Skip to navigation

Threat reportRansomwareTL-2026-5098

Ransomware Targeting of Small and Medium-Sized Businesses: Credential Theft, Unpatched Edge Devices, BYOVD and Backup Targeting

mediumACTIVE

Per the Verizon 2026 DBIR as summarized by Halcyon, about 96% of ransomware victims of known size were SMBs with fewer than 1,000 employees, and ransomware appeared in 83% of breaches at those businesses. Initial access was via stolen credentials (38%) or unpatched edge devices (29%), followed by legitimate admin tool use, BYOVD-based security tampering, pre-encryption data theft and backup targeting. First disclosed .

Key facts for SMB ransomware attack chain

IdentifiersTL-2026-5098
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
Affected productsVarious Internet-facing edge devices and Windows endpoints/servers at small and medium-sized businesses
ToolsScreenConnect
MITRE ATT&CK techniquesT1021 Remote Services, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1219 Remote Access Tools, T1490 Inhibit System Recovery, T1555 Credentials from Password Stores, T1685 Disable or Modify Tools
MotivationFINANCIAL
Target sectorssmall and medium-sized businesses, professional services, health, manufacturing, retail
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for SMB ransomware attack chain

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5098 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Stolen Valid Account Replay - Failed Then Successful Remote Logon From Public IP (T1078, T1110.004, T1133)

TL-2026-5098: Detects a public source IP that produces repeated failed network/RDP logons followed by at least one success against Windows hosts, the telemetry pattern of stolen or infostealer-sourced valid credentials being replayed (credential stuffing) against internet-exposed RDP/SMB. Verizon 2026 DBIR via Halcyon: compromised credentials are the initial access vector in 38% of SMB ransomware cases, and 73% of ransomware victims had an infostealer/credential compromise beforehand (50% within the prior 95 days). The Sentinel flavor also unions Entra ID sign-in logs so cloud-account replay is covered.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1078, T1110.004, T1133
  • Data sources: wineventlog:Security, SecurityEvent, SigninLogs
  • Severity: high
  • Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" earliest=-24h (EventCode=4624 OR EventCode=4625) Logon_Type IN (3,10) NOT Source_Network_Address IN ("-","::1","127.0.0.1") ```Stolen-credential replay (T1078, T1110.004, T1133, TL-2026-5098): repeated failures then success from a public source``` | eval outcome=if(EventCode=4624,"success","failure") | stats count(eval(outcome="failure")) AS failures count(eval(outcome="success")) AS successes dc(user) AS distinct_users values(user) AS users values(Logon_Type) AS logon_types earliest(_time) AS first_seen latest(_time) AS last_seen BY Source_Network_Address | where failures>=5 AND successes>=1 | where NOT (cidrmatch("10.0.0.0/8",Source_Network_Address) OR cidrmatch("172.16.0.0/12",Source_Network_Address) OR cidrmatch("192.168.0.0/16",Source_Network_Address) OR cidrmatch("169.254.0.0/16",Source_Network_Address)) | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table Source_Network_Address failures successes distinct_users users logon_types first_seen last_seen

Microsoft KQL

let winLogons = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4624, 4625) and LogonType in (3, 10)
| where isnotempty(IpAddress) and IpAddress !in ("-", "::1", "127.0.0.1") and not(ipv4_is_private(IpAddress))
| summarize Failures = countif(EventID == 4625), Successes = countif(EventID == 4624), Users = make_set(TargetUserName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IpAddress
| extend Source = "WindowsSecurity";
let entraLogons = SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType in ("0", "50126", "50053", "50057")
| where not(ipv4_is_private(IPAddress))
| summarize Failures = countif(ResultType != "0"), Successes = countif(ResultType == "0"), Users = make_set(UserPrincipalName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IpAddress = IPAddress
| extend Source = "EntraID";
union winLogons, entraLogons
| where Failures >= 5 and Successes >= 1
| project Source, IpAddress, Failures, Successes, Users, FirstSeen, LastSeen

