Skip to navigation

Threat reportThreat IntelligenceTL-2026-5442

France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

highACTIVE

CloudSEK reports a fourfold rise in France-tagged underground threat activity over 24 months (~17,800 items), driven by stolen credentials, infostealer logs, ransomware and pro-Russian hacktivism. Qilin and MedusaLocker hit French local government in the last 6 months, while NoName057(16) led DDoS and CCTV-access claims tied to France's support for Ukraine. First disclosed .

Key facts for France ransomware and hacktivism

IdentifiersTL-2026-5442
Also known asFrance Cyber Threat Outlook, #BrokenByte
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsVarious French public-sector, local-government, financial, telecom, retail and e-commerce organisations
Weaknesses (CWE)CWE-200, CWE-521, CWE-548
AttributionNoName057(16), Qilin, MedusaLocker, LockBit (medium confidence)
MalwareAgendaCrypt, Cobalt Strike, Dataleak, Dosia, LockBit, MedusaLocker, NETXLOADER, Smoke Loader - S0226
ToolsCobalt Strike, NetExec, PSEXEC, ScreenConnect
MITRE ATT&CK techniquesT1021.001 Remote Desktop Protocol, T1021.006 Windows Remote Management, T1059.001 PowerShell, T1078 Valid Accounts, T1110.004 Credential Stuffing, T1133 External Remote Services, T1136 Create Account, T1190 Exploit Public-Facing Application, T1219 Remote Access Tools, T1489 Service Stop, T1490 Inhibit System Recovery, T1491.002 External Defacement and 6 more in the attack flow
MotivationFINANCIAL
Target sectorsgovernment administration, local-government, finance, technology, telecoms, retail, ecommerce, education, health, postal, automotive, defense
Target regionsfrance, Europe
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for France ransomware and hacktivism

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5442 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Invoke-ReflectivePEInjection PowerShell Execution (MedusaLocker) — TL-2026-5442

Detects PowerShell script blocks (4104) or process command lines invoking Invoke-ReflectivePEInjection, or the underlying VirtualAlloc/CreateRemoteThread/PEBytes reflective PE loading pattern. CISA AA22-181A documents MedusaLocker spreading via a batch file that runs this script; MedusaLocker hit French local government (Mairie Thiverval-Grignon) per the France Cyber Threat Outlook. The VirtualAlloc/CreateRemoteThread branch also covers classic remote-thread process injection (T1055).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1059.001, T1620, T1055
  • Data sources: powershell_scriptblock_4104, sysmon, defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=windows earliest=-24h ((sourcetype="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104) OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)) | eval content=coalesce(ScriptBlockText, CommandLine) | eval lc=lower(content) | where like(lc, "%invoke-reflectivepeinjection%") OR (like(lc, "%virtualalloc%") AND like(lc, "%createremotethread%") AND like(lc, "%pebytes%")) | eval snippet=substr(content, 1, 300), actor=coalesce(User, user, "unknown") | stats count min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sources values(ParentImage) as parent_image values(snippet) as sample by host, actor | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lookback = 24h;
union
(DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has "Invoke-ReflectivePEInjection"
| project Timestamp, DeviceName, AccountName, Evidence=ProcessCommandLine, Source="DeviceProcessEvents"),
(DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "PowerShellCommand"
| where AdditionalFields has "Invoke-ReflectivePEInjection" or (AdditionalFields has "VirtualAlloc" and AdditionalFields has "CreateRemoteThread" and AdditionalFields has "PEBytes")
| project Timestamp, DeviceName, AccountName, Evidence=tostring(AdditionalFields), Source="DeviceEvents")
| order by Timestamp desc

Sigma

title: Invoke-ReflectivePEInjection PowerShell Script Block (MedusaLocker)
id: 5d3b7a1e-2c4f-4e8a-9b61-7a0c3f2d8e11
status: experimental
description: Detects PowerShell script blocks invoking Invoke-ReflectivePEInjection or the reflective PE loading API pattern, used to spread MedusaLocker via batch file (CISA AA22-181A).
references:
    - https://ic3.gov/CSA/2022/220630.pdf
    - https://www.cloudsek.com/blog/france-dark-web-ransomware-hacktivism-report
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1620
    - attack.privilege_escalation
    - attack.t1055
logsource:
    category: ps_script
    product: windows
detection:
    selection_name:
        ScriptBlockText|contains: 'Invoke-ReflectivePEInjection'
    selection_api:
        ScriptBlockText|contains|all:
            - 'VirtualAlloc'
            - 'CreateRemoteThread'
            - 'PEBytes'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team or penetration test using PowerSploit
level: high

