Skip to main content
Get support →

Insights & Intelligence

Expert knowledge from the frontlines of ransomware defense. Industry leaders share actionable intelligence, novel workflows, and cutting-edge research to help you stay ahead of threats.

Latest Intelligence

Expert research and analysis from the frontlines

Malware Analysis45 min read

CRPx0 ClickFix Ransomware Analysis

CRPx0 is a ClickFix-delivered ransomware-as-a-service operation whose lures impersonate Windows and macOS update prompts and reCAPTCHA checks to trick victims into running a copied command. Ransom-ISAC traces the full killchain — from the ClickFix HTML through a multi-stage DLL loader to cross-platform Python ransomware that exfiltrates data before encrypting with AES-128 and RSA-4096 — with detections, YARA/Sigma logic, MITRE ATT&CK mapping and IOCs.

Ransom-ISAC Research Team

August 27, 2026

+6 contributors

Threat Intelligence40 min read

Infrastructure Destruction Squad / BLACKNET-00: Ransomware, Firebase and ICS Tooling

A Billie Eilish superfan, two visible operators and three tested tools sit at the centre of this assessment. Ransom-ISAC analyses BLACKNET-00's ransomware builder, the Shadow Ghost Firebase scanner and the TRK-25 ICS reconnaissance toolkit — separating low-confidence marketing claims from verified, operationally relevant capability.

Ransom-ISAC Research Team

August 19, 2026

+4 contributors

White Paper30 min read

Weaponizing Exposed Data

Ransomware and data-extortion groups are moving beyond bulk dumps to analyze, index and price stolen data before it is published or sold — removing the "weaponization tax" and turning breaches into searchable, tranched and targetable assets. Case studies on FulcrumSec, The Gentlemen, Titan, Sentap, ShinyHunters and the Leak Bazaar indexing-as-a-service platform, plus the emerging risk of soft-data pivots.

Mannie W

July 31, 2026

+6 contributors

Malware Analysis40 min read

The Telegram Malware Ecosystem

How a 9,898-row intelligence collection was built from Telegram bot tokens and chat IDs leaking out of malware on VirusTotal — covering 9,678 bot tokens, 9,756 sample hashes, and 6,512 destination chats, enriched via the Bot API and clustered into 854 operator campaigns, with attribution case studies including a crypto-drainer MaaS and an account-takedown service.

Manuel Boll

July 27, 2026

+4 contributors

Threat Advisory3 min read

Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)

A coordinated Unified Threat Advisory covering active Cl0p ransomware affiliate exploitation of internet-exposed PTC Windchill and FlexPLM deployments — chaining a pre-auth FlexPLM WSDL information disclosure with a Windchill login servlet flaw for unauthenticated RCE, JSP webshell deployment, and double-extortion data theft.

Brandon Parsons

July 22, 2026

+2 contributors

Threat Advisory10 min read

The Fox Tempest Question

One malware build split across two unrelated signing chains: a loader signed by a Chinese shell company via Certum, and a stealer signed under a stolen identity via Microsoft Trusted Signing — timestamped 11 days before Microsoft disclosed Fox Tempest, suggesting a Dragon Breath-aligned actor buying certificates from signing-as-a-service brokers.

Alex Necula

July 20, 2026

+3 contributors

Threat Intelligence45 min read

MuddyWater: ClickFix to Telegram & PatchAgent Backdoor

Full reverse engineering of a three-stage PatchAgent loader chain assessed as MuddyWater-linked with high confidence — from a regsvr32-executed COM dropper through an AES-256-CBC PTCH v2 container to a functional HTTP shellcode backdoor that hollows notepad.exe and beacons to operator infrastructure, all from ClickFix delivery containing Telegram beaconing.

Ransom-ISAC Research Team

July 15, 2026

+5 contributors

Threat Intelligence50 min read

Kali365 PhaaS Kit: OAuth Device-Code Phishing Enables MFA-Satisfied Token Theft

End-to-end reverse engineering of the Kali365 (K365) Microsoft 365 Phishing-as-a-Service operator client, purchased web panel, and payment infrastructure — revealing OAuth device-code phishing (RFC 8628) that satisfies MFA legitimately to steal long-lived refresh tokens.

