Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)

Key facts for TL-2026-5508

Detection coverage for TL-2026-5508

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5508 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Oracle EBS CVE-2025-61882 / MOVEit CVE-2023-34362 Exploitation Requests (Cl0p, LEMURLOOT)

Detects HTTP requests matching Cl0p exploitation of internet-facing enterprise apps: POSTs to the Oracle E-Business Suite BI Publisher/Configurator endpoints abused by CVE-2025-61882 (UiServlet, SyndicationServlet; GOLDVEIN.JAVA delivery) and requests to the LEMURLOOT web shell human2.aspx or POSTs to guestaccess.aspx on MOVEit Transfer (CVE-2023-34362). Behaviour-first: keys on endpoint and method, not on source IP.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003
• Data sources: web:access_combined, web:ms:iis:auto, waf_proxy_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=web sourcetype IN ("access_combined","ms:iis:auto") (UiServlet OR SyndicationServlet OR human2.aspx OR guestaccess.aspx)
| eval path=lower(coalesce(uri_path, cs_uri_stem)), method=upper(coalesce(http_method, cs_method)), client=coalesce(src, clientip, c_ip), http_status=coalesce(status, sc_status)
| eval indicator=case(like(path,"%/oa_html/configurator/uiservlet%") AND method="POST", "OracleEBS_CVE-2025-61882_UiServlet", like(path,"%/oa_html/syndicationservlet%") AND method="POST", "OracleEBS_CVE-2025-61882_SyndicationServlet", like(path,"%/human2.aspx"), "MOVEit_CVE-2023-34362_LEMURLOOT_webshell", like(path,"%/guestaccess.aspx") AND method="POST", "MOVEit_CVE-2023-34362_guestaccess_probe", true(), null())
| where isnotnull(indicator)
| fillnull value="n/a" client http_status
| stats count min(_time) as first_seen max(_time) as last_seen values(http_status) as http_status dc(path) as distinct_paths by client, host, indicator
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

union isfuzzy=true
    (W3CIISLog
        | where TimeGenerated > ago(24h)
        | project TimeGenerated, SourceIp = tostring(cIP), Method = tostring(csMethod), Path = tostring(csUriStem), Status = tostring(scStatus), Host = tostring(Computer)),
    (CommonSecurityLog
        | where TimeGenerated > ago(24h)
        | where isnotempty(RequestURL)
        | project TimeGenerated, SourceIp = tostring(SourceIP), Method = tostring(RequestMethod), Path = tostring(RequestURL), Status = tostring(EventOutcome), Host = tostring(DeviceName))
| extend PathL = tolower(Path), MethodU = toupper(Method)
| extend Indicator = case(
    PathL has "/oa_html/configurator/uiservlet" and MethodU == "POST", "OracleEBS_CVE-2025-61882_UiServlet",
    PathL has "/oa_html/syndicationservlet" and MethodU == "POST", "OracleEBS_CVE-2025-61882_SyndicationServlet",
    PathL has "/human2.aspx", "MOVEit_CVE-2023-34362_LEMURLOOT_webshell",
    PathL has "/guestaccess.aspx" and MethodU == "POST", "MOVEit_CVE-2023-34362_guestaccess_probe",
    "")
| where isnotempty(Indicator)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Statuses = make_set(Status, 10), SamplePaths = make_set(Path, 5) by SourceIp, Host, Indicator

Sigma

title: Oracle EBS CVE-2025-61882 and MOVEit CVE-2023-34362 Exploitation Requests
id: 3b7f2c10-5d4e-4a8b-9c61-0e2f7a1d5b01
status: experimental
description: Detects web requests to Oracle E-Business Suite endpoints abused by Cl0p for CVE-2025-61882 (GOLDVEIN.JAVA delivery) and to the LEMURLOOT web shell or guestaccess.aspx on MOVEit Transfer (CVE-2023-34362).
references:
    - https://www.helpnetsecurity.com/2025/10/06/cl0p-oracle-data-theft-extortion-cve-2025-61882/
    - https://www.resecurity.com/blog/article/cve-2025-61882-mass-exploitation-oracle-e-business-suite-ebs-under-attack-by-cl0p-ransomware
    - https://netlas.io/blog/top_10_critical_threat_actors/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - cve.2025-61882
    - cve.2023-34362
logsource:
    category: webserver
detection:
    selection_oracle:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/OA_HTML/configurator/UiServlet'
            - '/OA_HTML/SyndicationServlet'
    selection_moveit_shell:
        cs-uri-stem|endswith: '/human2.aspx'
    selection_moveit_probe:
        cs-method: 'POST'
        cs-uri-stem|endswith: '/guestaccess.aspx'
    condition: 1 of selection_*
falsepositives:
    - Legitimate Oracle EBS Configurator or Syndication use by authenticated internal users
    - MOVEit guest-access workflows by sanctioned external partners
level: critical

Known false positives:

• Authenticated internal users legitimately invoking Oracle EBS Configurator or Syndication servlets
• Sanctioned external partners using MOVEit guestaccess.aspx for file exchange

Tuning notes: Restrict to internet-facing EBS/MOVEit hosts and exclude known partner source ranges. Treat any hit on human2.aspx as a confirmed web shell. Adjust the index/sourcetype to match your web telemetry; for Oracle EBS on Linux forward the Apache/OHS access log as access_combined.

