INC

Ransomware affiliates linked to the INC and The Gentlemen groups have been using an AI-driven intrusion framework called Phantom to automate and scale attacks. The operation leverages commercial AI models via OpenCode and OpenRouter, with human operators approving actions, to exploit vulnerabilities in public-facing systems such as FortiClient, SimpleHelp, cPanel, and SonicWall. The attackers achieve initial access, move laterally using tools like RevSocks and Ghost C2, escalate privileges, exfiltrate sensitive data, and prepare for ransomware deployment. At least 62 organizations were targeted, primarily in the U.S. and within industrial, healthcare, and energy sectors.

The FBI and USSS have issued a warning about the ongoing FortiBleed campaign, which targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The threat actors exploit reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. The campaign has collected over 86,644 valid credentials from 194 countries, enabling lateral movement, privilege escalation, and data exfiltration. Attackers create new administrative accounts for persistence and are suspected to be initial access brokers selling access to ransomware groups such as INC and Lynx.

The DeadLock ransomware operation, active since mid-2025, employs double-extortion tactics by stealing and encrypting data to extort ransom payments. It uses blockchain infrastructure, specifically the Polygon blockchain, to store configuration data and leak site content, making takedown efforts more difficult. The ransomware communicates with victims via a decentralized Session network and hosts stolen data on Wasabi cloud, while using XChaCha20 encryption with Curve25519 key exchange to lock files, appending the '.dlock' extension and dropping ransom notes. Microsoft observed deployment by multiple threat groups, including affiliates linked to Lynx and INC ransomware ecosystems.

The DeadLock ransomware group has adopted a resilient, decentralized infrastructure leveraging Polygon blockchain smart contracts to manage victim communications and data leak operations, making takedown efforts more difficult. The ransomware encrypts files with the '.dlock' extension, uses hybrid encryption (Curve25519 and XChaCha20), and drops an HTML-based interactive recovery note (RECOVERY_CHAT.<UID>.html) that enables end-to-end encrypted chat and access to a blockchain-hosted data leak blog. The HTML note retrieves proxy server addresses via JavaScript interacting with Polygon smart contracts, allowing for censorship-resistant communication. The attackers also use geofencing to avoid certain regions, employ resource throttling, erase logs, and leverage AnyDesk for remote access.

In Q2 2026, multiple ransomware groups remained active, with Qilin emerging as the most prolific based on victims listed on data leak sites. Microsoft disrupted a malware-signing-as-a-service operation run by the threat actor Fox Tempest, which was used by several ransomware groups including Rhysida, Akira, and Qilin. CISA added a Windows local privilege escalation vulnerability (CVE-2026-33825, BlueHammer) to its KEV catalog due to active exploitation in ransomware attacks. Check Point attributed zero-day exploitation of a critical vulnerability in its Remote Access VPN (CVE-2026-50751) to the Qilin ransomware group. Additionally, the PayoutsKing group was observed using QEMU to deploy hidden Alpine Linux-based virtual machines as a stealthy backdoor technique.