📊 Ransomware ecosystem in Q1 2026: market concentrates around major actors

In the first quarter of 2026, Check Point Research tracked more than 70 data leak sites where information on 2,122 new victims was published — a 117% increase over Q1 2024. The overall trend of rising ransomware activity continues.

To begin with, here are the key statistics:

📌 The number of active ransomware groups has started to decline after two years of market fragmentation — of the 85 groups at the Q3 2025 peak, 14 have ceased to exist. Meanwhile, 21 new names appeared, but most newcomers claimed fewer than 10 victims.  
📌 The top 10 groups accounted for 71.1% of all publications on data leak sites — the highest concentration since Q1 2024, when the ecosystem included far fewer active groups.  
📌 The US remains the main target of ransomware attacks — 49.6% of all known victims. Canada ranks second (4%), followed by the UK (4%).  
📌 The most targeted industries are business services (35%), consumer services (14%), and industrial manufacturing (11%).

As the number of active actors declines, the largest groups have started consolidating the market even more aggressively. Qilin, Akira, The Gentlemen, and LockBit together accounted for 41% of all victims during the quarter. Qilin alone published more victims than the bottom 50 groups combined.  

It is emphasized that the business model of major groups relies on their reputation: victims must believe that after payment they will indeed be able to restore their data. Market fragmentation in 2025 led to the emergence of many groups uninterested in maintaining decryption support or long-term credibility — a good example being the de facto wiper VECT 2.0, which we wrote about earlier.

Several of the fastest-growing groups stand out:

🔹 The Gentlemen has increased its activity by 315% compared to Q4 2025 — from 40 to 166 reported victims — taking third place globally. One of the group's key assets is believed to be a database of approximately 14,700 pre-compromised FortiGate devices. The geographical distribution is also notable: only 13.3% of victims are located in the US, while Thailand, Brazil, and India appear significantly more frequently than the ecosystem average.  

🔹 LockBit returned to the top after its infrastructure was dismantled in 2024. In Q1 2026, the group claimed 163 victims (+106% quarter-on-quarter), and the new LockBit 5.0 version was officially introduced on the RAMP forum in September 2025. The share of U.S. victims among LockBit's targets (21.2%) is notably below the market average; Italy, Brazil, and Turkey are also among its main targets. We previously reported on LockBit's attempts to regain its former position by lowering entry fees.  

Despite the growth in the number of victims, revenues from such operations continue to decline. Decrease in profits may gradually push out groups unable to reach sufficient scale or maturity to remain viable. As a result, the ecosystem is likely to concentrate around a limited number of dominant groups — those that are more technically mature, geographically diversified, and resilient to external pressure. To strengthen protection, such operators may shift their activities away from jurisdictions most actively involved in international takedown operations, a trend already observable in the case of LockBit.

Ransomware ecosystem in Q1 2026: market concentrates around major actors

The article examines vulnerabilities in Salesforce Marketing Cloud (formerly ExactTarget) related to the use of outdated cryptographic mechanisms. The research shows that parameters in email links are encrypted using weak or legacy algorithms, allowing an attacker to decrypt and tamper with them without knowledge of the key.

Exploitation is based on a combination of attacks, including padding oracle techniques, enabling access to subscriber data and email content.

📎 Article: https://slcyber.io/research-center/ghosts-of-encryption-past-salesforce-exacttarget/

Legacy Encryption in Salesforce Marketing Cloud

🔽Bypassing BitLocker via a downgrade attack

The article examines a technique for bypassing BitLocker through a downgrade attack, in which vulnerable versions of the Windows Boot Manager are loaded. Despite installed updates, outdated boot components remain trusted within the Secure Boot chain, allowing an attacker to replace the boot environment and run the system in a compromised state without breaking the chain of trust.

The attack requires physical access and is carried out using modified boot images, enabling the extraction of encryption keys after system initialization. The core issue lies in the lack of revocation of vulnerable binaries in the UEFI dbx, making the attack reproducible.

