Fifteen incidents is enough to call it a playbook [3]. Each step in it is unremarkable. Affiliates authenticate to a remote access service with credentials that work, then reuse the same domain credentials over RDP to reach file servers and domain controllers [4][5]. Tooling lands in C:\PerfLogs, the Windows performance-log directory, which CTU notes is rarely scrutinized by administrators or security controls [6]. Nothing after the front door requires an exploit.
That is what makes the 24-hour figure a control question [1]. If encryption can follow the first observed post-compromise activity by a day, the controls that decide the outcome are the ones sitting in front of the credential. In the February case, the actor opened multiple VPN sessions from different foreign IP addresses inside the first hour, which CTU reads as access validation and redundancy [7]. Sophos names the absence of MFA as the condition that allowed the initial login at all [8].
The sources pull apart on the access vector. Group-IB reported in March that affiliates hunted internet-exposed FortiGate management interfaces vulnerable to CVE-2024-55591 [9], and leaked Rocket chat logs from May showed the group testing stolen credentials against a range of VPN services [10]. CTU found artifacts in several intrusions consistent with exploited Fortinet endpoints, but said the available telemetry could not confirm it [11]. Patching the firewall is worth doing, but it would not have stopped the February intrusion CTU documented, which needed no firewall bug.
The volume arithmetic explains the recruiting. Monthly postings stayed under 20 through the end of 2025, then averaged over 75 at the start of 2026 [14], and the site held 683 names by the end of July 2026, 169 of them added in July [16][17]. Subtract a generous 80 for the four months of 2025 and at least 603 names land in the first seven months of 2026, roughly 86 a month [18]. July alone is about a quarter of everything the site has ever published [19]. CTU attributes the rise to a growing affiliate pool [15], which tracks with the 90/10 ransom split advertised on the RAMP forum in September 2025 [20]. A 90 percent share rewards persistence over skill.
Sector spread is wide, and CTU takes that as evidence the affiliates pick victims on available access rather than industry [21]. Sophos also logged the first attempted deployment against one of its own customers as the 2026 surge began [22]. The qualifying condition for being next is a remote access service where a password is sufficient [8].
