, KryBit) and Actively Exploited SolarWinds Serv-U Flaw CVE-2026-28318

> Bitdefender's June 2026 debrief reports 714 ransomware victims claimed on leak sites in May 2026, with Construction the top attacked industry and the Netherlands newly in the Top 10 regions. It also covers an actively exploited SolarWinds Serv-U flaw (CVE-2026-28318, KEV-listed 2026-06-05), Silent Ransom Group's vishing and on-site intrusion tactics, credential-theft precursors to ransomware, and the Operation Saffron takedown of the First VPN service.

- **Published:** 2026-10-21T10:16:42Z
- **Last reviewed:** 2026-10-21T10:16:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4029
- **ID:** TL-2026-4029
- **Severity:** HIGH (CVSS 7.5)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28318

## Description

Bitdefender's Threat Debrief for June 2026 analyses data-leak-site (DLS) postings for 1-31 May 2026 and counts 714 claimed ransomware victims. Qilin, The Gentlemen, DragonForce and Coinbase Cartel are re-claiming victims previously posted by other major groups, which Bitdefender reads as evidence of shared criminal supply chains rather than isolated incidents. KryBit dropped out of the Top 10 after public exposure but still claimed 15 victims. Nova and Bavacai (described as formerly MedusaLocker) entered the Top 10. ShadowByt3$ is promoting a BreachForums-affiliated domain. Clop is noted for historically exploiting critical flaws in third-party software. Construction overtook manufacturing and technology as the most attacked industry, Wholesale entered the industry Top 10, and the Netherlands entered the region Top 10 (normally under 4 victims a month), with The Gentlemen and DragonForce responsible for more than half of Dutch victims.

The debrief flags CVE-2026-28318 in SolarWinds Serv-U 15.5.4 and earlier as actively exploited, and Bitdefender describes it as an authentication flaw. NVD, the SolarWinds advisory and CISA KEV describe it differently: an unauthenticated denial-of-service (CWE-400, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/A:H). Specially crafted POST requests sent with 'Content-Encoding: deflate' crash the Serv-U service without credentials, and repeated exploitation keeps FTP, SFTP and HTTP/S file transfer offline. SolarWinds published the advisory on 2026-06-03, NVD on 2026-06-04 and CISA added it to KEV on 2026-06-05 with a federal due date of 2026-06-19. The fix is Serv-U 15.5.4 Hotfix 1; the vendor also suggests a WAF rule blocking POSTs carrying a Content-Encoding header, and limiting access to known addresses. The public sources reviewed do not name the exploiting actors, and none ties the Serv-U exploitation to a specific ransomware group. The debrief only notes that groups such as Clop have used similar file-transfer flaws.

Bitdefender MDR observations stress that credential theft usually precedes ransomware and domain takeover: LSASS dumping, NTDS extraction, LSA secret harvesting, SMB-based harvesting, Remote Registry abuse and browser credential theft, with attackers logging in with stolen valid credentials rather than using zero-days. Customised Lumma and Redline infostealer variants harvest session tokens, passwords and browser data, which is used to bypass MFA and the data is resold on criminal markets. GitHub repositories were targeted for intellectual property and infrastructure-security data. Silent Ransom Group (UNC3753, Luna Moth, Chatty Spider) is performing vishing and now sends staff posing as IT personnel into legal and financial offices; other reporting (FBI FLASH of 2026-05-26) lists RMM abuse (AnyDesk, Zoho Assist, Quick Assist, RustDesk, Splashtop, Atera) and exfiltration via WinSCP, renamed Rclone, cloud storage and USB drives, with no encryption payload. Finally, Operation Saffron (19-20 May 2026, led by France and the Netherlands) dismantled the First VPN anonymisation service used by ransomware actors, seizing 33 servers and the domains 1vpns.com, 1vpns.net and 1vpns.org. The Bitdefender debrief lists no IOCs; the IOCs recorded here come from the corroborating sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.004 Phishing: Spearphishing Voice
- T1078 Valid Accounts
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1003.004 OS Credential Dumping: LSA Secrets
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Bitdefender Threat Debrief | June 2026](https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-june-2026)
- [SolarWinds Security Advisory CVE-2026-28318](https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318)
- [SolarWinds Serv-U 15.5.4 Hotfix 1 Release Notes](https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm)
- [NVD - CVE-2026-28318](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28318)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-28318](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318)
- [CISA Adds Actively Exploited SolarWinds Serv-U Vulnerability to KEV Catalog (ThaiCERT / The Hacker News)](https://www.thaicert.or.th/?p=14612)
- [Silent Ransom Group: Vishing and Physical Intrusion at Law Firms (CSA research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-unc3753-silent-ransom-vishing-physical-int/)
- [Silent Ransom Group Targets Law Firms With IT Impersonation Attacks](https://www.esecurityplanet.com/threats/silent-ransom-group-targets-law-firms-with-it-impersonation-attacks/)
- [FBI: crooks enter legal offices and steal data via USB drive (The Register)](https://www.theregister.com/security/2026/05/27/fbi-crooks-enter-legal-offices-and-steal-data-via-usb-drive/5247212)
- [Authorities dismantle First VPN, used by ransomware actors (Help Net Security)](https://helpnetsecurity.com/2026/05/21/operation-saffron-first-vpn-takedown)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4029