📎 Article: https://www.intrinsec.com/en/contournement-bitlocker-la-realite-des-downgrade-attacks/
⚙️ PoC: https://github.com/garatc/BitUnlocker

Bypassing BitLocker via a downgrade attack

Apple has begun rolling out secure messaging between iOS and Android devices through the RCS standard.

RCS (Rich Communication Services) is a modern replacement for SMS and MMS. The technology supports high-quality photo and video sharing, group chats, reactions, typing indicators, and file transfers over the internet.

⚙️ What has changed

Previously, conversations between iOS users through iMessage were protected with end-to-end encryption. However, communication between iOS and Android users was often transmitted through SMS or standard RCS without full protection of message content.

Apple is now adding support for encrypted RCS messaging in the Messages app. If the carrier supports the latest RCS version and the Android user is running the latest version of Google Messages, conversations between iOS and Android devices will be encrypted automatically.

❓ What end-to-end encryption provides

Messages are encrypted on the sender’s device and decrypted only on the recipient’s device. As a result, carriers and messaging infrastructure providers cannot access the contents of the conversation. In the interface, these chats are marked with a lock icon and an indication that the conversation is protected.

⚠️ Limitations

End-to-end encryption for RCS is still in beta testing, as its functionality depends on multiple parties, including Apple, Google, mobile carriers, and device support for the RCS standard.

Apple Adds End-to-End Encryption for RCS Messaging Between iOS and Android

Researchers at Black Duck have released their annual report on open-source software security. The study analyzed 947 real-world customer codebases, broken down into approximately 2,843 individual projects for more detailed analysis. The research covered the period from November 2024 through October 2025.

Key findings:

🔺The average number of OSS components per application rose from 911 to 1,180, confirming a persistent trend toward greater reliance on open-source software.

🕵🏻‍♂️About 16% of open-source dependencies were detected only through in-depth analysis—methods capable of finding code fragments missed by standard tools (for example, copied snippets or embedded dependencies). Conventional automated scanners (such as those based on SBOMs) may fail to identify these dependencies completely, leaving blind spots in an application’s composition analysis.

📚About 64% of the codebases contained transitive (shadow) dependencies—packages automatically pulled in when adding a single library. Developers typically do not select them directly and often remain unaware of their presence, which broadens the attack surface and complicates codebase oversight.

✒️Roughly two-thirds of the codebases involved licensing risks or potential conflicts: each transitive component carries its own license terms (for example, attribution requirements or restrictions on commercial use) that developers may violate if they don’t verify license compatibility and distribution terms. Such oversights can lead to long-term legal consequences for organizations.

The report stresses that open source is a valuable resource—but without disciplined dependency management, it brings serious risks, from codebase conflicts to new attack vectors and legal risks. This issue is especially acute in large, fast-moving projects where developers often add libraries “automatically” without checking their origin, licensing, or update history. As a result, an organization may not realize for a long time which components are actually used in its products, creating blind spots both for security and compliance. Effective dependency management—including automated SBOM-based visibility, ongoing vulnerability monitoring, and license governance—is no longer optional but an essential part of the modern development lifecycle.

Toxic Dependencies

The most sensitive information in organizations is often discussed offline. Yet audiovisual (AV) systems in meeting and conference rooms remain among the least protected attack surfaces, with little to no monitoring in place.

This issue was highlighted in a blog post by researcher Eugene Lim (spaceraccoon), who described vulnerabilities he discovered in the AVer PTC320UV2 (a camera for meeting room applications) and the Crestron TSW-1060 (a conference room control panel). For the latter, he demonstrated an attack chain that, once the device is compromised, allows persistence, lateral movement into the internal network, and ultimately eavesdropping on conversations and recording video from the conference room.

There are several reasons why securing such devices has become a challenge:

🔴 Updates are often delayed or discouraged. AV systems are expected to run continuously, so updates are frequently postponed or ignored. This is especially true for legacy devices: updates can disrupt operation, and troubleshooting or recovery may be difficult.
🔴 Many devices are insecure “out of the box”. Default configurations may expose open services, weak authentication, and standard credentials. Hardening is left to system integrators, and when it's incomplete, identical vulnerable setups are deployed at scale.
🔴 Weak monitoring. These systems often don't support additional monitoring tools, and remote access to some of them is restricted. Moreover, they're typically maintained by IT staff focused on uptime and minimal disruption rather than security.

AV security remains a weak spot for many organizations, even though basic safeguards are well known: for instance, network segmentation alone can significantly reduce the risk of lateral movement. The main issue is awareness — such devices often stay off the radar because they're expected to work reliably without extra oversight. Regular asset inventories, careful configuration following vendor guidance, and centralized access control can greatly reduce this blind spot.

How vulnerable AV equipment becomes a stealthy participant in business meetings

Sale of a 0-day vulnerability in Windows 11

For informational purposes only

According to the seller, the exploit leverages a vulnerability in the ntoskrnl module and operates exclusively on physical (non-virtual) machines with Intel processors.

Vulnerability type: LPE
Affected versions: 24H2, 25H2
Price: $100k (payable in BTC)

Sale of a 0-day vulnerability in Windows 11

📌 ImageMagick and Ghostscript: the path from SVG to RCE

A new research demonstrates how a specially crafted SVG file can lead to arbitrary code execution when processed by ImageMagick, which relies on Ghostscript to render PostScript content. The vulnerability exists in the default configuration, where ImageMagick automatically delegates processing to Ghostscript, allowing an attacker to write arbitrary files and achieve remote code execution.

Exploitation requires no elevated privileges — uploading a malicious SVG file through a standard image resize or conversion feature is sufficient. As a result, an attacker can execute commands with the privileges of the image-processing service, potentially leading to privilege escalation and full server compromise.

📎 Article: https://blog.deephacking.tech/en/posts/imagepanick-from-svg-to-rce-imagemagick-ghostscript/

ImageMagick and Ghostscript: the path from SVG to RCE

The research demonstrates how the Cross-Session Activation (CSA) mechanism can be abused to execute code in the context of an interactive user on a local host. The technique relies on abusing DCOM and Windows COM objects configured with the RunAs=Interactive User parameter.

If an attacker with local administrative privileges is able to hijack the associated CLSID, CSA can be used to launch a process under the active user’s context without directly interacting with their session. This makes the technique valuable for post-exploitation activities, token theft, and further privilege escalation.

📎 Article: https://ipurple.team/2026/05/04/cross-session-activation/

Cross-Session Activation via DCOM: Code Execution in an Interactive User Session

The research describes a vulnerability in Microsoft Semantic Kernel (.NET SDK v1.47.0–1.48.0) and Agent Framework 1.0 that enables remote code execution (RCE). The issue stems from an unsafe trust model in which stochastic LLM output is interpreted as executable system commands.

The vulnerability forms a chain of CWE-1039 → CWE-22 → CWE-94 and remains exploitable despite the official patch for CVE-2026-25592. Exploitation requires no privileges, can be performed remotely, and may result in overwriting the host application's source code (the “Self-Nuke” vector). The research demonstrates six independent 0-day bypasses of the implemented security mechanisms.

📎 Article: https://nuka-ai.github.io/posts/2026-07-28-Semantic-Kernel-disclosure/

Bypassing the CVE-2026-25592 Patch in Microsoft Semantic Kernel

VECT is a relatively new RaaS threat that emerged in late 2025. It was initially promoted as an ambitious ransomware for mass deployment, supporting Windows, Linux, and ESXi, featuring a mature affiliate model, partnership with the TeamPCP group, and a convenient operator panel. VECT even became the first notable example of the Breached forum's willingness to collaborate with international actors from Russia, China, and other regions — as we reported earlier.

However, an investigation by Check Point Research revealed that the technical implementation of VECT 2.0 differs significantly from its advertised capabilities:
❌ a flaw in the encryption routine effectively turns VECT 2.0 into a wiper, irreversibly corrupting files larger than 128 KB
❌ declared cryptographic methods don't match the actual implementation
❌ several claimed features,such as encryption speed selection, are missing; corresponding flags are ignored
❌ identical flaws appear across all three platform builds, indicating careless code reuse

In addition, the code contains numerous other weaknesses pointing to an unprofessional implementation. There are also suspicions that parts of the code were generated by AI.