Sigma

title: Remote Interactive Logon From Public IP Address (Valid Accounts)
id: 6b1f0c52-3a7e-4d19-9c64-2f8a1e5b7d01
status: experimental
description: Detects successful Windows RDP logons originating from non-RFC1918 addresses, a common outcome of stolen-credential or infostealer-sourced access to SMB environments that precedes ransomware (TL-2026-5098).
references:
    - https://www.halcyon.ai/blog/ransomware-protection-for-small-businesses
    - https://verizon.com/DBIR
    - https://attack.mitre.org/techniques/T1078/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1078
    - attack.t1133
    - attack.credential_access
    - attack.t1110.004
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    filter_private:
        IpAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '127.0.0.0/8'
    filter_local:
        IpAddress:
            - '-'
            - '::1'
    condition: selection and not 1 of filter_*
falsepositives:
    - Administrators or MSPs connecting over RDP through a public gateway
    - Remote staff on home networks where RDP is intentionally published behind NLA
level: medium

Known false positives:

  • Remote staff or MSPs legitimately logging on from public IPs after mistyped passwords
  • Vulnerability scanners or monitoring probes that authenticate over the network
  • Shared NAT egress addresses where several users fail then succeed

Tuning notes: Add known corporate egress, VPN concentrator and MSP IP ranges to an exclusion lookup; raise the failure threshold in noisy environments; require distinct_users>=2 to emphasise credential stuffing; correlate hits with infostealer-exposure feeds (credentials stolen in the prior 95 days) for the affected accounts; enforce MFA and remove direct RDP exposure.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Edge Device Exploitation Attempts Against VPN and Gateway Management Paths (T1190, T1133) · unlock with TL Creds
  • Backup and Recovery Destruction Plus Ransom Note Staging Before Encryption (T1490, T1489, T1486) · unlock with TL Creds
  • Unsanctioned ScreenConnect Remote Access Client Install, Service and Relay Activity (T1219, T1543.003, T1105) · unlock with TL Creds
  • Credential Store Harvesting - Vault, Browser and Stealer Tool Commands (T1555, T1555.003, T1555.004) · unlock with TL Creds
  • Lateral Movement With Legitimate Admin Tools - PsExec, WinRS, WMI, PowerShell Remoting, Impacket-Style ADMIN$ (T1021, T1021.002, T1021.006, T1047) · unlock with TL Creds
  • Pre-Encryption Data Exfiltration and Staging - rclone, MEGAcmd, pscp, WinSCP, Archive Tools (T1041, T1567.002, T1048, T1560.001) · unlock with TL Creds
  • BYOVD - Known-Vulnerable Driver Load or Kernel Driver Service From Writable Path (T1068, T1562.001, T1543.003) · unlock with TL Creds
  • Endpoint Security Tampering - Service Stop, Defender Disablement and Registry Policy Changes (T1562.001, T1489, T1112) · unlock with TL Creds

Indicators of compromise for SMB ransomware attack chain

As of 2026-11-02, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5098.

7 indicators of compromise · unlock with TL Creds. Compare plans

How SMB ransomware attack chain works

This record documents a ransomware trend rather than a single incident or named campaign. The source is a Halcyon blog post by Kevin Gee (published 2026-11-02) that aggregates statistics from the Verizon 2026 Data Breach Investigations Report (DBIR), Sophos, Veeam, Arctic Wolf, Marsh and a 2025 Mastercard study. No CVEs, malware families, threat actors, hashes or network indicators are named in the article.

According to the Verizon 2026 DBIR as quoted by Halcyon and corroborated by the Cyber Readiness Institute's summary, about 96% of ransomware victims of known size were small or medium-sized businesses (fewer than 1,000 employees) and ransomware appeared in 83% of breaches at those businesses. Initial access at SMBs was attributed to compromised credentials (38%) and unpatched vulnerabilities in edge devices (29%). The Cyber Readiness Institute summary adds that 73% of ransomware victims experienced an infostealer or credential compromise beforehand, and 50% of those had credentials stolen within the 95 days before the ransomware incident. It also reports that 69% of SMBs refused to pay ransom demands because they maintained reliable backups.

The article describes the following attack pattern: access through stolen credentials or unpatched edge devices; lateral movement using legitimate administrative tools; Bring Your Own Vulnerable Driver (BYOVD) to disable endpoint security; data exfiltration before encryption (double extortion); and targeting of backups. The article attributes to Arctic Wolf that data theft occurs in 96% of ransomware attacks, and to Sophos that 94% of ransomware attacks attempt to compromise backups. Sophos is cited for average recovery cost of $638,536 for 100-250 employee organizations; Veeam for an average recovery time of 22 days with 72% of victims not fully recovering data. Halcyon reports in its ROC Star Report that nearly 99% of alerts were caught in earliest attack stages before exfiltration or encryption.

Defender relevance: because specific tooling and drivers are not named, detection should focus on behaviors: anomalous valid-account logons (especially following infostealer exposure), exploitation or anomalous access of internet-facing edge devices, new kernel driver loads and security-service tampering, use of remote administration tooling, bulk outbound data transfer, and backup deletion or tampering. No actor attribution is made; a related Silent Ransom Group alert was noted in the hunt rationale but is not mentioned in the source article and is not used for attribution.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Command and Control

T1219 Remote Access Tools

Impact

T1490 Inhibit System Recovery

Credential Access

T1555 Credentials from Password Stores

defense-impairment

T1685 Disable or Modify Tools

Remediation for SMB ransomware attack chain

Patches

  • Apply vendor security updates for all edge devices as released

Immediate actions

  • Reset and enforce MFA on exposed accounts; hunt for credentials exposed by infostealers
  • Inventory and patch internet-facing edge devices (VPNs, firewalls, gateways) or remove management interfaces from the internet
  • Verify backups are immutable/offline and test restores
  • Alert on security-tool tampering and unexpected kernel driver loads

Workarounds

  • Limit exposure of edge device management planes to trusted IP ranges
  • Disable unused remote access services

Longer-term hardening

  • Deploy behavioral ransomware prevention that acts before exfiltration or encryption
  • Enable driver blocklisting (e.g., Microsoft vulnerable driver blocklist / HVCI)
  • Restrict and monitor legitimate remote administration tools via application allowlisting
  • Segment backup infrastructure and use separate credentials for it

Affected and fixed versions

  • Various — Internet-facing edge devices and Windows endpoints/servers at small and medium-sized businesses
    Vulnerable versions: Unpatched edge devices (no specific products named in source)

Timeline of SMB ransomware attack chain

  • locked-ioc-1 (also tracked as Luna Moth) emerges following the Conti collapse, per locked-ioc-4 coverage; related context only, not used for attribution of this trend record.
  • FBI publishes a locked-ioc-1 cybersecurity advisory (related context from the hunt rationale; not used for attribution).
  • Cyber Readiness Institute publishes its summary of the locked-ioc-5 2026 DBIR: 96% of ransomware victims are small organizations; 38% credentials and 29% unpatched edge devices as SMB access vectors.
  • locked-ioc-4 alert on locked-ioc-1 in-person intrusions against U.S. law firms, linked from the locked-ioc-4 SMB ransomware article as an example of SMB-sized targets.
  • locked-ioc-4 ROC Star Report (Q2 2026 data; URL dated September 2026) published, cited as showing nearly 99% of alerts caught in earliest attack stages.
  • locked-ioc-4 article references an October 2026 incident involving a weaponized locked-ioc-2 remote access tool (no exact day or victim given in the source).
  • Threadlinqs opens TL-2026-5098 as a ransomware-trend record with no CVEs, actors or network IOCs.
  • locked-ioc-4 blog by Kevin Gee published, summarizing DBIR SMB ransomware findings, BYOVD, admin-tool lateral movement, data theft and backup targeting.

Sources cited for SMB ransomware attack chain

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats