Intel 471's 2026 Outlook Reports 63% Rise in Extortion Breach Events
Report discovered via Awesome Annual Security Reports.
Summary
Intel 471 reported over 6,800 extortion breach events in 2025, up about 63%, while access-sale claims fell 27%. Its 2026 outlook highlights supply chain compromises, ClickFix delivery and faster vulnerability exploitation.
Key points
- The report draws on intelligence collected January 1–December 15, 2025, including underground engagement, open sources and proprietary monitoring; its extortion figures do not represent all underground claims.
- Intel 471 reported over 6,800 extortion breach events, up about 63% from 2024. Qilin accounted for approximately 18% of tracked victims and expanded pressure tactics through stolen-data analysis and multilingual calls.
- Researchers observed over 3,200 initial-access sale claims, down about 27%. Credential-based attacks represented roughly 49% of observed initial-access techniques; the decline partly reflected fewer substantial bulk offers.
- ClickFix expanded across Windows and macOS, using fake verification, troubleshooting and update prompts to induce command execution. Lumma, Stealc and Vidar were the most downloaded information stealers in Intel 471 telemetry.
- Supply chain campaigns amplified downstream exposure through enterprise platforms and npm packages. The second Shai-Hulud wave exploited compromised publishing tokens and automation, stole cloud credentials and included destructive fallback behavior.
- Intel 471 assessed criminal AI use primarily as an efficiency boost for phishing and impersonation, not a core operational dependency, and reported no widely used malware family in its observations that required generative AI to run.
- For 2026, the report anticipates faster exploit development, more automated supply chain compromises and increased opportunistic targeting of poorly secured operational technology by hacktivists.
Article Details
- Publisher
- Intel 471
- Report Period
- 2025-01-01 to 2025-12-15
- Scope
- Global cybercrime underground, extortion, initial access sales, malware, vulnerability exploitation and hacktivism.
- Sample Size
- Multiple intelligence sources and proprietary telemetry; no single overall sample size disclosed.
- Key Statistics
- Intel 471 reported over 6,800 extortion breach events, approximately 63% more than in 2024. These are observed events and claims, not all extortion incidents; statistics include LockBit claims whose accuracy could not be determined.
- Intel 471 observed over 3,200 initial access sale claims, approximately 27% fewer than in 2024; some offers remained unverified.
- Qilin accounted for approximately 18% of recorded extortion breaches and reached 212 reported breaches in October 2025.
- From 2025-04-01 to 2025-12-01, telemetry identified over 8,400 mobile malware observations across over 60 families; SpyNote represented 47.4% of detections.
- Intel 471 tracked more than 700 hacktivist responses; commentary and DDoS attacks each represented approximately 40%.
- Recommendations
- Engineer resilience across systems and partnerships to support early identification, rapid containment and recovery.
- Use access brokers' recurring reconnaissance procedures as early indicators of intrusion activity.
- Prioritize patching CVE-2025-5777, consistent with the CISA guidance cited in the report.
- Strengthen dependency integrity and identity/credential hygiene in developer workflows and CI/CD pipelines.
MITRE ATT&CK
T1018 · Remote System DiscoveryAccess brokers queried domain controllers with nltest and enumerated Active Directory computer objects.T1059.001 · PowerShellAccess brokers used PowerShell to enumerate computer objects in Active Directory.T1078 · Valid AccountsAccess brokers used legitimate credentials to obtain unauthorized network access.T1110 · Brute Force*Black and *Gold used brute-force attacks against remote access technologies.T1190 · Exploit Public-Facing ApplicationThreat actors exploited vulnerable public-facing Oracle EBS, SAP NetWeaver, NetScaler and SharePoint instances.T1195.002 · Compromise Software Supply ChainAttackers trojanized npm packages and republished infected versions through compromised publishing tokens.T1204 · User ExecutionClickFix lures instructed victims to paste and execute malicious commands under troubleshooting or verification pretexts.T1482 · Domain Trust DiscoveryAccess brokers executed nltest commands to enumerate domain trust relationships.T1485 · Data DestructionThe second npm worm wave deleted and overwrote user home-directory files if authenticated access to GitHub and npm could not be maintained.T1496 · Resource HijackingOpen sources reported cryptocurrency miner deployment following React2Shell exploitation.T1505.003 · Web ShellOpen sources reported web shell deployment following React2Shell exploitation.T1528 · Steal Application Access TokenThe second npm supply chain wave harvested cloud credentials and used stolen automation and publishing tokens.
CVE
CVE-2023-4966all consistent with prior CVE-2023-4966 aka CitrixBleed vulnerability exploitation. ThisCVE-2025-53770exploit brokers, while CVE-2025-5777, CVE-2025-53770 and CVE-2025-55182 wereCVE-2025-53771CVE-2025-53771 — a path traversal spoofing bug reported by an independent researcher.CVE-2025-55182exploit brokers, while CVE-2025-5777, CVE-2025-53770 and CVE-2025-55182 wereCVE-2025-5777exploit brokers, while CVE-2025-5777, CVE-2025-53770 and CVE-2025-55182 were
People
Threat Actors
*BlackRedacted access broker handle associated with almost 300 wholesale access offers and scanning, brute force, credential abuse and vulnerability exploitation.*BronzeRedacted exploit broker handle advertising alleged zero-day exploits for enterprise software and operating systems.*GoldRedacted access broker handle associated with over 70 specified access offers and brute-force attacks against remote access systems.Cl0pExplicit alias of CLOP, also named CL0P and CL0P^_- LEAKS.CL0P^_- LEAKSExplicit alias of CLOP, also named CL0P and Cl0p.ClopSupply chain extortion group targeting Cleo Harmony and Oracle EBS; explicitly also named CL0P, Cl0p and CL0P^_- LEAKS.NoName057(16)Pro-Russian group conducting DDoS operations and claiming HMI access; Intel 471 observed only about one week of inactivity after Operation Eastwood.QilinLeading extortion group in Intel 471's observations; expanded multilingual pressure tactics and allegedly compromised South Korean financial entities through an MSP.Scattered Lapsus$ HuntersExplicit alternate name for SP1D3R HUNTERS, also named SLH and SLSH.SLHExplicit alternate name for SP1D3R HUNTERS, also named SCATTERED LAPSUS$ HUNTERS and SLSH.SP1D3R HUNTERSGroup conducting social engineering and intrusions against vulnerable SAP NetWeaver and Oracle EBS instances; explicitly also named SCATTERED LAPSUS$ HUNTERS, SLH and SLSH. Salesloft breach attribution remained uncorroborated.Z-Pentest AlliancePro-Russian hacktivist group associated with attacks against water treatment and steel company HMI systems and alleged hydroelectric power station access.zeroplayerUnderground exploit broker advertising alleged enterprise software zero-days and an EDR evasion tool using BYOVD.
Malware
AhMythThe most prevalent families were SpyNote, Antidot and AhMyth.AmadeyThe most popular tools this quarter supporting the aforementioned install services in descending order were the Amadey, Lumma, Stealc_v2 and Offerloader strains.AntidotThe most prevalent families were SpyNote, Antidot and AhMyth.Lumma- In 2025, our telemetry indicated the most downloaded information-stealer malware in descending order were the Lumma, Stealc and Vidar strains.OfferLoaderThe most popular tools this quarter supporting the aforementioned install services in descending order were the Amadey, Lumma, Stealc_v2 and Offerloader strains.RhadamanthysConcurrently, authorities successfully disrupted two major information-stealer operations — Lumma and Rhadamanthys — reshaping the threat landscape and compelling affiliates and buyers to pivot toward other malwareSpyNoteThe most prevalent families were SpyNote, Antidot and AhMyth.StealC- In 2025, our telemetry indicated the most downloaded information-stealer malware in descending order were the Lumma, Stealc and Vidar strains.Vidar- In 2025, our telemetry indicated the most downloaded information-stealer malware in descending order were the Lumma, Stealc and Vidar strains.
Vendors
CitrixOn June 17, 2025, Citrix disclosed CVE-2025-5777, a critical out-of-bounds vulnerability inMicrosoftIn 2025, \*Gold targeted remote access technologies such as Cisco, Fortinet, Palo Alto, SonicWall and Watchguard, as well as Microsoft RDWeb.OracleGroup members demonstrated exploitation capabilities and conducted multiple intrusions that targeted vulnerable SAP NetWeaver and Oracle E-Business Suite (EBS) instances, subsequently leaking the exploit code publicly.Salesforce Inc.Group members allegedly were in contact with actors involved in breaches impacting the Salesloft and Gainsight platforms — both of which integrate with the U.S.-based technology company Salesforce Inc.Salesloft Inc.transfer (MFT) software-as-a-service (SaaS) and Oracle EBS instances, the compromise of CRM provider Salesloft Inc.
Products
Cleo HarmonyThis year also was marked by several major supply chain attacks, including CLOP’s attacks on Cleo Harmony managed file transfer (MFT) software-as-a-service (SaaS) and Oracle EBS instances, the compromise of CRM providermacOSThis innovative approach allowed attackers to gain traction in macOS environments by reducing delivery friction and turning execution into a user-driven action.Microsoft RDWebIn 2025, \*Gold targeted remote access technologies such as Cisco, Fortinet, Palo Alto, SonicWall and Watchguard, as well as Microsoft RDWeb.Microsoft WindowsAmong these, the most frequently observed procedure involved the execution of `nltest`, a native Windows command-line utility used by system administrators to query domain controllers (DCs) and domain trustNetScalerthe NetScaler application delivery controller, and on June 26, 2025, ReliaQuest reportedOracle EBSincluding CLOP’s attacks on Cleo Harmony managed file transfer (MFT) software-as-a-service (SaaS) and Oracle EBS instances, the compromise of CRM provider Salesloft Inc.SalesforceGroup members allegedly were in contact with actors involved in breaches impacting the Salesloft and Gainsight platforms — both of which integrate with the U.S.-based technology company Salesforce Inc.Salesloft Driftafter the company’s GitHub account was breached, leading Salesloft customers who had integrated their Drift AI-based chatbot plug-in with the Salesforce platform to be susceptible to data exfiltration from theirSAP NetWeaverGroup members demonstrated exploitation capabilities and conducted multiple intrusions that targeted vulnerable SAP NetWeaver and Oracle E-Business Suite (EBS) instances, subsequently leaking the exploit code publicly.SharePoint Serverdeserialization in on-premises SharePoint Server software. Microsoft also announced
Tools
Cobalt Strikeinstall Cobalt Strike.47DDoSiaactivity from its DDoSia infrastructure.InboxPrime AIOne of the most recent tools to explicitly advertise AI usage is the InboxPrime AI spamming tool the actor Mr_Pentium offered.[^2] The actor allegedly integrated a third-party AI model via an application programmingVulnCloudFlareActor *Burgundy offers VulnCloudFlare
Countries
Cambodiaalso precipitated a mirrored response among hacktivist groups, including the Cambodia-Egyptattacks until the Palestinian territories, Egypt and Jordan were liberated and claimed toGermany50 In late July 2025, Germany — which specifically wasIsraelbetween Israel and Hamas and Russia and Ukraine. The majority of activity pertained toRussiabetween Israel and Hamas and Russia and Ukraine. The majority of activity pertained toSouth Koreaand Qilin’s “Korean Leak” campaign targeting South Korea-based financial institutions.ThailandThailand border dispute, terrorist activity likely related to India-Pakistan tensions andUkrainebetween Israel and Hamas and Russia and Ukraine. The majority of activity pertained toUnited Arab Emiratesand SYLHET GANG-SG — targeted United Arab Emirates (UAE)-based entities for theUnited StatesGroup members allegedly were in contact with actors involved in breaches impacting the Salesloft and Gainsight platforms — both of which integrate with the U.S.-based technology company Salesforce Inc.
Industries
Asset managementOpen source reports indicate more than 20 asset management firms were breached via a common information technology (IT) service provider that supported their internal systems.[^20]Financial institutionsand Qilin’s “Korean Leak” campaign targeting South Korea-based financial institutions.GovernmentIn May 2025, the Australian government introduced new reporting obligations under the Cyber Security Act 2024, which require mandatory ransomware and cyber extortion payment reporting.[^14] Additionally, in SeptemberManufacturingaccounted for more than 63.5% of total victims and the manufacturing sector was the most impacted.[^17]MediaThe group quickly gained media attention for its aggressive tactics, which included threatening employees of breached organizations as well as anyone who publicly investigated its members.steel constructionland-based steel construction company and alleged unauthorized access to a hydroelectricWater treatmentthe HMI system of an Italy-based water treatment company, the HMI environment of a Po-