Currently, subscription-based malware distribution models — including ransomware — are steadily gaining traction. As the number of such services grows, competition among operators intensifies, pushing them to find new ways to stand out and attract potential clients. Yet the VECT 2.0 case shows that this doesn't always come from quality: the proclaimed “professionalism” is often just a façade meant to create an impression of maturity. Such encryption design flaws pose risks not only to victims but also to affiliates themselves: irreversible file damage reduces the likelihood of receiving ransom payments.

VECT 2.0 ransomware: strong marketing masked weak technical execution

📌 Analysis of Prototype Pollution in Adobe Acrobat

The article provides a detailed examination of three critical vulnerabilities CVE-2026-34621, CVE-2026-34622 and CVE-2026-34626 affecting Acrobat DC, Acrobat Reader DC, and Acrobat 2024, respectively. These issues stem from improper handling of object prototype modifications (prototype pollution) within the JavaScript environment during PDF document parsing.

Exploitation of these vulnerabilities allows an attacker to inject arbitrary properties into JavaScript runtime objects, potentially leading to sensitive data leakage or arbitrary code execution.

For a successful attack, it is sufficient for a user to open a specially crafted PDF file; no additional privileges or user interaction are required. If successfully exploited, the attacker gains the ability to execute code in the context of the Reader process.

📎 Article: https://starlabs.sg/blog/2026/04-three-bugs-walk-into-a-pdf-prototype-pollution-served-cold/

Analysis of Prototype Pollution in Adobe Acrobat

Researchers from Kaspersky reported the compromise of installers for DAEMON Tools, a popular application for working with disk images. According to Securelist, infected versions 12.5.0.2421 through 12.5.0.2434 have been distributed since April 8, 2026.

The attackers compromised the software distribution channel, causing users to install the legitimate application together with malicious code. The compromised files were also signed with a valid certificate belonging to the developer, AVB Disc Soft.

Telemetry data recorded thousands of infection attempts across more than 100 countries. Initially, the malicious payload collected system information, including the MAC address, hostname, DNS domain, running processes, installed software, and system language. On selected machines, the attackers then deployed additional tools, including a backdoor and the QUIC RAT implant, which supports communication with command-and-control servers over multiple protocols, including HTTP, UDP, TCP, WSS, QUIC, DNS, and HTTP/3.

Researchers from Kaspersky reported the compromise of installers for DAEMON Tools

Rhynorater, Justin Gardner, and Shubham Shah (Assetnote) shared their approach to web application code review in a new episode of the bug bounty podcast Critical Thinking — methodology, checklists, and personal tips.

📎 Article: https://blog.criticalthinkingpodcast.io/p/hackernotes-ep-172-critical-guide-to-code-review

White-box web analysis techniques from top researchers

The Bugscale team published an analysis of an attack on Galaxy Store 4.6.02.7 on the Samsung S25: a malicious app, with no permissions and no user interaction, can install an arbitrary local APK.

The attack chains five bugs:

 1. The Cloud Games feature uses a deeplink to install an auxiliary Shell APK to a predictable path without integrity checks.

 2. The Store’s custom signature validation downgrades from scheme v3 to v2 and does not verify that the signature block matches the actual APK data (the attacker copies the v2 signature block from the original Shell APK into their payload — the Store accepts it via v2, while the Android system installer validates it via v3).

 3. The exported SmartSwitchReceiver, without permission checks, allows path traversal via new File(...) during data restore.

 4. The authentication confirmation protocol uses Random initialized with System.currentTimeMillis().

 5. A NullPointerException in IapReceiver forces the Store to crash and restart on demand, narrowing the brute-force window for the seed.

📎 Article: https://bugscale.ch/blog/here-we-go-again-a-five-bug-chain-to-arbitrary-apk-install-on-samsung-s25/