Payload Ransomware: Early Profile
Tags: Payload ransomware, data broker extortion, double extortion, Tor leak site, ESXi ransomware, RECOVERY-xx0001.txt, IOCs, incident response
Threat intelligence, decoded.
Evidence-led cyber threat intelligence for defenders. Incident reports, actor profiles and vulnerability analysis — written for the people who have to act on it.
// Latest reporting
APT33 - Threat Actor Profile
APT33, Elfin, Peach Sandstorm, HOLMIUM, Refined Kitten, Iran, aerospace, energy, petrochemical, spearphishing, password spraying, Outlook Home Page, Ruler, TurnedUp, DropShot, ShapeShift, StoneDrill
BeyondTrust CVE-2026-1731: Pre-auth RCE escalates from rapid scanning to ransomware-linked intrusions
CISA has now flagged CVE-2026-1731 —a critical, pre-authentication remote code execution flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) as being used in ransomware…
Ivanti EPMM Pre-Auth RCE (CVE-2026-1281) Under Active Exploitation
Ivanti Endpoint Manager Mobile (EPMM) sits in a uniquely privileged position: it manages device enrollment, policy enforcement, and app/content distribution across entire mobile fleets. When an…
EDR Killers in 2026: The most common ways attackers neutralize endpoint security — and how to stop them
Publish date: 21 February 2026 Category: Threat Intelligence / Defense Evasion / Endpoint Security Tags: EDR, XDR, ransomware, defense evasion, BYOVD, Windows drivers, tamper protection, detection…
BYOVD in 2026: the signed-driver loophole powering EDR bypass at scale
Bring Your Own Vulnerable Driver (BYOVD) is a post-compromise technique where attackers load a legitimately signed (but vulnerable) kernel driver and then abuse it to gain ring-0 capabilities…
APT29 (Cozy Bear / The Dukes / Midnight Blizzard) - Threat Actor Profile
APT29, also known as Cozy Bear, is a Russian hacker group believed to be affiliated with one or more Russian intelligence agencies. The group has been operating for the Russian Federation since at…
APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) - Threat Actor Profile
APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU’s 85th Main Special Service Center (GTsSS), military unit 26165, active since at least 2004. (…
APT31 (Violet Typhoon / ZIRCONIUM) - Threat Actor Profile
APT31 is a China-linked cyber espionage actor assessed by the U.S. Department of Justice and U.S. Treasury as operating in support of the PRC Ministry of State Security , specifically the Hubei…
Threat Actor Profile: LAPSUS$ (a.k.a. Microsoft “DEV-0537” / “Strawberry Tempest”)
LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity…
Threat Actor Profile: Cl0p (CL0P) — Extortion-led Mass Compromise
Cl0p (often written “CL0P”) is a financially motivated extortion operation best known for high-scale data theft campaigns that disproportionately impact organisations running internet-facing…
UNC6201 Targets Dell RecoverPoint (CVE-2026-22769): Evolving Backdoors and Novel VMware Pivot Techniques
Mandiant and Google Threat Intelligence Group (GTIG) have released critical findings regarding UNC6201 , a suspected PRC-nexus threat cluster. This group has been actively exploiting a Dell…