Threat Watch · Sep 22, 2026

the gentlemen posted 18 claims in a single batch — a third of the day's 56 — landing in Angola, Colombia, Costa Rica, Portugal, Spain, the UK, Austria, Mexico, Sweden, Canada, Finland, South Africa and the United States. Almost all are family firms with employees in the dozens: an optician, a glass company, a blind manufacturer, a veterinary distributor. STMicroelectronics sits in the middle of that list. The batch says nothing about size and everything about route of access.

Groups and claims

The full table is at Threat Actors. Everything below is a group's own claim, not a confirmed intrusion.

the gentlemen — 18 claims across thirteen countries

One batch roughly the size of every other group's day combined. Worth naming: STMicroelectronics, Europe's largest chipmaker, whose entry records $13.1 billion in revenue; D.W. McMillan Memorial Hospital, a rural hospital in Brewton, Alabama running a 24/7 emergency room, ICU, obstetrics and outpatient chemotherapy since 1954; Guardrisk, the South African specialist insurer that pioneered cell captive insurance in Africa; and PuroClean, North America's largest privately owned property-damage restoration franchise with 500+ locations. The rest are small family businesses: a Portuguese optical chain, a Leeds glass company, a Swedish blind manufacturer, an Austrian sanitary and heating wholesaler, a Mexican magnet-wire distributor, a Costa Rican machinery dealer and a Costa Rican software shop, a Finnish sports institute, an Arkansas seed company. Each entry carries a ZoomInfo-style company profile link.

Sources: RansomLook · RansomLook

metaencryptor — 6 claims, concentrated in manufacturing and supply chain

Astemo is a global automotive parts mega-supplier with roughly 80,000 employees across the United States, Asia, China, Europe and Japan. Flex Ltd is the Austin-headquartered contract manufacturer and supply-chain company whose entry describes its data center and AI customers. Bruker is the Massachusetts scientific instruments company whose products are used in life sciences, pharmaceuticals, materials science and semiconductor research. HyVision System is a Korean manufacturer of test and measurement equipment for mobile camera modules. The other two are Hudson MD Group, a New Jersey multispecialty medical group, and Visual Intelligence. Four of the six sit in manufacturing or measurement equipment.

Sources: ransomware.live · ransomware.live

doommageddon — Charlottesville Police Department, listed as upcoming

The entry's status is upcoming, with no data size and no file count yet, and a deadline of September 30, 2026. A US municipal law enforcement agency on a leak site is an uncommon category of claim.

Sources: ransomware.live

n0n — FinSoft, a retail back-office software vendor

A retail software and IT services vendor in Uzbekistan. What the entry lists is not the company's own data but the client databases of more than ten retail chains it serves — keddo, marc, lancaster, comf_rus and others — covering sales, stock, pricing and financial records, plus back-office platform and API service data. One intrusion, a dozen downstream lines.

Sources: ransomware.live

storm — 3 claims, all small organisations holding dense records

Manroc Developments, an Ontario mining contractor with 30 years and 70+ projects behind it; The Money Store, a New Jersey residential mortgage lender; and TrueCore Behavioral Solutions in Tampa, which provides behavioral treatment for at-risk adjudicated youth aged 13 to 21. Mortgage files and juvenile behavioral treatment records carry far more per-document sensitivity than the size of either organisation suggests.

Sources: RansomLook · RansomLook

global secret group — 2 claims, two orders of magnitude apart

Allied Supply Co. of Ohio, an industrial machinery wholesaler with $8 million revenue, is listed at 25.3 GB across 32,019 files. Kjla, a broadcaster with $6.7 million revenue, is listed at 783 GB across 501,662 files in 42,890 folders. Comparable companies, thirty times the data — a media organisation's storage profile is not a wholesaler's.

Sources: ransomware.live · ransomware.live

termite — 3 claims: Sealcon, a Colorado cable management supplier; theLender, a wholesale mortgage company; and TruAmerica Multifamily, a US multifamily real estate investment and asset management firm.

Sources: ransomware.live

One claim, two group names, and a victim name that is two companies

"Hogan Lovells Cadwalader" appears under SilentRansomGroup on ransomware.live and under leakeddata on RansomLook. ransomware.live's own annotation flags that the name corresponds to no single entity: Hogan Lovells and Cadwalader, Wickersham & Taft are two separate international law firms. A forked group name on top of a merged victim name means this record miscounts under any tally keyed on either.

Sources: ransomware.live · RansomLook

The rest: panzer with 4 (including the previously reported Universität Hamburg, plus small technology firms in Brazil, France and Latin America), nightspire with 2, qilin with 2 (Ikegami Tsushinki in Japan and Telrad Networks in Israel), play with 2 (United States and Norway), inc ransom with 2, and one each from akira, anubis, secp0, moneymessage, endzone, unsafe, lockbit5, dragonforce and 3am. Across both trackers the day totals 22 groups and 56 claims.

Campaigns and activity

PAYLOAD ransomware — no encryption, no binary, Active Directory Group Policy instead

Kaspersky GERT published a technical incident analysis of a PAYLOAD ransomware operation with two defining characteristics: encryptionless and binary-less. It does not encrypt files and does not drop a ransomware binary on the host, abusing the Active Directory mechanisms for managing Group Policy Objects instead. For defenders whose detection rests on observing encryption behaviour or on catching a ransomware sample, this operation triggers neither.

Sources: Securelist

Vidar — string obfuscation is now a virtual machine that changes every build

Zscaler ThreatLabz tracked Vidar from May through early September 2026 and documents the evolution from internal version 2.0 to 3.3. Early versions used single-byte XOR; from version 1.5 the developer adopted ChaCha20; from 1.8 the ChaCha20 cipher was modified to make detection and decryption harder; and from 2.0 the approach changed entirely, to a custom virtual machine executed by a lightweight bytecode interpreter, with opcodes that differ per build, plus a custom stream cipher whose operations also vary across builds. The stated purpose is to defeat static and automated analysis, and it does so structurally: any detection keyed on a fixed constant or a fixed deobfuscation algorithm expires with the next build.

Sources: Zscaler ThreatLabz

ChainScript — delivered by ClickFix lures, rotating C2 through the Polygon blockchain

Blackpoint Adversary Pursuit Group documented a previously undocumented remote access trojan called ChainScript, delivered through ClickFix-like lures. Per APG it has appeared under multiple build names — ComponentTask33, UpdateDigital, HostShared, OrchidViolet66 — while presenting itself as Spotify, Zoom Workplace and Microsoft Teams software. Putting C2 rotation on a public chain means taking down a domain or an IP does not orphan the implant, and the lookup that retrieves the next address looks like an ordinary blockchain query.

Sources: The Hacker News

TASK#STOMP — a PowerShell backdoor that watches the filesystem in real time

Researchers disclosed a new campaign delivering a PowerShell backdoor that automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary commands. Real-time watching for new files is the part that differs from the usual one-shot collect-and-exfiltrate: what it wants is the documents produced after the intrusion.

Sources: The Hacker News

[Added detail] Fake LastPass Authenticator installer — a Microsoft-signed kernel driver turns off EDR first

Researchers at LastPass and Delphos Labs said on September 17 that a fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs. Microsoft's own hardware-compatibility program signs the driver, and it scored zero detections on VirusTotal when researchers checked. What was already public about this campaign is that it distributes through SEO-optimised GitHub repositories; what is new is that it carries a valid Microsoft signature and therefore loads in the kernel.

Sources: The Hacker News

Japan's Digital Agency — roughly 246,000 records exposed through a VPN appliance flaw

Check Point's September 21 weekly threat intelligence report records that Japan's Digital Agency confirmed a data breach after attackers exploited a vulnerability in a VPN appliance, with approximately 246,000 records exposed. The agency operates the Government Solution Service used by multiple ministries.

Sources: Check Point Research

Infrastructure and indicators

430 new C2 and malware-distribution addresses in 24 hours — the highest of the last six issues

By label: 320 malware_download (74%) and 17 "Unknown malware", still four fifths between them. Among named families, Cobalt Strike has 16 and VShell 13, flipping the order back from the previous issue — but both sit in the low teens, and at that magnitude the ordering is not a trend. The rest: PureRAT 8, AsyncRAT 8, Mirai 7, Aisuru 7, AdaptixC2 6, ValleyRAT 5, XWorm 3, Evilginx 3. Mirai, ValleyRAT, XWorm and Evilginx are four labels that enter the top twelve today.

Sources: C2 Infrastructure

Hosting: the largest block is still not the best-evidenced one

CHINA169 (China Unicom backbone, AS4837) still leads at 2,202 hosts, but only 476 of them have a hosting record — 21.6%. AROSS-AS (Seychelles, AS400619) carries 235 records against 244 hosts, 96.3%, labelled VShell, PureRAT and possible Cobalt Strike. That shape is unchanged from the previous issue. The scanning vendor Censys, AS398324, still sits seventh with 158 hosts and 5 records — what lands on the C2 list there are its scanner nodes, not C2.

Sources: C2 Infrastructure