Loading story…
Multiple reports highlight evolving ransomware tactics and growing operational scale across distinct groups. Group-IB reported that DeadLock is using Polygon smart contracts to help obscure and rapidly rotate infrastructure used to connect victims to the gang, complicating defender blocking and analysis. After encryption, DeadLock reportedly drops an HTML file that wraps the Session messenger workflow; the smart contract stores a proxy URL that can be frequently changed, supporting an “encryption-only” model without a traditional public data leak site.
Separately, Darktrace summarized late-2025/early-2026 intelligence indicating Medusa (aka Storm-1175 / Spearwing) has become one of the most active RaaS operations, with reporting that 500+ organizations have been impacted and that affiliates leverage vulnerabilities for access, including Fortra GoAnywhere MFT CVE-2025-10035 and multiple SimpleHelp issues (CVE-2024-57726, CVE-2024-57727, CVE-2024-57728). Trellix research (via DataBreaches/Industrial Cyber) described CrazyHunter as a Prince ransomware fork written in Go, with enhanced intrusion and evasion techniques and a focus on Taiwan healthcare, citing six confirmed victims and use of a data leak site to pressure targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On January 14, 2026, reporting on Group-IB research disclosed that DeadLock was using Polygon smart contracts to store rotatable proxy server URLs, making its command-and-control infrastructure harder to analyze and block.
By January 2026, Trellix reported that the CrazyHunter ransomware campaign had escalated, with six confirmed healthcare victims in Taiwan. The report said the group had evolved rapidly, using enhanced intrusion techniques, anti-malware evasion, and a data leak site consistent with double extortion.
Darktrace says Medusa's growth drew a joint advisory from CISA and the FBI, reflecting official concern over the group's expanding activity and tradecraft.
According to Darktrace, Medusa grew into one of the top 10 most active ransomware threat actors during 2025 through broad opportunistic targeting, RMM abuse, and exploitation of public-facing vulnerabilities.
Darktrace describes a Q4 2025 Medusa-linked incident in Europe involving long-lived SimpleHelp command-and-control, large-scale data exfiltration, and eventual ransomware execution.
The Register notes that Google Threat Intelligence Group reported the 'EtherHiding' technique in October 2025, documenting smart-contract abuse in North Korean activity. This provided prior precedent for blockchain-based attacker infrastructure similar to DeadLock's later methods.
Group-IB says the DeadLock ransomware operation was first observed in July 2025. The group targeted a range of organizations while keeping a relatively low profile.
Trellix assesses CrazyHunter as a fork of the Prince ransomware family, which was first seen in mid-2024. This places Prince as the earlier codebase from which CrazyHunter likely evolved.
Darktrace reports observing Medusa-related encryption activity in customer environments beginning in December 2023, indicating the ransomware operation was active well before its later surge in prominence.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcedarktrace.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026
Reporting highlights a broader shift in the ransomware ecosystem toward **platform-like operations** and **ransomware-as-a-service (RaaS)** models that lower the barrier to entry and accelerate the creation of new crews. Huntress telemetry for 2025 is cited as placing **Akira** as a leading ransomware group, with operators increasingly targeting the **hypervisor layer** to bypass traditional endpoint controls; separate commentary describes rapid victim growth for **Qilin** (claimed to exceed 1,000 victims in 2025) and notes **LockBit** regaining operational capability after prior disruption. The same reporting also points to “**Extortion-as-a-Service**” offerings (including a federation described as **SLSH**—Scattered Spider/Lapsus$/ShinyHunters) that enable affiliates to rent tooling rather than develop it, contributing to a surge in newly formed groups. A separate technical write-up details **Termite** ransomware as a Babuk-derived operation first observed in late 2024 that has matured into a multi-stage intrusion and **double-extortion** threat, claiming dozens of victims across multiple sectors and regions by March 2026. The report emphasizes Termite’s operationalization of **ClickFix** (browser-based social engineering) to bypass traditional phishing defenses, and provides a distinctive forensic marker: encrypted files reportedly have the Babuk-inherited trailing string `"choung dong looks like hot dog"`, positioned as a practical indicator during triage. Another overview article catalogs major active ransomware groups and tactics, including **Lynx** (described as sharing substantial code with INC, using double extortion, appending `.lynx`, and deleting shadow copies) and **Medusa**, while reiterating law-enforcement attribution and indictments tied to **LockBit** leadership and deployment activity.
Jun 29, 2026
Threat intelligence reporting describes **DragonForce** as a rapidly evolving ransomware operation that brands itself as a “cartel” and runs an affiliate service called *Ransombay*, offering customizable payload options and reportedly advertising an **80% revenue split** to attract pentesters and initial access brokers. Researchers assess DragonForce’s tooling as heavily derived from **LockBit 3.0** and **Conti**, and report signs of consolidation behavior, including infrastructure/code overlap with groups such as **BlackLock**, **RansomHub**, and **LockBit**; one cited incident involved DragonForce abusing a rival’s misconfiguration and a **Local File Inclusion (LFI)** weakness to obtain information including credentials, followed by defacement of the rival’s leak site. Separate industry reporting indicates ransomware victimization continued to rise sharply in 2025, with GuidePoint Security tracking a **58% year-over-year increase** and **7,515 claimed victims** across leak sites, alongside a more **fragmented** landscape (124 named groups, up 46% from 2024). The same reporting highlights concentration of victimization in the **United States (55%)** and heavy targeting of **manufacturing**, with healthcare also significantly impacted (500+ victims) and **Qilin** described as the most prolific RaaS group in 2025 with disproportionate healthcare targeting—context that aligns with the broader trend of many smaller, high-volume groups rather than a few dominant actors.
Jun 29, 2026