Known false positives:

  • Authorized red team or penetration test using PowerSploit
  • Security tooling or lab scripts that bundle PowerSploit modules

Tuning notes: Requires PowerShell Script Block Logging (4104) and Sysmon EventID 1. Adjust the index name to your Windows data. Exclude known red-team hosts via a host lookup. The API-pattern branch can be dropped if noisy.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • External RDP Logon Following Credential-Stuffing Burst — TL-2026-5442 · unlock with TL Creds
  • Ransomware Recovery Inhibition and Backup Service Stop — TL-2026-5442 · unlock with TL Creds
  • WinRM Remote Shell Lateral Movement (NetExec / winrs) — TL-2026-5442 · unlock with TL Creds
  • ScreenConnect Client Spawning Shells or LOLBins (Compromised MSP Access) — TL-2026-5442 · unlock with TL Creds
  • Local Account Creation and Administrator Group Addition — TL-2026-5442 · unlock with TL Creds
  • Connection to Community-Observed Cobalt Strike Infrastructure — TL-2026-5442 · unlock with TL Creds
  • WinRAR/RAR Data Staging Archive Creation (Qilin) — TL-2026-5442 · unlock with TL Creds
  • PsExec / NetExec Remote Service Execution (Qilin Lateral Movement) — TL-2026-5442 · unlock with TL Creds

Indicators of compromise for France ransomware and hacktivism

As of 2026-11-06, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5442.

Sample indicators (1 of 26)

  • Domain: classic-days[.]fr

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

26 indicators of compromise · unlock with TL Creds. Compare plans

How France ransomware and hacktivism works

CloudSEK's France Cyber Threat Outlook (published 2026-07-23) analyses roughly 17,800 France-tagged items collected over 24 months across dark-web, ransomware and hacktivism monitoring modules. Dark-web volume grew from under 300 items per month in mid-2024 to a peak above 1,400 in January 2026. CloudSEK characterises the surge as a commodity cybercrime supply chain (infostealer logs, scraped databases and combolists) rather than a single coordinated campaign. The most common exposed data types were account credentials (4,447) and credential collections (4,360), followed by combined datasets (4,011), breached records (3,565), customer records (2,380), financial fraud data (1,188) and authentication tokens (977). The most exposed sectors were government (1,652), financial services (1,594), technology (1,491), telecommunications (1,480) and email (1,427). CNIL received about 5,600 breach notifications in 2024, and more than 145 million records belonging to French residents were exposed across 2024-2025.

Dark-web sellers named in the report include SKYNET (bulk PII and credential sale, 635 items), WhiteMelly (data leak distribution, 614), DevelMakss (combolists, 279), AiCombo (combolist distribution, 194), 587306 (about 2 million PII records described as belonging to French women, offered for $399), ChimeraZ (real estate, hospitality and government data), Saturne (disclosure of the Classic-Days.fr 11GB database, including plaintext passwords, activation keys and source code, linked to an exposed Apache directory listing), Immanuel_Kant (about 489K French documents) and HiddenHq (a claimed 1 billion+ record dataset allegedly sourced via Salesforce, affecting 36 global companies, about 2.3TB). A fraud network (NormalLeVrai/NearLeVrai, with aliases such as Epsilon and PwnerSec) sold fabricated databases impersonating ANTS and CPAM.

In the last six months CloudSEK tagged 213 ransomware victim advisories to France. Qilin (8 advisories, a single victim re-listed repeatedly, Commune d'Eyguires, June 20-21 2026) and MedusaLocker (2 advisories, Mairie Thiverval-Grignon, claiming 162 email addresses) targeted French local government, while LockBit remained a recurring cross-sector presence. Public guidance on these families describes the likely tradecraft. Qilin affiliates use phishing, exploitation of public-facing applications, RDP, compromised MSP ScreenConnect credentials, Cobalt Strike, SmokeLoader, NETXLOADER, PsExec, NetExec, WinRM and WinRAR, followed by double extortion with Rust/C ransomware binaries (CIS, Q2 2025). MedusaLocker actors mostly gain access via vulnerable RDP and phishing, and propagate with a batch file that runs a PowerShell Invoke-ReflectivePEInjection script (CISA AA22-181A). These mechanics come from the cited vendor and government sources, not from the CloudSEK report's own incident analysis.

