| 1 | Threat / Category Q1 observation · ransom economics Payments became less frequent but materially larger when victims paid[2]Evidence dated Jun 3, 2026 | Why it mattersArete reports a 31% Q1 2026 payment rate, down from 33% in Q1 2025, while the median payment rose from $100,000 to $250,000. The Q1 median demand was $571,000. Lower payment frequency therefore did not reduce the financial severity of the paid cases in Arete's engagement population. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 2 | Threat / Category Q1 observation · actor concentration Akira and Qilin produced almost one-third of Arete's Q1 engagements[2]Evidence dated Jun 3, 2026 | Why it mattersAkira represented 18.3% and Qilin 14.3% of Q1 activity in Arete's chart. Their combined share remained important but declined from more than half in each of Q3 and Q4 2025, showing concentration easing without eliminating either actor as a priority. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 3 | Threat / Category Q1 observation · payment leverage Akira combined high volume with unusually strong payment conversion[2]Evidence dated Jun 3, 2026 | Why it mattersArete reports Akira median demands of $700,000, median payments of $300,000, and payment in almost 48% of Akira engagements. More than half of those paying victims purchased data suppression without a decryptor, showing that stolen-data pressure can drive payment even when recovery is not the objective. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 4 | Threat / Category Q1 observation · victimology Professional services led a broad, access-driven victim population[2]Evidence dated Jun 3, 2026 | Why it mattersProfessional, scientific, and technical services accounted for 21.6% of Arete engagements, followed by manufacturing at 13.6%, wholesale trade at 10.4%, healthcare and social assistance at 8.8%, retail at 8.0%, and construction at 7.2%. Arete assesses most groups as opportunistic and access-vector-driven rather than sector-exclusive. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 5 | Threat / Category Q1 observation · initial access Edge exploitation, compromised credentials, and social engineering formed the Q1 access triad[2]Evidence dated Jun 3, 2026 | Why it mattersArete identifies vulnerability exploits, compromised credentials, and social engineering as the leading initial-access classes. Firewalls and VPN systems concentrate risk because they are internet-facing, authentication-connected, and capable of exposing internal enterprise access after compromise. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 6 | Threat / Category Q1 observation · identity-first intrusion Teams impersonation, device-code abuse, and ClickFix moved social engineering beyond ordinary phishing[2]Evidence dated Jun 3, 2026 | Why it mattersArete observed renewed cross-tenant Microsoft Teams help-desk impersonation, OAuth and Quick Assist workflows, and ClickFix campaigns across Windows and macOS. Akira, INC Ransom, Payouts King, and Chaos used Teams-style tactics, while Akira, Qilin, and Interlock adopted ClickFix. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 7 | Threat / Category Q1 observation · edge vulnerabilities Fortinet, WatchGuard, and BeyondTrust weaknesses were operational entry paths—not inventory trivia[2]Evidence dated Jun 3, 2026 | Why it mattersThe report documents Fortinet authentication bypass and older-flaw exploitation, Qilin exploitation of WatchGuard CVE-2025-14733, and Arete-confirmed exploitation of BeyondTrust CVE-2026-1731 linked to a Medusa-associated cluster. Edge remediation must pair patching with access review and hunting. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 8 | Threat / Category Q1 observation · actor persistence The top tier remained stable even as new ransomware brands emerged[2]Evidence dated Jun 3, 2026 | Why it mattersAkira, Qilin, PLAY, and INC Ransom remained among Arete's top five groups in every quarter since the second half of 2025. NightSpire posted more than 100 Q1 disclosures, BravoX posted nine while building credibility, and Schrodinger Cat formalized its brand, but established operators still drove most handled activity. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 9 | Threat / Category Q1 observation · RaaS evolution DragonForce's cartel model and leaked-code reuse lower the cost of operational change[2]Evidence dated Jun 3, 2026 | Why it mattersArete describes DragonForce shifting toward a decentralized partnership model and identifies Conti-derived implementation overlap. Its appendix reports identical ChaCha-like encryption logic, shared command-line behavior, a common mutex, and 99% BinDiff similarity between compared 32-bit DragonForce and Devman samples. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 10 | Threat / Category Q1 observation · AI evidence boundary Most adversarial AI use remained generative and assistive—not autonomous[2]Evidence dated Jun 3, 2026 | Why it mattersArete observed AI accelerating stolen-data analysis, victim prioritization, social engineering, and extortion strategy, while its outlook says most current use remained generative rather than agentic. Defenders should act on measurable workflow acceleration without claiming autonomous intrusions the evidence does not establish. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 11 | Threat / Category AI-assisted offense Later Arete analysis sharpened how AI shortens malware development and EDR testing[8]Evidence dated Jun 12, 2026 | Why it mattersArete describes threat actors using agent-based AI workflows for Active Directory discovery, iterative development, lab reproduction, and evasion testing. It found no evidence that AI was embedded as an autonomous operator inside victim environments. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 12 | Threat / Category Criminal infrastructure disruption AudiA6 shows ransomware depends on professional laundering infrastructure[7]Evidence dated Jun 23, 2026 | Why it mattersArete's account of the Europol-backed action describes arrests, more than 30 servers, 25 domains, and over €778,000 in frozen or seized cryptocurrency. Financial services, mule accounts, and marketplace infrastructure belong in the ransomware ecosystem map. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 13 | Threat / Category Credential exposure FortiBleed is a credential-compromise problem, not a patch-only problem[6]Evidence dated Jun 30, 2026 | Why it mattersArete's update describes password spraying, configuration exfiltration, packet sniffing, and harvested credentials affecting more than 86,000 devices across 194 countries. Credential resets, historical log review, management-plane restriction, and hunting are required alongside fixes. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 14 | Threat / Category June observation · crimeware trend June activity remained distributed despite Akira leading Arete's observations[5]Evidence dated Jul 6, 2026 | Why it mattersArete identified 17 unique groups during June and kept Akira, Qilin, and INC Ransom among the most active. The decision is to maintain a behavior-led watchlist instead of anchoring response plans to one brand. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 15 | Threat / Category June observation · trusted software abuse BYOVD is being used to disable or evade endpoint defenses[5]Evidence dated Jul 6, 2026 | Why it mattersArete reports Akira and DragonForce using vulnerable drivers in engagements and describes GentleKiller as a framework targeting multiple security products. Driver loading and security-control tampering should be high-priority detection events. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 16 | Threat / Category June observation · SaaS supply chain OAuth tokens can propagate one provider breach into many customer environments[5]Evidence dated Jul 6, 2026 | Why it mattersArete's June review uses the Klue incident to show how stolen Salesforce integration tokens can extend an intrusion through trusted SaaS relationships. Token inventory, revocation, and connected-app telemetry are incident-response requirements. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 17 | Threat / Category Ransomware access ecosystem FortiBleed links stolen edge credentials to INC and Lynx operations[4][6]First cited source Jun 30, 2026 · Latest cited source Jul 14, 2026 | Why it mattersArete reports evidence connecting the credential-harvesting campaign to INC and Lynx ransomware operations, including a shared operator and exposed workflow infrastructure. Organizations with affected FortiGate history should investigate credentials and administrative activity even after patching. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 18 | Threat / Category Identity-led extortion Helix makes Microsoft 365 identity the extortion perimeter[3]Evidence dated Jul 17, 2026 | Why it mattersArete describes Helix using vishing, device-code phishing, MFA abuse, and trusted-person impersonation to reach SharePoint Online and exfiltrate data. The practical control boundary is the identity session and cloud application—not only the endpoint. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 19 | Threat / Category Actor identity boundary Helix may overlap ShinyHunters and BlackFile ecosystems, but the relationship is unresolved[3]Evidence dated Jul 17, 2026 | Why it mattersArete notes operational similarities and possible shared ecosystems while explicitly keeping the connection unconfirmed. Defenders can correlate behaviors without collapsing separate names into one attribution. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 20 | Threat / Category July observation · actor concentration Akira entered the window as the clear volume leader, but not as a monopoly[9]Evidence dated Dec 3, 2025 | Why it mattersArete's Q3 report assigns Akira 32.1% of July engagements, followed by Qilin at 11.3% and Sinobi at 9.4%. The opening month already supports a multi-actor playbook even before Akira's August surge. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 21 | Threat / Category August observation · actor surge Akira rose above half of Arete's August engagements[9][10]First cited source Sep 8, 2025 · Latest cited source Dec 3, 2025 | Why it mattersAkira reached 52.9% in August, while Qilin represented 15.3% and PLAY 5.9%. Arete tied the spike partly to exploitation and legacy credentials around SonicWall environments, making edge history and credential hygiene central response questions. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 22 | Threat / Category August observation · SaaS supply chain Salesloft Drift token theft turned a trusted integration into downstream access[9][10]First cited source Sep 8, 2025 · Latest cited source Dec 3, 2025 | Why it mattersArete's Q3 analysis describes theft of Salesforce OAuth and refresh tokens associated with the Salesloft Drift campaign. Connected-app inventory, token revocation, and downstream log review are necessary when a SaaS provider is compromised. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 23 | Threat / Category September observation · enterprise extortion CL0P began an Oracle EBS extortion wave tied to CVE-2025-61882[9]Evidence dated Dec 3, 2025 | Why it mattersArete records extortion emails beginning on 29 September following exploitation of Oracle E-Business Suite. The sequence demonstrates why application remediation must include retrospective data-access review and preparation for delayed extortion contact. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 24 | Threat / Category September observation · actor mix Akira receded while PLAY and World Leaks gained share[9][11]First cited source Oct 6, 2025 · Latest cited source Dec 3, 2025 | Why it mattersArete's Q3 report places Akira at 36.6%, Qilin at 11.3%, and both PLAY and World Leaks at 7.0% in September. Extortion-only operations became a larger part of the visible mix even as the leading ransomware brands persisted. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 25 | Threat / Category October observation · parallel campaigns Edge exploitation and SaaS extortion were active at the same time[12]Evidence dated Nov 7, 2025 | Why it mattersArete kept Akira and Qilin among October's leaders while tracking CL0P's Oracle EBS campaign and the Scattered Lapsus$ Hunters/Salesloft activity. Response planning must cover appliance compromise, enterprise applications, and trusted cloud integrations concurrently. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 26 | Threat / Category Law-enforcement action · malware infrastructure Operation Endgame removed infrastructure at scale without ending the crimeware market[13]Evidence dated Nov 21, 2025 | Why it mattersArete's account of Season 3 attributes more than 1,000 server disruptions, 20 seized domains, an operator arrest, and millions of stolen credentials to the coordinated action. The takedown imposed cost, but Arete did not treat it as proof that ransomware access supply had stopped. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 27 | Threat / Category Full-year observation · actor landscape Akira led 2025, but Arete still observed a fragmented operator ecosystem[17]Evidence dated Mar 27, 2026 | Why it mattersArete's annual report places Akira at 28.4% and Qilin at 12.8% across 81 named and 52 unnamed actor labels. Akira's Q3 surge mattered, but the number of labels shows why a durable defense cannot depend on a single-brand watchlist. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 28 | Threat / Category December observation · renewed concentration Akira exceeded one-third of December activity as RansomHouse returned[14][17]First cited source Jan 12, 2026 · Latest cited source Mar 27, 2026 | Why it mattersArete reports Akira above one-third of December observations and the top three groups at 57%, alongside RansomHouse's return and emerging React2Shell and MongoBleed exposure. Actor concentration and fast-moving vulnerability response were linked operational concerns. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 29 | Threat / Category January observation · broader actor mix The top three fell to 34% as LockBit 5 and ClickFix entered the watchlist[15]Evidence dated Feb 5, 2026 | Why it mattersArete identified 17 groups in January, with Akira at 17% and the top three representing only about one-third. LockBit 5 activity and ClickFix/CrashFix social engineering reinforced the need to follow behaviors across changing brands. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 30 | Threat / Category February observation · edge and endpoint defense Akira and Qilin again approached half of activity while access paths diversified[16]Evidence dated Mar 9, 2026 | Why it mattersArete's February review places Akira and Qilin at nearly half of observations and highlights Qilin exploitation of WatchGuard CVE-2025-14733 plus Hotta Killer BYOVD activity. Edge remediation and protection against security-driver tampering belong in the same program. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 31 | Threat / Category March observation · distribution shift Twenty-one groups diluted the leading brands and widened the response burden[18]Evidence dated Apr 6, 2026 | Why it mattersArete observed 21 groups in March versus 15 in February, with Akira and Qilin falling from nearly half to just over one-quarter. FortiGate exploitation and Teams/Quick Assist social engineering show that actor-share changes do not simplify the access problem. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 32 | Threat / Category April observation · leadership change Qilin overtook Akira while four groups generated about half of activity[19]Evidence dated May 4, 2026 | Why it mattersArete reports Qilin moving ahead of Akira in April, with Akira, Qilin, INC Ransom, and DragonForce together accounting for roughly half. DragonForce's rise and continued BYOVD use show both concentration and tactical adaptation. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 33 | Threat / Category Technical campaign · deceptive files Fake JPEG delivery concealed PowerShell and remote-management access[21]Evidence dated May 26, 2026 | Why it mattersArete describes attackers using a fake image workflow to execute PowerShell and deploy a trojanized ScreenConnect path. File extension, content, user action, script execution, and remote-tool behavior must be correlated. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 34 | Threat / Category Technical campaign · web compromise A Ghost CMS flaw exposed more than 700 sites to ClickFix delivery[20]Evidence dated May 29, 2026 | Why it mattersArete's research connects CVE-2026-26980 exploitation across education and technology sites to a ClickFix campaign. A compromised website can become social-engineering infrastructure even when the visitor is not the original intrusion target. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Arete exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