Ransom-ISAC Research Team

July 3, 2026

+6 contributors

Threat Intelligence20 min read

Kairos Ransomware: Data-Extortion Case Study Involving a U.S. Government Entity

A leaked negotiation transcript and payment-flow analysis of a successful $1 million ransom payment by a U.S. government body to Kairos — a data-extortion actor whose "ransomware group" status remains unverified — including fund tracing to ByBit, OKX, and BELQI exchange touchpoints.

Rakesh Krishnan

July 3, 2026

+3 contributors

Threat Intelligence45 min read

When Three Threats Meet One Inbox Against Japan

Three unrelated Chinese-nexus operators — CoGUI email phishing, the Smishing Triad SMS/iMessage ecosystem, and MirrorFace espionage — converge on Japanese inboxes simultaneously, producing a single-campaign illusion that demands durable behavioral detection over short-lived IoCs.

Md. Azim Uddin & Abdullah Al Mamun

June 25, 2026

+4 contributors

Malware Analysis45 min read

ShinyHunters: Silent Malware as a Service (MaaS)

A full malware analysis of Illusion-2.6.5-setup.exe — a deployment of Silent Stealer v2.6.5 and integrated RAT sold as a Malware-as-a-Service and distributed via Telegram under the ShinySpider alias, with an exposed operator panel that maps the complete C2 infrastructure and capability set.

Ransom-ISAC Research Team

May 26, 2026

+5 contributors

Threat Intelligence10 min read

The Gentlemen Leak Analysis (Part 2) — JA456 Follow-on

Analysis of JA456, a follow-on package to the original Gentlemen Leaks that exposes operator-side artifacts — MEGA session history, a Synology NAS shadow dump, and wipe-in-progress screenshots — yielding rare attribution pivots including an early residential Izhevsk IP.

Ransom-ISAC Research Team

May 26, 2026

+4 contributors

Threat Intelligence120 min read

The Gentlemen Ransomware Group — Leak Analysis

A 120-minute technical intelligence whitepaper analysing the leaked Rocket.Chat corpus of The Gentlemen RaaS — 3,366 messages, 66 confirmed victims, custom G-BOT C2, Fortinet exploitation, AI-assisted operations, and a moderate-high confidence assessment of Black Basta successor lineage.

Ransom-ISAC Research Team

May 15, 2026

+13 contributors

Threat Advisory2 min read

Critical PAN-OS Vulnerability Demands Immediate Attention

CVE-2026-0300 is a critical unpatched buffer overflow in Palo Alto PAN-OS firewalls that gives unauthenticated attackers root access, with limited exploitation already seen in education, healthcare, and ISP environments and patches not expected until mid-May.

Reyben Cortes

May 6, 2026

+4 contributors

Threat Intelligence15 min read

Dragon in the Kernel — Part II

Independent validation, certificate history, and an expanded driver arsenal: a prior 2024 Zhengzhou 403 GlobalSign EV certificate, a hide_process rootkit, and YDArkDrv.sys signed under the same shell company.

Alex Necula & Ellis Stannard

April 29, 2026

+1 contributor

Threat Intelligence35 min read

DragonBreath: Dragon in the Kernel

A 0-day BYOVD vulnerability in dragoncore_k.sys signed by Zhengzhou 403 Network Technology, with shell company analysis, Dragon Breath APT-Q-27 attribution, and an APT31 / Wuhan Xiaoruizhi personnel nexus.

Alex Necula & Ellis Stannard

April 22, 2026

+3 contributors

Threat Intelligence10 min read

0APT Hacked - And Then Got Hacked Back

An extortion-minded threat actor known as 0APT breached the Krybit ransomware admin panel — and within hours was counter-hacked by Krybit. A look inside both operations, the chat transcript, and the recovered Android-hosted infrastructure.

Ransom-ISAC Research Team

April 14, 2026

+5 contributors

Threat Advisory3 min read

Iran-linked hackers access U.S. Water Utilities East Coast - Advisory

A Unified Threat Advisory on Iran-linked hackers targeting small U.S. East Coast water utilities via Eclipse 9800i PLCs, and technical details of the TRK25-ADVANCED Python GUI ICS reconnaissance and exfiltration tool.

Reyben Cortes

April 9, 2026

+4 contributors

Threat Advisory45 min read

Supply Chain Confidence: What Every Organisation Needs to Know

A threat advisory covering TeamPCP’s multi-stage supply chain campaign through Trivy, npm, LiteLLM, Telnyx, and Axios — with 11 prioritised defensive recommendations for organisations of all sizes.

Ransom-ISAC Research Team

April 3, 2026

+12 contributors

Vulnerability Research30 min read

You’re Driving Me Crazy: Analysing and Detecting BYOVD

A deep-dive technical reference for SOC teams and threat hunters covering BYOVD attack analysis, kernel driver reverse engineering, KQL detection queries, and defensive hardening with WDAC policies.

Alex Necula

April 3, 2026

+3 contributors

Threat Advisory5 min read

New Tool in the Wild: Bluekit Dashboard (Beta)

A threat advisory on Bluekit, a phishing-as-a-service platform advertised as an accessible, anonymity-focused alternative to Evilginx Pro and Tycoon2FA — 40+ templates, 2FA interception, device/geolocation spoofing, and no vetting requirements.

Ransom-ISAC Research Team

March 31, 2026

+1 contributor

Threat Intelligence30 min read

Contagious Interview: VS Code to RAT

A DPRK-affiliated social engineering campaign weaponises VS Code trusted features to deliver RATs through fake job interviews, with full attack chain analysis, malware breakdown, infrastructure tracking, and IOCs.

François-Julien Alcaraz & Yashraj Solanki

March 16, 2026

+3 contributors

Threat Intelligence30 min read

Ransomware in Healthcare: Three Years of Insight

A case study exploring how deeper insight emerges when analysis moves beyond high-level sector classifications on Dedicated Leak Sites and instead focuses on the specific subsectors within which entities operate.

Jeffrey Bell

February 19, 2026

+3 contributors

DFIR30 min read

Ransomware Leak Collection & Analysis

A structured intelligence workflow for ransomware leak data collection and LLM-assisted analysis, from automated Tor-based collection to agentic reasoning and intelligence dissemination.

Apurv Singh Gautam

February 6, 2026

+4 contributors

Threat Intelligence55 min read

Safely Tracking Ransomware Affiliates

An ethical and reproducible HUMINT-style workflow for safely observing ransomware affiliates using synthetic personas, tactical empathy, and rigorous operational security.

Matthew Maynard

December 29, 2025

+5 contributors

Threat Intelligence35 min read

Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4)

Follow the money through on-chain analysis, tracing stolen funds across BSC and TRON blockchains and connecting wallet addresses directly to other DPRK exchange thefts. Blockchain forensic evidence ties this campaign to a broader pattern of North Korean cryptocurrency operations.

Nick Smart and Andrii Sovershennyi

December 8, 2025

+4 contributors

Threat Intelligence45 min read

Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 3)

Deep dive into the adversary infrastructure, operational security measures, and attribution analysis of the DPRK-linked campaign, revealing infrastructure fingerprints, C2 clusters, and connections to known threat groups.

Yashraj Solanki

November 13, 2025

+4 contributors

Become a Contributor

We're building a community of ransomware defense experts. If you have unique insights, novel workflows, or cutting-edge research to share, we want to hear from you.

Expert recognitionL.O.C.K. S.T.A.R. eligibilityGlobal impactCommunity support
Get in Touch

Email us at contact@ransom-isac.org

Join the Fight Against Ransomware

Partner with Ransom-ISAC to access high-quality threat intelligence and connect with defenders worldwide.

Become a PartnerLearn more