Topic
Affiliate-based ransomware operations that package builders, panels and documentation for third-party operators.
Azazel, a Russian-speaking affiliate of The Gentlemen RaaS crew, ran his own leak site to extort over two dozen victims and kept the proceeds, CloudSEK found. His way in was secrets left in old GitLab commits.
Reality
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishersReality
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Perspective Coverage
3 publishersReality
The updated CISA-FBI advisory puts Medusa at more than 500 victims as of April 2026, up from 300, with exploits weaponized within 24 hours and sometimes a week before disclosure.
Perspective Coverage
7 publishersReality
Researcher Dancho Danchev matched 205 handles from a 2005-2008 Exploit.in dump to private messages on five later forums, 26 of them from active early members. A matching handle does not prove a matching person, so 205 is a ceiling, but the forum's core was only about 90 accounts, few enough to follow from board to board.
Reality
Microsoft says affiliate Storm-2570 has run the same remote access and exfiltration tools whether it deploys Qilin, DragonForce, Anubis or BERT ransomware. Detections built on those tools can catch the operator before any payload runs.
Reality
Cisco Talos's tally of Japanese ransomware for January to July 2026 hands the country lead to The Gentlemen, a crew that was not in last year's data and that listed 105 victims worldwide in July alone.
Reality
The RaaS operation appeared on August 5 with build management for four operating systems, Tox-gated affiliate vetting and two Italian victims, and the encryptor those affiliates are uploading still awaits public analysis.
Reality
Daily NK reports Pyongyang's elite are stunned by the scheme and that Reconnaissance General Bureau officials fear the blame reaching them. Tom Uren expects tighter controls on hacking teams, not fewer operations.
Reality
Group-IB puts the Qilin affiliate cut at up to 80 percent, and KELA logged a change that routes victim payments through affiliate wallets first, which says more about the operation's incentives than its thin public tradecraft record does.
Reality
The Gentlemen gave the Houston hospital operator nine days to pay after an August 31 filing confirmed patient, employee and provider files were taken, and a class action had already landed on August 27.
Perspective Coverage
3 publishersReality
Sophos CTU reviewed 15 intrusions by GOLD SHERWOOD affiliates and found the same route each time: a working credential on a Fortinet SSL VPN with no MFA, then RDP into domain controllers within hours.
Reality
Check Point Research says a nonce bug in every public VECT build leaves files above 131,072 bytes unrecoverable, by the attacker as well. That turns extortion into destruction.
Reality
A six-agency #StopRansomware advisory dated August 10, 2026 gives defenders named CVEs, tooling and file extensions for a group that took about nine months to turn a variant into a business.
Reality