• 🔒 Entra ID Password Spraying Followed by Successful Sign-in (APT29, Scattered Spider) · unlock with TL Creds
• 🔒 Ransomware Impact: Recovery Inhibition and Akira/Qilin Ransom Note Artifacts (Akira, LockBit, Qilin, DragonForce) · unlock with TL Creds
• 🔒 Community-Observed C2 Infrastructure and ngrok Tunnel Domains (TL_OSINT_Scan) · unlock with TL Creds
• 🔒 Web Server Process Spawning Shell or Recon Tools (VersaMem, GOLDVEIN.JAVA, LEMURLOOT, OilRig Web Shell) · unlock with TL Creds
• 🔒 BYOVD Vulnerable Driver Load, Drop and Kernel Service Creation: [indicator] and [indicator] (DragonForce) · unlock with TL Creds
• 🔒 Phantom DLL Side-Loading of SessionEnv/TSVIPSrv Components by svchost (Lazarus) · unlock with TL Creds
• 🔒 Credential Access: LSASS Dumping, Mimikatz and Qilin GPO [indicator] Harvesting (LockBit, Scattered Spider, Akira, Qilin) · unlock with TL Creds
• 🔒 Rclone, MEGAsync, ngrok and FRP Tunnel/Exfil Tool Execution (Cl0p, DragonForce, OilRig, Volt Typhoon) · unlock with TL Creds

Indicators of compromise for TL-2026-5508

As of 2026-11-07, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5508.

How Top 10 Critical Threat Actors to Watch in 2026 works

This record tracks a secondary vendor roundup published by Netlas on 2026-01-23 that profiles ten actors defenders should prioritize in 2026. Claims below were corroborated where possible against primary or trade reporting; remaining actor details are as reported by Netlas.

Ransomware and extortion: Akira (aliases GOLDSAHARA/GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Storm-1567) runs double extortion with a C++ v1 locker, the Megazord variant and a Rust-based Akira_v2, targeting Windows, Linux, VMware ESXi and Hyper-V. Initial access is via VPN weaknesses, notably CVE-2024-40766, an improper access control flaw in SonicWall SonicOS (Gen 5, Gen 6 and Gen 7 up to 7.0.1-5035) that CISA added to the KEV catalog; the group had claimed roughly $244M in proceeds by late September 2025 and has been reported targeting Nutanix AHV. DragonForce (Water Tambanakua) operates a cartel-style affiliate model with a hybrid locker built from LockBit 3.0 and Conti v3 code and a BYOVD loader abusing TrueSight.sys and RentDrv.sys, using AdFind, SoftPerfect, Rclone and MegaSync. Qilin (Agenda) uses an 80-85% affiliate commission model, a Rust Qilin.B variant, Linux ELF encryptors, GPO-deployed IPScanner.ps1 credential harvesting and the .NET CountLoader. LockBit (Water Selkie) was disrupted by Operation Cronos in February 2024 and relaunched as LockBit 5.0 in September 2025 (Windows, Linux, ESXi), alongside StealBit, PsExec, WMI, Cobalt Strike and Mimikatz.

Identity and data-theft crews: Scattered Spider (UNC3944, Octo Tempest, Muddled Libra, Storm-0875) relies on vishing, Evilginx2 AiTM phishing, OAuth token theft, Mimikatz and the Spectre RAT, and adopted DragonForce ransomware in April 2025 against retailers, insurers and airlines. Cl0p (Lace Tempest, FIN11, TA505, Graceful Spider) is a data-theft extortion actor that exploited MOVEit (CVE-2023-34362, LEMURLOOT web shell) and, as a zero-day from at least 2025-08-09, Oracle E-Business Suite BI Publisher Integration CVE-2025-61882 (CVSS 9.8, unauthenticated RCE over HTTP, EBS 12.2.3-12.2.14), using the GOLDVEIN.JAVA downloader, Cobalt Strike and Rclone.

State-sponsored: Lazarus (Hidden Cobra, APT38, BlueNoroff, Diamond Sleet) is credited with about $2.02B of cryptocurrency theft in 2025 using PondRAT, ThemeForestRAT, RemotePE, ScoringMathTea, VSingle and Agamemnon, social-engineered via LinkedIn/Telegram lures and fake Calendly/Zoom pages, with DLL side-loading. Volt Typhoon (Vanguard Panda, Bronze Silhouette, UNC3236) pre-positions in US and allied critical infrastructure using KV-botnet SOHO routers, customized FRP and SockDetour, and exploited Versa Director zero-day CVE-2024-39717 to deploy the VersaMem Java web shell against ISPs/MSPs (Black Lotus Labs observed exploitation traffic since 2024-06-12; fixed in later Versa releases after notification on 2024-07-26). APT29 (Midnight Blizzard, Cozy Bear, NOBELIUM) uses password spraying, cloud valid accounts, OAuth app abuse, and the GRAPELOADER/WINELOADER loaders against Western governments and diplomatic targets. OilRig (APT34, Earth Simnavaz, Hazel Sandstorm) weaponized Windows kernel TOCTOU privilege escalation CVE-2024-30088 (patched June 2024) in a Gulf-region campaign reported by Trend Micro in October 2024: web shell on a vulnerable server, ngrok, RunPE-In-Memory to run the exploit, then the STEALHOOK Exchange-based backdoor that emails harvested data as attachments.

Defensive priorities highlighted by the source: treat identity as Tier 0, deploy phishing-resistant MFA, block vulnerable drivers, keep immutable backups, shorten patch cycles on internet-facing systems, and use behavior-based detection for living-off-the-land activity. The source supplies no network IOCs; hashes, IPs and domains must come from the primary reports linked in references.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1110.003 Password Spraying

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares

Command and Control

T1071.004 DNS; T1572 Protocol Tunneling

Initial Access

T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1566.004 Spearphishing Voice

Collection

T1114 Email Collection

Impact

T1490 Inhibit System Recovery

Persistence

T1505.003 Web Shell

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Defense Evasion

T1574.001 DLL

defense-impairment

T1685 Disable or Modify Tools

Remediation for Top 10 Critical Threat Actors to Watch in 2026

Patches

• SonicWall SonicOS firmware update for CVE-2024-40766
• Oracle Security Alert for CVE-2025-61882
• Versa Director update for CVE-2024-39717
• Microsoft June 2024 update for CVE-2024-30088
• Progress MOVEit Transfer update for CVE-2023-34362

Immediate actions

• Patch or upgrade SonicWall SonicOS for CVE-2024-40766, reset local SSL-VPN credentials and enforce MFA on VPN access
• Apply Oracle's patch for CVE-2025-61882 and review EBS hosts against Oracle-published IOCs
• Patch Versa Director (CVE-2024-39717) and restrict the high-availability port from untrusted networks
• Apply Microsoft June 2024 patches for CVE-2024-30088 and the MOVEit fix for CVE-2023-34362
• Hunt for Rclone, MegaSync, ngrok, AdFind and Mimikatz on servers where they are not expected

Workarounds

• Restrict management and SSL-VPN interfaces to trusted source addresses
• Do not expose Oracle EBS or Versa Director management interfaces to the internet
• Block outbound ngrok and unsanctioned cloud-storage exfiltration traffic

Longer-term hardening

• Treat identity as Tier 0 with phishing-resistant (FIDO2) MFA and helpdesk verification against vishing
• Deploy a vulnerable-driver blocklist to counter BYOVD (TrueSight.sys, RentDrv.sys)
• Maintain immutable, offline backups and protect hypervisors (ESXi, Hyper-V, Nutanix AHV)
• Monitor Entra ID and Exchange Online for password spraying, rogue OAuth apps and anomalous mailbox searches
• Shorten patch cycles for internet-facing VPN, file-transfer, ERP and SD-WAN systems

Affected and fixed versions

• SonicWall — SonicOS (Gen 5, Gen 6, Gen 7 SSL-VPN/management access)
  Vulnerable versions: Gen 7 SonicOS 7.0.1-5035 and older; Gen 5; Gen 6
  Fixed in: Latest SonicWall firmware per vendor advisory
• Oracle — E-Business Suite (BI Publisher Integration / Concurrent Processing)
  Vulnerable versions: 12.2.3 through 12.2.14
  Fixed in: Oracle Security Alert CVE-2025-61882 patch
• Progress — MOVEit Transfer
  Vulnerable versions: Versions prior to the 2023 fix for CVE-2023-34362
  Fixed in: Vendor-patched releases
• Versa Networks — Versa Director
  Vulnerable versions: 21.2.3; 22.1.2; 22.1.3
  Fixed in: Later releases per Versa advisory
• Microsoft — Windows Kernel
  Vulnerable versions: Windows builds prior to June 2024 security update
  Fixed in: June 2024 cumulative updates

Timeline of Top 10 Critical Threat Actors to Watch in 2026

• 2024-06-12 Black Lotus Labs observes traffic from SOHO routers exploiting Versa Director CVE-2024-39717 as a zero-day to deploy the locked-ioc-17 web shell
• 2024-07-26 Versa privately alerts customers after Black Lotus Labs reported the flaw on 2024-07-20
• 2024-09-10 Help Net Security reports CISA confirmed SonicWall CVE-2024-40766 exploitation and added it to the KEV catalog amid Akira ransomware activity
• 2024-10-01 Trend Micro reports OilRig/Earth Simnavaz exploiting CVE-2024-30088 and deploying the locked-ioc-13 Exchange backdoor against UAE and Gulf targets
• 2025-04-01 Scattered Spider adopts DragonForce ransomware in April 2025, followed by retail (M&S, Co-op) intrusions
• 2025-08-09 First known exploitation of Oracle EBS by Cl0p (CrowdStrike: Graceful Spider) ahead of CVE-2025-61882 disclosure
• 2025-09-01 LockBit 5.0 resurfaces in September 2025 with Windows, Linux and ESXi variants
• 2025-10-06 Oracle patches CVE-2025-61882 and confirms Cl0p data-theft and extortion campaign against EBS customers
• 2025-11-14 CISA warns Akira is now targeting Nutanix AHV virtual machines
• 2026-01-23 Netlas publishes the Top 10 Critical Threat Actors to Watch in 2026 roundup

Sources cited for Top 10 Critical Threat Actors to Watch in 2026

• CVE-2025-61882 Mass Exploitation: Oracle EBS Under Attack by Cl0p (Resecurity) resecurity.com · Research
• Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against UAE and Gulf Regions (Trend Micro) Trend Micro · Research
• Top 10 Critical Threat Actors to Watch in 2026 (Netlas) netlas.io · Blog · 2026-01-23
• CISA confirms that SonicWall vulnerability is getting exploited (CVE-2024-40766) Help Net Security · News · 2024-09-10
• CISA flags imminent threat as Akira ransomware starts hitting Nutanix AHV The Register · News · 2025-11-14
• Akira Ransomware Actors Exploit SonicWall Bug for RCE Dark Reading · News
• Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882) Help Net Security · News · 2025-10-06
• Chinese Volt Typhoon hackers exploited Versa zero-day to breach ISPs, MSPs BleepingComputer · News
• Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717) Help Net Security · News
• OilRig Exploits Windows Kernel Flaw in Cyber Espionage Campaign Targeting UAE and Gulf The Hacker News · News · 2024-10-01

More in threat intel

• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism
• Insider Threat: FBI Supervisory Special Agent Pleads Guilty to Stealing $2.4M in Crypto Seized from Nation-State Hackers and Crime Victims

More from Akira

• Ransomware Targeting of Backup Infrastructure: Akira/Fog/Frag Exploiting Veeam CVE-2024-40711, Plus CVE-2025-23120 and March 2026 Backup & Replication Flaws (CVE-2026-21666/21667/21708)
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• Akira Ransomware Attack Collapses 158-Year-Old UK Logistics Firm KNP (Knights of Old) After Guessed Employee Password
• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• Akira Ransomware Attack Reconstructed: RDP Access, Procdump Credential Dumping, GOST Tunnel, Rclone Exfiltration
• The First 24 Hours of a Ransomware Intrusion: Exfiltration, Credential Theft and Backup Targeting (Akira, REDBIKE, AGENDA)

Other reports on CVE-2024-40766

• ThreatsDay Roundup: AI API Key Leaks (OpenCode Console), PingCAP Source Code Theft, Zeabur Breach, NVIDIA AIStore CVE-2026-65162, Signal CVE-2026-113380, Laravel CVE-2026-114509
• #StopRansomware: SafePay Ransomware (CISA AA26-293A) — Exploitation of Cisco ASA/FTD, Veeam B&R and SonicWall SonicOS
• Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices
• Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender
• SEO Poisoning Supply Chain Campaign Distributing Akira Ransomware via Trojanized Enterprise Software
• Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)

Other reports on CVE-2025-61882

• Q1 2026 Industrial Cybersecurity Incidents: Sandworm/Static Tundra Polish Energy Wiper Attempts, Handala Intune Wipe of Stryker, DragonForce Ransomware at Hazeldenes
• Oracle October 2026 Critical Patch Update - 1,295 Patches Incl. Maximum-Severity E-Business Suite Workflow Flaw (CVE-2026-101809)
• Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)
• ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leak
• ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour Extortion
• Estée Lauder Data Breach via Oracle E-Business Suite Zero-Day (CVE-2025-61882) — Clop Exploitation

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors