# Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)

> Netlas roundup (2026-01-23) profiling ten ransomware, cybercrime and state-sponsored actors with aliases, malware, TTPs and target sectors. Named exploited CVEs: Akira via SonicWall CVE-2024-40766, Cl0p via Oracle EBS CVE-2025-61882 and MOVEit CVE-2023-34362, Volt Typhoon via Versa Director CVE-2024-39717, and OilRig via Windows kernel CVE-2024-30088.

- **Published:** 2026-11-07T11:12:10Z
- **Last reviewed:** 2026-11-07T11:12:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5508
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5508.png
- **ID:** TL-2026-5508
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Akira
- **Detections:** 9 (1 shown free below) · **IOCs:** 21
- **CVEs:** CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088

## Description

This record tracks a secondary vendor roundup published by Netlas on 2026-01-23 that profiles ten actors defenders should prioritize in 2026. Claims below were corroborated where possible against primary or trade reporting; remaining actor details are as reported by Netlas.

Ransomware and extortion: Akira (aliases GOLDSAHARA/GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Storm-1567) runs double extortion with a C++ v1 locker, the Megazord variant and a Rust-based Akira_v2, targeting Windows, Linux, VMware ESXi and Hyper-V. Initial access is via VPN weaknesses, notably CVE-2024-40766, an improper access control flaw in SonicWall SonicOS (Gen 5, Gen 6 and Gen 7 up to 7.0.1-5035) that CISA added to the KEV catalog; the group had claimed roughly $244M in proceeds by late September 2025 and has been reported targeting Nutanix AHV. DragonForce (Water Tambanakua) operates a cartel-style affiliate model with a hybrid locker built from LockBit 3.0 and Conti v3 code and a BYOVD loader abusing TrueSight.sys and RentDrv.sys, using AdFind, SoftPerfect, Rclone and MegaSync. Qilin (Agenda) uses an 80-85% affiliate commission model, a Rust Qilin.B variant, Linux ELF encryptors, GPO-deployed IPScanner.ps1 credential harvesting and the .NET CountLoader. LockBit (Water Selkie) was disrupted by Operation Cronos in February 2024 and relaunched as LockBit 5.0 in September 2025 (Windows, Linux, ESXi), alongside StealBit, PsExec, WMI, Cobalt Strike and Mimikatz.

Identity and data-theft crews: Scattered Spider (UNC3944, Octo Tempest, Muddled Libra, Storm-0875) relies on vishing, Evilginx2 AiTM phishing, OAuth token theft, Mimikatz and the Spectre RAT, and adopted DragonForce ransomware in April 2025 against retailers, insurers and airlines. Cl0p (Lace Tempest, FIN11, TA505, Graceful Spider) is a data-theft extortion actor that exploited MOVEit (CVE-2023-34362, LEMURLOOT web shell) and, as a zero-day from at least 2025-08-09, Oracle E-Business Suite BI Publisher Integration CVE-2025-61882 (CVSS 9.8, unauthenticated RCE over HTTP, EBS 12.2.3-12.2.14), using the GOLDVEIN.JAVA downloader, Cobalt Strike and Rclone.

State-sponsored: Lazarus (Hidden Cobra, APT38, BlueNoroff, Diamond Sleet) is credited with about $2.02B of cryptocurrency theft in 2025 using PondRAT, ThemeForestRAT, RemotePE, ScoringMathTea, VSingle and Agamemnon, social-engineered via LinkedIn/Telegram lures and fake Calendly/Zoom pages, with DLL side-loading. Volt Typhoon (Vanguard Panda, Bronze Silhouette, UNC3236) pre-positions in US and allied critical infrastructure using KV-botnet SOHO routers, customized FRP and SockDetour, and exploited Versa Director zero-day CVE-2024-39717 to deploy the VersaMem Java web shell against ISPs/MSPs (Black Lotus Labs observed exploitation traffic since 2024-06-12; fixed in later Versa releases after notification on 2024-07-26). APT29 (Midnight Blizzard, Cozy Bear, NOBELIUM) uses password spraying, cloud valid accounts, OAuth app abuse, and the GRAPELOADER/WINELOADER loaders against Western governments and diplomatic targets. OilRig (APT34, Earth Simnavaz, Hazel Sandstorm) weaponized Windows kernel TOCTOU privilege escalation CVE-2024-30088 (patched June 2024) in a Gulf-region campaign reported by Trend Micro in October 2024: web shell on a vulnerable server, ngrok, RunPE-In-Memory to run the exploit, then the STEALHOOK Exchange-based backdoor that emails harvested data as attachments.

Defensive priorities highlighted by the source: treat identity as Tier 0, deploy phishing-resistant MFA, block vulnerable drivers, keep immutable backups, shorten patch cycles on internet-facing systems, and use behavior-based detection for living-off-the-land activity. The source supplies no network IOCs; hashes, IPs and domains must come from the primary reports linked in references.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.004 Spearphishing Voice
- T1078.004 Cloud Accounts
- T1505.003 Web Shell
- T1685 Disable or Modify Tools
- T1574.001 DLL
- T1003.001 LSASS Memory
- T1110.003 Password Spraying
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1114 Email Collection
- T1572 Protocol Tunneling
- T1071.004 DNS
- T1567.002 Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Oracle EBS CVE-2025-61882 / MOVEit CVE-2023-34362 Exploitation Requests (Cl0p, LEMURLOOT)** (`TL-2026-5508-SPL-001`)

Detects HTTP requests matching Cl0p exploitation of internet-facing enterprise apps: POSTs to the Oracle E-Business Suite BI Publisher/Configurator endpoints abused by CVE-2025-61882 (UiServlet, SyndicationServlet; GOLDVEIN.JAVA delivery) and requests to the LEMURLOOT web shell human2.aspx or POSTs to guestaccess.aspx on MOVEit Transfer (CVE-2023-34362). Behaviour-first: keys on endpoint and method, not on source IP.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003
- **Data sources:** web:access_combined, web:ms:iis:auto, waf_proxy_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype IN ("access_combined","ms:iis:auto") (UiServlet OR SyndicationServlet OR human2.aspx OR guestaccess.aspx)
| eval path=lower(coalesce(uri_path, cs_uri_stem)), method=upper(coalesce(http_method, cs_method)), client=coalesce(src, clientip, c_ip), http_status=coalesce(status, sc_status)
| eval indicator=case(like(path,"%/oa_html/configurator/uiservlet%") AND method="POST", "OracleEBS_CVE-2025-61882_UiServlet", like(path,"%/oa_html/syndicationservlet%") AND method="POST", "OracleEBS_CVE-2025-61882_SyndicationServlet", like(path,"%/human2.aspx"), "MOVEit_CVE-2023-34362_LEMURLOOT_webshell", like(path,"%/guestaccess.aspx") AND method="POST", "MOVEit_CVE-2023-34362_guestaccess_probe", true(), null())
| where isnotnull(indicator)
| fillnull value="n/a" client http_status
| stats count min(_time) as first_seen max(_time) as last_seen values(http_status) as http_status dc(path) as distinct_paths by client, host, indicator
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
union isfuzzy=true
    (W3CIISLog
        | where TimeGenerated > ago(24h)
        | project TimeGenerated, SourceIp = tostring(cIP), Method = tostring(csMethod), Path = tostring(csUriStem), Status = tostring(scStatus), Host = tostring(Computer)),
    (CommonSecurityLog
        | where TimeGenerated > ago(24h)
        | where isnotempty(RequestURL)
        | project TimeGenerated, SourceIp = tostring(SourceIP), Method = tostring(RequestMethod), Path = tostring(RequestURL), Status = tostring(EventOutcome), Host = tostring(DeviceName))
| extend PathL = tolower(Path), MethodU = toupper(Method)
| extend Indicator = case(
    PathL has "/oa_html/configurator/uiservlet" and MethodU == "POST", "OracleEBS_CVE-2025-61882_UiServlet",
    PathL has "/oa_html/syndicationservlet" and MethodU == "POST", "OracleEBS_CVE-2025-61882_SyndicationServlet",
    PathL has "/human2.aspx", "MOVEit_CVE-2023-34362_LEMURLOOT_webshell",
    PathL has "/guestaccess.aspx" and MethodU == "POST", "MOVEit_CVE-2023-34362_guestaccess_probe",
    "")
| where isnotempty(Indicator)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Statuses = make_set(Status, 10), SamplePaths = make_set(Path, 5) by SourceIp, Host, Indicator
```

### Sigma

```yaml
title: Oracle EBS CVE-2025-61882 and MOVEit CVE-2023-34362 Exploitation Requests
id: 3b7f2c10-5d4e-4a8b-9c61-0e2f7a1d5b01
status: experimental
description: Detects web requests to Oracle E-Business Suite endpoints abused by Cl0p for CVE-2025-61882 (GOLDVEIN.JAVA delivery) and to the LEMURLOOT web shell or guestaccess.aspx on MOVEit Transfer (CVE-2023-34362).
references:
    - https://www.helpnetsecurity.com/2025/10/06/cl0p-oracle-data-theft-extortion-cve-2025-61882/
    - https://www.resecurity.com/blog/article/cve-2025-61882-mass-exploitation-oracle-e-business-suite-ebs-under-attack-by-cl0p-ransomware
    - https://netlas.io/blog/top_10_critical_threat_actors/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - cve.2025-61882
    - cve.2023-34362
logsource:
    category: webserver
detection:
    selection_oracle:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/OA_HTML/configurator/UiServlet'
            - '/OA_HTML/SyndicationServlet'
    selection_moveit_shell:
        cs-uri-stem|endswith: '/human2.aspx'
    selection_moveit_probe:
        cs-method: 'POST'
        cs-uri-stem|endswith: '/guestaccess.aspx'
    condition: 1 of selection_*
falsepositives:
    - Legitimate Oracle EBS Configurator or Syndication use by authenticated internal users
    - MOVEit guest-access workflows by sanctioned external partners
level: critical
```

**Known false positives:**

- Authenticated internal users legitimately invoking Oracle EBS Configurator or Syndication servlets
- Sanctioned external partners using MOVEit guestaccess.aspx for file exchange

**Tuning notes:** Restrict to internet-facing EBS/MOVEit hosts and exclude known partner source ranges. Treat any hit on human2.aspx as a confirmed web shell. Adjust the index/sourcetype to match your web telemetry; for Oracle EBS on Linux forward the Apache/OHS access log as access_combined.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Entra ID Password Spraying Followed by Successful Sign-in (APT29, Scattered Spider) (locked: unlock with TL Creds)
- Ransomware Impact: Recovery Inhibition and Akira/Qilin Ransom Note Artifacts (Akira, LockBit, Qilin, DragonForce) (locked: unlock with TL Creds)
- Community-Observed C2 Infrastructure and ngrok Tunnel Domains (TL_OSINT_Scan) (locked: unlock with TL Creds)
- Web Server Process Spawning Shell or Recon Tools (VersaMem, GOLDVEIN.JAVA, LEMURLOOT, OilRig Web Shell) (locked: unlock with TL Creds)
- BYOVD Vulnerable Driver Load, Drop and Kernel Service Creation: [indicator] and [indicator] (DragonForce) (locked: unlock with TL Creds)
- Phantom DLL Side-Loading of SessionEnv/TSVIPSrv Components by svchost (Lazarus) (locked: unlock with TL Creds)
- Credential Access: LSASS Dumping, Mimikatz and Qilin GPO [indicator] Harvesting (LockBit, Scattered Spider, Akira, Qilin) (locked: unlock with TL Creds)
- Rclone, MEGAsync, ngrok and FRP Tunnel/Exfil Tool Execution (Cl0p, DragonForce, OilRig, Volt Typhoon) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Top 10 Critical Threat Actors to Watch in 2026 (Netlas)](https://netlas.io/blog/top_10_critical_threat_actors/)
- [CISA confirms that SonicWall vulnerability is getting exploited (CVE-2024-40766)](https://www.helpnetsecurity.com/2024/09/10/cve-2024-40766-exploited/)
- [CISA flags imminent threat as Akira ransomware starts hitting Nutanix AHV](https://www.theregister.com/2025/11/14/cisa_akira_ransomware/)
- [Akira Ransomware Actors Exploit SonicWall Bug for RCE](https://darkreading.com/ics-ot-security/akira-ransomware-actors-exploit-sonicwall-bug-for-rce)
- [Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882)](https://www.helpnetsecurity.com/2025/10/06/cl0p-oracle-data-theft-extortion-cve-2025-61882/)
- [CVE-2025-61882 Mass Exploitation: Oracle EBS Under Attack by Cl0p (Resecurity)](https://www.resecurity.com/blog/article/cve-2025-61882-mass-exploitation-oracle-e-business-suite-ebs-under-attack-by-cl0p-ransomware)
- [Chinese Volt Typhoon hackers exploited Versa zero-day to breach ISPs, MSPs](https://www.bleepingcomputer.com/news/security/chinese-volt-typhoon-hackers-exploited-versa-zero-day-to-breach-isps-msps/)
- [Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717)](https://www.helpnetsecurity.com/?p=310099)
- [OilRig Exploits Windows Kernel Flaw in Cyber Espionage Campaign Targeting UAE and Gulf](https://thehackernews.com/2024/10/oilrig-exploits-windows-kernel-flaw-in.html)
- [Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against UAE and Gulf Regions (Trend Micro)](https://www.trendmicro.com/en/research/24/j/earth-simnavaz-cyberattacks.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5508