# France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

> CloudSEK reports a fourfold rise in France-tagged underground threat activity over 24 months (~17,800 items), driven by stolen credentials, infostealer logs, ransomware and pro-Russian hacktivism. Qilin and MedusaLocker hit French local government in the last 6 months, while NoName057(16) led DDoS and CCTV-access claims tied to France's support for Ukraine.

- **Published:** 2026-11-06T19:50:28Z
- **Last reviewed:** 2026-11-06T19:50:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5442
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5442.png
- **ID:** TL-2026-5442
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** NoName057(16)
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (1 shown free below)

## Description

CloudSEK's France Cyber Threat Outlook (published 2026-07-23) analyses roughly 17,800 France-tagged items collected over 24 months across dark-web, ransomware and hacktivism monitoring modules. Dark-web volume grew from under 300 items per month in mid-2024 to a peak above 1,400 in January 2026. CloudSEK characterises the surge as a commodity cybercrime supply chain (infostealer logs, scraped databases and combolists) rather than a single coordinated campaign. The most common exposed data types were account credentials (4,447) and credential collections (4,360), followed by combined datasets (4,011), breached records (3,565), customer records (2,380), financial fraud data (1,188) and authentication tokens (977). The most exposed sectors were government (1,652), financial services (1,594), technology (1,491), telecommunications (1,480) and email (1,427). CNIL received about 5,600 breach notifications in 2024, and more than 145 million records belonging to French residents were exposed across 2024-2025.

Dark-web sellers named in the report include SKYNET (bulk PII and credential sale, 635 items), WhiteMelly (data leak distribution, 614), DevelMakss (combolists, 279), AiCombo (combolist distribution, 194), 587306 (about 2 million PII records described as belonging to French women, offered for $399), ChimeraZ (real estate, hospitality and government data), Saturne (disclosure of the Classic-Days.fr 11GB database, including plaintext passwords, activation keys and source code, linked to an exposed Apache directory listing), Immanuel_Kant (about 489K French documents) and HiddenHq (a claimed 1 billion+ record dataset allegedly sourced via Salesforce, affecting 36 global companies, about 2.3TB). A fraud network (NormalLeVrai/NearLeVrai, with aliases such as Epsilon and PwnerSec) sold fabricated databases impersonating ANTS and CPAM.

In the last six months CloudSEK tagged 213 ransomware victim advisories to France. Qilin (8 advisories, a single victim re-listed repeatedly, Commune d'Eyguires, June 20-21 2026) and MedusaLocker (2 advisories, Mairie Thiverval-Grignon, claiming 162 email addresses) targeted French local government, while LockBit remained a recurring cross-sector presence. Public guidance on these families describes the likely tradecraft. Qilin affiliates use phishing, exploitation of public-facing applications, RDP, compromised MSP ScreenConnect credentials, Cobalt Strike, SmokeLoader, NETXLOADER, PsExec, NetExec, WinRM and WinRAR, followed by double extortion with Rust/C ransomware binaries (CIS, Q2 2025). MedusaLocker actors mostly gain access via vulnerable RDP and phishing, and propagate with a batch file that runs a PowerShell Invoke-ReflectivePEInjection script (CISA AA22-181A). These mechanics come from the cited vendor and government sources, not from the CloudSEK report's own incident analysis.

CloudSEK recorded 742 hacktivism items for France in the last six months. NoName057(16), which operates the DDoSia toolkit, led with DDoS, defacement and CCTV/data-access claims tied to France's policy positions on Ukraine. Named targets include Xsun France and iDrone (#BrokenByte campaign), the Musée National de l'Automobile in Mulhouse, a Renault/Dacia dealership (Groupe GGP) and DDoS claims against the Economy, Justice, Finance and Interior ministries and the Civil Aviation Authority. Independent reporting shows the same group claimed the December 2025 DDoS against La Poste and La Banque Postale, which prompted a Paris prosecutor investigation taken over by the DGSI, and recorded roughly 1,530 successful DDoSia operations between late October 2025 and mid-March 2026 with France the most-targeted country. TerraStress.ST (DDoS-for-hire) and O1s Channel chat V2 (stolen card sales via Telegram) are secondary actors.

Regulatory context: CNIL enforcement has shifted from warnings to penalties, including a EUR 42M fine for Free Mobile/Free (2024 breach, 24.6 million subscriber contracts, 5.1 million IBANs) and EUR 5M for France Travail (up to 43 million job seekers), both in January 2026. Breaches must be notified to CNIL within 72 hours under GDPR Article 33, with parallel NIS2-driven notification duties to ANSSI. The source lists no CVEs, CVSS scores or technical IOCs; severity is analyst-assigned.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1110.004 Credential Stuffing
- T1555 Credentials from Password Stores
- T1059.001 PowerShell
- T1569.002 Service Execution
- T1136 Create Account
- T1620 Reflective Code Loading
- T1021.001 Remote Desktop Protocol
- T1021.006 Windows Remote Management
- T1560.001 Archive via Utility
- T1219 Remote Access Tools
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1491.002 External Defacement
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Invoke-ReflectivePEInjection PowerShell Execution (MedusaLocker) — TL-2026-5442** (`TL-2026-5442-SPL-001`)

Detects PowerShell script blocks (4104) or process command lines invoking Invoke-ReflectivePEInjection, or the underlying VirtualAlloc/CreateRemoteThread/PEBytes reflective PE loading pattern. CISA AA22-181A documents MedusaLocker spreading via a batch file that runs this script; MedusaLocker hit French local government (Mairie Thiverval-Grignon) per the France Cyber Threat Outlook. The VirtualAlloc/CreateRemoteThread branch also covers classic remote-thread process injection (T1055).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1620, T1055
- **Data sources:** powershell_scriptblock_4104, sysmon, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows earliest=-24h ((sourcetype="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104) OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)) | eval content=coalesce(ScriptBlockText, CommandLine) | eval lc=lower(content) | where like(lc, "%invoke-reflectivepeinjection%") OR (like(lc, "%virtualalloc%") AND like(lc, "%createremotethread%") AND like(lc, "%pebytes%")) | eval snippet=substr(content, 1, 300), actor=coalesce(User, user, "unknown") | stats count min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sources values(ParentImage) as parent_image values(snippet) as sample by host, actor | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lookback = 24h;
union
(DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has "Invoke-ReflectivePEInjection"
| project Timestamp, DeviceName, AccountName, Evidence=ProcessCommandLine, Source="DeviceProcessEvents"),
(DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "PowerShellCommand"
| where AdditionalFields has "Invoke-ReflectivePEInjection" or (AdditionalFields has "VirtualAlloc" and AdditionalFields has "CreateRemoteThread" and AdditionalFields has "PEBytes")
| project Timestamp, DeviceName, AccountName, Evidence=tostring(AdditionalFields), Source="DeviceEvents")
| order by Timestamp desc
```

### Sigma

```yaml
title: Invoke-ReflectivePEInjection PowerShell Script Block (MedusaLocker)
id: 5d3b7a1e-2c4f-4e8a-9b61-7a0c3f2d8e11
status: experimental
description: Detects PowerShell script blocks invoking Invoke-ReflectivePEInjection or the reflective PE loading API pattern, used to spread MedusaLocker via batch file (CISA AA22-181A).
references:
    - https://ic3.gov/CSA/2022/220630.pdf
    - https://www.cloudsek.com/blog/france-dark-web-ransomware-hacktivism-report
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1620
    - attack.privilege_escalation
    - attack.t1055
logsource:
    category: ps_script
    product: windows
detection:
    selection_name:
        ScriptBlockText|contains: 'Invoke-ReflectivePEInjection'
    selection_api:
        ScriptBlockText|contains|all:
            - 'VirtualAlloc'
            - 'CreateRemoteThread'
            - 'PEBytes'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team or penetration test using PowerSploit
level: high
```

**Known false positives:**

- Authorized red team or penetration test using PowerSploit
- Security tooling or lab scripts that bundle PowerSploit modules

**Tuning notes:** Requires PowerShell Script Block Logging (4104) and Sysmon EventID 1. Adjust the index name to your Windows data. Exclude known red-team hosts via a host lookup. The API-pattern branch can be dropped if noisy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- External RDP Logon Following Credential-Stuffing Burst — TL-2026-5442 (locked: unlock with TL Creds)
- Ransomware Recovery Inhibition and Backup Service Stop — TL-2026-5442 (locked: unlock with TL Creds)
- WinRM Remote Shell Lateral Movement (NetExec / winrs) — TL-2026-5442 (locked: unlock with TL Creds)
- ScreenConnect Client Spawning Shells or LOLBins (Compromised MSP Access) — TL-2026-5442 (locked: unlock with TL Creds)
- Local Account Creation and Administrator Group Addition — TL-2026-5442 (locked: unlock with TL Creds)
- Connection to Community-Observed Cobalt Strike Infrastructure — TL-2026-5442 (locked: unlock with TL Creds)
- WinRAR/RAR Data Staging Archive Creation (Qilin) — TL-2026-5442 (locked: unlock with TL Creds)
- PsExec / NetExec Remote Service Execution (Qilin Lateral Movement) — TL-2026-5442 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 26)

Defanged, TLP:CLEAR.

- Domain: `classic-days[.]fr`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [France Cyber Threat Outlook: Dark Web, Ransomware, and Hacktivism Trends (CloudSEK)](https://www.cloudsek.com/blog/france-dark-web-ransomware-hacktivism-report)
- [Qilin Top Ransomware Threat to SLTTs in Q2 2025 (Center for Internet Security)](https://www.cisecurity.org/insights/blog/qilin-top-ransomware-threat-to-sltts-in-q2-2025)
- [#StopRansomware: MedusaLocker (CISA/FBI/Treasury/FinCEN AA22-181A)](https://ic3.gov/CSA/2022/220630.pdf)
- [Pro-Russia hackers claim attack on La Poste (The Record)](https://therecord.media/pro-russia-hackers-claim-attack-la-poste)
- [Pro-Russian hackers claim French postal service cyberattack (Euronews)](https://www.euronews.com/2025/12/24/pro-russian-hackers-claim-french-postal-service-cyberattack)
- [Pro-Russian hacker group gamifies cyberattacks on Europe with crypto rewards (Moscow Times)](https://www.themoscowtimes.com/2026/04/29/pro-russian-hacker-group-gamifies-cyberattacks-on-europe-with-crypto-rewards-investigation)
- [DDoS Threat Intelligence: France (SOCRadar)](https://socradar.io/blog/ddos-threat-intelligence-france-8-dec25/)
- [Qilin Threat Profile (HHS HC3)](https://www.hhs.gov/sites/default/files/qilin-threat-profile-tlpclear.pdf)
- [Qilin Ransomware Analysis: Critical TTPs and Defense (Picus Security)](https://www.picussecurity.com/resource/blog/qilin-ransomware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5442