Threat reportRansomwareTL-2026-4501
Ransomware Recovery Failures: Backup Targeting and Reinfection from Premature Restoration, with Weaponized ScreenConnect Delivered by a Fake IT Operations Agent (Halcyon '22 Days of Hell')
Ransomware Recovery Failures (TL-2026-4501), also tracked as 22 Days of Hell, is a medium-severity ransomware operation, first published 2026-10-27. It has no confirmed attribution, affects Various Enterprise backup and recovery infrastructure; endpoints, maps to 6 MITRE ATT&CK techniques (T1036.001, T1053.005, T1071), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4501
- Threat ID
- TL-2026-4501
- Also known as
- 22 Days of Hell, Phase Zero
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Ransomware Recovery Failures
Malware and tooling: OpsBridgeAgent, ScreenConnect, Weaponized ScreenConnect client
How Ransomware Recovery Failures works
Halcyon's 22 Days of Hell series argues that ransomware recovery takes ~22 days on average (Gartner; 38 days for enterprises per Total Assure) and that backups are targeted directly in 96% of attacks. Restoring before attacker eviction is verified risks reinfection. A related Halcyon post documents a fake IT operations agent (OpsBridgeAgent.exe, revoked OpsBridge LLC signature) built to install a weaponized ScreenConnect client.
This record is a low-confidence, guidance-driven entry rather than a discrete campaign. Halcyon's Part 1 article (Phase Zero, published 2026-09-03, Kevin Gee) states that recovery is far slower than tabletop exercises assume: Gartner puts average ransomware recovery at 22 days and Total Assure puts enterprise environments at 38 days. Sophos is cited for the claim that one in four security leaders is replaced after a ransomware attack and that 55% of CISOs expect to be fired if a breach occurs on their watch. The article frames recovery as phases (detection, investigation, containment, eviction, recovery, hardening) and stresses that business pressure to restore systems before eviction is verified leads to reinfection. The 96% figure for direct backup targeting appears in Halcyon promotional content; an independent search attributes the same figure to Veeam's 2024 Ransomware Trends Report (backup repositories targeted in 96% of incidents, successfully affected in 76%). That attribution was not confirmed against the primary report.
A separate Halcyon post, 'The Fake Agent Was Just the Delivery Truck' (2026-10-19), describes an September 2026 intercept by the Halcyon ROC of a fake IT operations agent, a packaged Python application named OpsBridgeAgent.exe installed under Program Files, signed by 'OpsBridge LLC' with a certificate that had been revoked yet still displayed as signed. It was obtained from a third-party download site rather than an official vendor, unpacked components, created a scheduled task, initiated C2 communication, and installed a weaponized ScreenConnect client. Halcyon states that remote access tools accounted for 44% of real threat activity in September. No hash, domain, IP, actor or ransomware family is disclosed. Part 5 (Phase 4, 2026-10-01) adds that post-restoration hardening, regulatory and legal work can run for months to years, citing Blackbaud (2020) as an example.
No CVE, exploitation of a vulnerability, PoC or network IOC is stated in any source, so no BeaconBeagle correlation was possible. Defender takeaways: protect and isolate backups (immutable/offline copies), verify eviction before restoring, validate restored systems, treat unsigned or revoked-signature 'IT agents' and unexpected remote-support tooling as high-risk, and rehearse recovery rather than only decision-making.
MITRE ATT&CK techniques used in TL-2026-4501
Defense Evasion
T1036.001 Invalid Code Signature
Persistence
Command and Control
T1071 Application Layer Protocol; T1219 Remote Access Tools
Execution
Impact
Affected products and versions in Ransomware Recovery Failures
- Various — Enterprise backup and recovery infrastructure; endpoints permitting unapproved remote access tools
Remediation for Ransomware Recovery Failures
Immediate actions
- Verify attacker eviction (credentials reset, persistence and remote access tools removed) before restoring production systems
- Audit endpoints for unapproved remote access tooling (e.g. ScreenConnect clients) and for OpsBridgeAgent.exe
- Review scheduled tasks created by recently installed IT or operations agents
Workarounds
- Application allow-listing for remote administration tools
- Block downloads of IT agents from third-party download sites
Longer-term hardening
- Keep immutable or offline backups isolated from the production identity plane and test restores regularly
- Run recovery-focused exercises (BC/DR simulations), not only decision-making tabletops
- Enforce software installation only from approved vendor sources and alert on binaries with revoked signatures
- Deploy behavioral detection for remote access tool abuse rather than relying on signature validity alone
Timeline of Ransomware Recovery Failures
- Blackbaud 2020 ransomware incident cited by Halcyon as taking nearly 5 years to fully resolve regulatory and legal matters (exact date not stated; year only)
- CSO Online reports Sophos State of Ransomware 2025 finding that 25% of security leaders are replaced after a ransomware attack
- Halcyon ROC intercepts fake IT operations agent OpsBridgeAgent.exe that installs a weaponized ScreenConnect client (September 2026; exact day not stated)
- Halcyon publishes 22 Days of Hell Part 1 (Phase Zero) by Kevin Gee on recovery failures, backup targeting and reinfection risk
- Halcyon publishes 22 Days of Hell Part 5 (Phase 4) on post-restoration hardening, regulatory and legal workstreams
- Halcyon publishes 'The Fake Agent Was Just the Delivery Truck' describing the OpsBridgeAgent.exe delivery of weaponized ScreenConnect
Sources cited for Ransomware Recovery Failures
- Your Tabletop Exercise Lied to You (22 Days of Hell, Part 1: Phase Zero) - Kevin Gee, Halcyon
- 22 Days of Hell, Part 5: Phase 4 - Halcyon
- The Fake Agent Was Just the Delivery Truck - Halcyon
- 25% of security leaders replaced after ransomware attack - CSO Online (Sophos State of Ransomware 2025)
- The State of Ransomware in Enterprise 2025 - Sophos
- MITRE ATT&CK T1490 Inhibit System Recovery
- MITRE ATT&CK T1219 Remote Access Software
Detection coverage for TL-2026-4501
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4501 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.