CloudSEK recorded 742 hacktivism items for France in the last six months. NoName057(16), which operates the DDoSia toolkit, led with DDoS, defacement and CCTV/data-access claims tied to France's policy positions on Ukraine. Named targets include Xsun France and iDrone (#BrokenByte campaign), the Musée National de l'Automobile in Mulhouse, a Renault/Dacia dealership (Groupe GGP) and DDoS claims against the Economy, Justice, Finance and Interior ministries and the Civil Aviation Authority. Independent reporting shows the same group claimed the December 2025 DDoS against La Poste and La Banque Postale, which prompted a Paris prosecutor investigation taken over by the DGSI, and recorded roughly 1,530 successful DDoSia operations between late October 2025 and mid-March 2026 with France the most-targeted country. TerraStress.ST (DDoS-for-hire) and O1s Channel chat V2 (stolen card sales via Telegram) are secondary actors.

Regulatory context: CNIL enforcement has shifted from warnings to penalties, including a EUR 42M fine for Free Mobile/Free (2024 breach, 24.6 million subscriber contracts, 5.1 million IBANs) and EUR 5M for France Travail (up to 43 million job seekers), both in January 2026. Breaches must be notified to CNIL within 72 hours under GDPR Article 33, with parallel NIS2-driven notification duties to ANSSI. The source lists no CVEs, CVSS scores or technical IOCs; severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.006 Windows Remote Management

Execution

T1059.001 PowerShell; T1569.002 Service Execution

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing

Credential Access

T1110.004 Credential Stuffing; T1555 Credentials from Password Stores

Persistence

T1136 Create Account

Command and Control

T1219 Remote Access Tools

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1491.002 External Defacement; T1657 Financial Theft

Collection

T1560.001 Archive via Utility

Stealth

T1620 Reflective Code Loading

Remediation for France ransomware and hacktivism

Patches

  • Patch internet-facing systems on the CISA KEV list, prioritising VPN/firewall and remote-management products abused by ransomware affiliates

Immediate actions

  • Stand up continuous infostealer-log and combolist monitoring against employee and customer credential sets (0-30 days)
  • Enforce MFA universally and deploy credential-stuffing and rate-limiting controls on customer-facing logins (0-30 days)
  • Confirm breach-notification readiness against the 72-hour CNIL clock
  • Reset credentials and revoke sessions and authentication tokens found in infostealer logs

Workarounds

  • Restrict or remove exposed RDP; require MFA and VPN for external remote services
  • Monitor for reflective PE injection via PowerShell, bulk archiving with WinRAR, and unexpected remote-management tool sessions

Longer-term hardening

  • Audit legacy, archived and regional/subsidiary web systems for misconfigurations such as exposed directory listings (30-60 days)
  • Extend ransomware readiness to regional offices and municipalities; inventory third-party vendor controls (60-90 days)
  • Prepare DDoS mitigation for public-facing infrastructure tied to government or policy roles
  • Update incident response playbooks with Qilin and LockBit indicators from CISA #StopRansomware advisories

Affected and fixed versions

  • Various — French public-sector, local-government, financial, telecom, retail and e-commerce organisations

Timeline of France ransomware and hacktivism

  • locked-ioc-6 first appears in March 2022, weeks after Russia's full-scale invasion of Ukraine, and operates the locked-ioc-23 toolkit (day approximate).
  • CISA, FBI, Treasury and FinCEN publish #StopRansomware advisory AA22-181A on locked-ioc-10 (RDP and phishing initial access, RaaS affiliate split of 55-60%).
  • France-tagged dark-web activity is below 300 items per month in mid-2024, the start of CloudSEK's 24-month growth window (day approximate).
  • locked-ioc-26 becomes the leading ransomware threat to US state, local, tribal and territorial governments in Q2 2025 (24% of incidents, up from 9% in Q1), per CIS.
  • locked-ioc-6 claims a DDoS against La Poste and La Banque Postale ahead of Christmas; services are restored by 2025-12-26 and the Paris prosecutor opens an investigation taken over by the DGSI.
  • France-tagged dark-web activity peaks above 1,400 items in January 2026 (about 4x the 2024 baseline); CNIL fines Free Mobile (EUR 42M) and France Travail (EUR 5M) the same month (day approximate).
  • Actor locked-ioc-18 posts an 11GB locked-ioc-3 database (plaintext passwords, activation keys, source code) tied to an exposed Apache directory listing, in June 2026 (day approximate).
  • locked-ioc-26 lists locked-ioc-2 and re-lists the same victim across at least eight advisory postings between 2026-06-20 and 2026-06-21.
  • CloudSEK publishes the France Cyber Threat Outlook covering ~17,800 items, 213 ransomware advisories and 742 hacktivism items for France.

Sources cited for France ransomware and hacktivism

More from NoName057(16)

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats