Expert knowledge from the frontlines of ransomware defense. Industry leaders share actionable intelligence, novel workflows, and cutting-edge research to help you stay ahead of threats.
Expert research and analysis from the frontlines
This report analyzes four leaked operational files from the established Russian-speaking extortion group “Silent Ransom Group” (aka SRG or Luna Moth). These files are internal documents from the SRG group which were leaked on a Tor site and proliferated widely via X (formerly Twitter) on 2026-10-03.
Ransom-ISAC Research Team
October 26, 2026
+9 contributors
Inferno Drainer and its many derivatives constitute arguably the most notorious cryptodrainer-as-a-service ecosystem ever developed. After months spent reverse-engineering its newest payloads and monitoring the ecosystem in real time, one thing seems clear: the operation is in serious decline, and has been for quite some time.
John Marshall & M. Smith
October 5, 2026
+2 contributors
A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encoded in Ethereum transaction destination addresses.
Ellis Stannard & Nick Smart
September 25, 2026
+1 contributor
A Fake “Bot Protection” Prompt Is Stealing Mac Users’ Crypto Wallets, and the Cleanup Is Not Keeping Up
Dani [Varys] Z & Dimple Gajra
September 17, 2026
+3 contributors
CRPx0 is a ClickFix-delivered ransomware-as-a-service operation whose lures impersonate Windows and macOS update prompts and reCAPTCHA checks to trick victims into running a copied command. Ransom-ISAC traces the full killchain — from the ClickFix HTML through a multi-stage DLL loader to cross-platform Python ransomware that exfiltrates data before encrypting with AES-128 and RSA-4096 — with detections, YARA/Sigma logic, MITRE ATT&CK mapping and IOCs.
Ransom-ISAC Research Team
August 27, 2026
+6 contributors
A Billie Eilish superfan, two visible operators and three tested tools sit at the centre of this assessment. Ransom-ISAC analyses BLACKNET-00's ransomware builder, the Shadow Ghost Firebase scanner and the TRK-25 ICS reconnaissance toolkit — separating low-confidence marketing claims from verified, operationally relevant capability.
Ransom-ISAC Research Team
August 19, 2026
+4 contributors
Ransomware and data-extortion groups are moving beyond bulk dumps to analyze, index and price stolen data before it is published or sold — removing the "weaponization tax" and turning breaches into searchable, tranched and targetable assets. Case studies on FulcrumSec, The Gentlemen, Titan, Sentap, ShinyHunters and the Leak Bazaar indexing-as-a-service platform, plus the emerging risk of soft-data pivots.
Mannie W
July 31, 2026
+6 contributors
How a 9,898-row intelligence collection was built from Telegram bot tokens and chat IDs leaking out of malware on VirusTotal — covering 9,678 bot tokens, 9,756 sample hashes, and 6,512 destination chats, enriched via the Bot API and clustered into 854 operator campaigns, with attribution case studies including a crypto-drainer MaaS and an account-takedown service.
Manuel Boll
July 27, 2026
+4 contributors
A coordinated Unified Threat Advisory covering active Cl0p ransomware affiliate exploitation of internet-exposed PTC Windchill and FlexPLM deployments — chaining a pre-auth FlexPLM WSDL information disclosure with a Windchill login servlet flaw for unauthenticated RCE, JSP webshell deployment, and double-extortion data theft.
Brandon Parsons
July 22, 2026
+2 contributors
One malware build split across two unrelated signing chains: a loader signed by a Chinese shell company via Certum, and a stealer signed under a stolen identity via Microsoft Trusted Signing — timestamped 11 days before Microsoft disclosed Fox Tempest, suggesting a Dragon Breath-aligned actor buying certificates from signing-as-a-service brokers.
Alex Necula
July 20, 2026
+3 contributors
Full reverse engineering of a three-stage PatchAgent loader chain assessed as MuddyWater-linked with high confidence — from a regsvr32-executed COM dropper through an AES-256-CBC PTCH v2 container to a functional HTTP shellcode backdoor that hollows notepad.exe and beacons to operator infrastructure, all from ClickFix delivery containing Telegram beaconing.
Ransom-ISAC Research Team
July 15, 2026
+5 contributors
End-to-end reverse engineering of the Kali365 (K365) Microsoft 365 Phishing-as-a-Service operator client, purchased web panel, and payment infrastructure — revealing OAuth device-code phishing (RFC 8628) that satisfies MFA legitimately to steal long-lived refresh tokens.
Ransom-ISAC Research Team
July 3, 2026
+6 contributors
A leaked negotiation transcript and payment-flow analysis of a successful $1 million ransom payment by a U.S. government body to Kairos — a data-extortion actor whose "ransomware group" status remains unverified — including fund tracing to ByBit, OKX, and BELQI exchange touchpoints.
Rakesh Krishnan
July 3, 2026
+3 contributors
Three unrelated Chinese-nexus operators — CoGUI email phishing, the Smishing Triad SMS/iMessage ecosystem, and MirrorFace espionage — converge on Japanese inboxes simultaneously, producing a single-campaign illusion that demands durable behavioral detection over short-lived IoCs.
Md. Azim Uddin & Abdullah Al Mamun
June 25, 2026
+4 contributors
A full malware analysis of Illusion-2.6.5-setup.exe — a deployment of Silent Stealer v2.6.5 and integrated RAT sold as a Malware-as-a-Service and distributed via Telegram under the ShinySpider alias, with an exposed operator panel that maps the complete C2 infrastructure and capability set.
Ransom-ISAC Research Team
May 26, 2026
+5 contributors
Analysis of JA456, a follow-on package to the original Gentlemen Leaks that exposes operator-side artifacts — MEGA session history, a Synology NAS shadow dump, and wipe-in-progress screenshots — yielding rare attribution pivots including an early residential Izhevsk IP.
Ransom-ISAC Research Team
May 26, 2026
+4 contributors
A 120-minute technical intelligence whitepaper analysing the leaked Rocket.Chat corpus of The Gentlemen RaaS — 3,366 messages, 66 confirmed victims, custom G-BOT C2, Fortinet exploitation, AI-assisted operations, and a moderate-high confidence assessment of Black Basta successor lineage.
Ransom-ISAC Research Team
May 15, 2026
+13 contributors
CVE-2026-0300 is a critical unpatched buffer overflow in Palo Alto PAN-OS firewalls that gives unauthenticated attackers root access, with limited exploitation already seen in education, healthcare, and ISP environments and patches not expected until mid-May.
Reyben Cortes
May 6, 2026
+4 contributors
Independent validation, certificate history, and an expanded driver arsenal: a prior 2024 Zhengzhou 403 GlobalSign EV certificate, a hide_process rootkit, and YDArkDrv.sys signed under the same shell company.
Alex Necula & Ellis Stannard
April 29, 2026
+1 contributor
A 0-day BYOVD vulnerability in dragoncore_k.sys signed by Zhengzhou 403 Network Technology, with shell company analysis, Dragon Breath APT-Q-27 attribution, and an APT31 / Wuhan Xiaoruizhi personnel nexus.
Alex Necula & Ellis Stannard
April 22, 2026
+3 contributors
An extortion-minded threat actor known as 0APT breached the Krybit ransomware admin panel — and within hours was counter-hacked by Krybit. A look inside both operations, the chat transcript, and the recovered Android-hosted infrastructure.
Ransom-ISAC Research Team
April 14, 2026
+5 contributors
A Unified Threat Advisory on Iran-linked hackers targeting small U.S. East Coast water utilities via Eclipse 9800i PLCs, and technical details of the TRK25-ADVANCED Python GUI ICS reconnaissance and exfiltration tool.
Reyben Cortes
April 9, 2026
+4 contributors
A threat advisory covering TeamPCP’s multi-stage supply chain campaign through Trivy, npm, LiteLLM, Telnyx, and Axios — with 11 prioritised defensive recommendations for organisations of all sizes.
Ransom-ISAC Research Team
April 3, 2026
+12 contributors
A deep-dive technical reference for SOC teams and threat hunters covering BYOVD attack analysis, kernel driver reverse engineering, KQL detection queries, and defensive hardening with WDAC policies.
Alex Necula
April 3, 2026
+3 contributors
A threat advisory on Bluekit, a phishing-as-a-service platform advertised as an accessible, anonymity-focused alternative to Evilginx Pro and Tycoon2FA — 40+ templates, 2FA interception, device/geolocation spoofing, and no vetting requirements.
Ransom-ISAC Research Team
March 31, 2026
+1 contributor
A DPRK-affiliated social engineering campaign weaponises VS Code trusted features to deliver RATs through fake job interviews, with full attack chain analysis, malware breakdown, infrastructure tracking, and IOCs.
François-Julien Alcaraz & Yashraj Solanki
March 16, 2026
+3 contributors
Complete DFIR analysis of VEN0m ransomware including BYOVD attack chain, 42 behavioral detection queries, MITRE ATT&CK mapping, and trivially recoverable encryption key from a single open-source Rust binary.
Eric Taylor
February 26, 2026
+4 contributors
A case study exploring how deeper insight emerges when analysis moves beyond high-level sector classifications on Dedicated Leak Sites and instead focuses on the specific subsectors within which entities operate.
Jeffrey Bell
February 19, 2026
+3 contributors
A structured intelligence workflow for ransomware leak data collection and LLM-assisted analysis, from automated Tor-based collection to agentic reasoning and intelligence dissemination.
Apurv Singh Gautam
February 6, 2026
+4 contributors
An ethical and reproducible HUMINT-style workflow for safely observing ransomware affiliates using synthetic personas, tactical empathy, and rigorous operational security.
Matthew Maynard
December 29, 2025
+5 contributors
Follow the money through on-chain analysis, tracing stolen funds across BSC and TRON blockchains and connecting wallet addresses directly to other DPRK exchange thefts. Blockchain forensic evidence ties this campaign to a broader pattern of North Korean cryptocurrency operations.
Nick Smart and Andrii Sovershennyi
December 8, 2025
+4 contributors
Deep dive into the adversary infrastructure, operational security measures, and attribution analysis of the DPRK-linked campaign, revealing infrastructure fingerprints, C2 clusters, and connections to known threat groups.
Yashraj Solanki
November 13, 2025
+4 contributors
Detailed analysis of the DEV#POPPER.js RAT and OmniStealer malware used in the sophisticated cross-chain attack campaign, revealing the complete kill chain from initial compromise through data exfiltration.
Ellis Stannard
October 27, 2025
+6 contributors
Deep dive into a sophisticated DPRK-linked attack campaign using novel Cross-Chain TxDataHiding techniques to create takedown-proof C2 infrastructure across TRON, Aptos, and BSC blockchains.
Ellis Stannard
October 20, 2025
+5 contributors
We're building a community of ransomware defense experts. If you have unique insights, novel workflows, or cutting-edge research to share, we want to hear from you.
Email us at contact@ransom-isac.org
Partner with Ransom-ISAC to access high-quality threat intelligence and connect with defenders worldwide.