Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishers
- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Reality
- Evidence78
- Adoption
- Insufficient
- Hype gap+25
- Incentives45
- Confidence76
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Publishers:bleepingcomputer.com · guidepointsecurity.com · thehackernews.com Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Reality
- Evidence66
- Adoption18
- Hype gap+12
- Incentives40
- Confidence62
The updated CISA-FBI advisory puts Medusa at more than 500 victims as of April 2026, up from 300, with exploits weaponized within 24 hours and sometimes a week before disclosure.
Perspective Coverage
7 publishers
- Builder
- Builder 12%
- Operator
- Operator 79%
- Investor
- Investor 9%
Reality
- Evidence76
- Adoption
- Insufficient
- Hype gap+20
- Incentives40
- Confidence74
Researcher Dancho Danchev matched 205 handles from a 2005-2008 Exploit.in dump to private messages on five later forums, 26 of them from active early members. A matching handle does not prove a matching person, so 205 is a ceiling, but the forum's core was only about 90 accounts, few enough to follow from board to board.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence40
Microsoft says affiliate Storm-2570 has run the same remote access and exfiltration tools whether it deploys Qilin, DragonForce, Anubis or BERT ransomware. Detections built on those tools can catch the operator before any payload runs.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives30
- Confidence55
Cisco Talos's tally of Japanese ransomware for January to July 2026 hands the country lead to The Gentlemen, a crew that was not in last year's data and that listed 105 victims worldwide in July alone.
Reality
- Evidence52
- Adoption60
- Hype gap+15
- Incentives70
- Confidence55
The RaaS operation appeared on August 5 with build management for four operating systems, Tox-gated affiliate vetting and two Italian victims, and the encryptor those affiliates are uploading still awaits public analysis.
Publishers:andreafortuna.org
Reality
- Evidence30
- Adoption32
- Hype gap+18
- Incentives68
- Confidence40
Daily NK reports Pyongyang's elite are stunned by the scheme and that Reconnaissance General Bureau officials fear the blame reaching them. Tom Uren expects tighter controls on hacking teams, not fewer operations.
Reality
- Evidence34
- Adoption31
- Hype gap+17
- Incentives48
- Confidence43
Group-IB puts the Qilin affiliate cut at up to 80 percent, and KELA logged a change that routes victim payments through affiliate wallets first, which says more about the operation's incentives than its thin public tradecraft record does.
Publishers:blog.bushidotoken.net
Reality
- Evidence54
- Adoption63
- Hype gap+14
- Incentives71
- Confidence57
The Gentlemen gave the Houston hospital operator nine days to pay after an August 31 filing confirmed patient, employee and provider files were taken, and a class action had already landed on August 27.
Perspective Coverage
3 publishers
- Builder
- Builder 15%
- Operator
- Operator 57%
- Investor
- Investor 28%
Reality
- Evidence68
- Adoption62
- Hype gap+8
- Incentives76
- Confidence72
Sophos CTU reviewed 15 intrusions by GOLD SHERWOOD affiliates and found the same route each time: a working credential on a Fortinet SSL VPN with no MFA, then RDP into domain controllers within hours.
Reality
- Evidence64
- Adoption76
- Hype gap+12
- Incentives70
- Confidence58
Check Point Research says a nonce bug in every public VECT build leaves files above 131,072 bytes unrecoverable, by the attacker as well. That turns extortion into destruction.
Publishers:research.checkpoint.com
Reality
- Evidence74
- Adoption22
- Hype gap+12
- Incentives62
- Confidence58
A six-agency #StopRansomware advisory dated August 10, 2026 gives defenders named CVEs, tooling and file extensions for a group that took about nine months to turn a variant into a business.
Reality
- Evidence78
- Adoption66
- Hype gap+12
- Incentives45
- Confidence74