Last Week in Threats Banner

Last Week in Threats: Week 35

Published on August 31, 2026 | By Focused Hunts

Bottom Line

What changed: Qilin ransomware surged 31% week-over-week to dominate the threat landscape, even as overall ransomware victim volume dropped 14.5% and seven new groups entered the top 10.

Who is most exposed: Organizations running developer tooling (JFrog Artifactory, Gitea), infrastructure systems (Linux Kernel, Red Hat), and edge appliances (Citrix NetScaler) face active exploitation of 11 newly cataloged vulnerabilities, with three already weaponized in an AI-driven campaign.

Recommended action: Patch the August 24-30 CISA KEV additions immediately and audit outbound traffic from developer environments for signs of data exfiltration tied to Qilin's accelerating operations.

The Week in Review

The week of August 24 to 30, 2026 marked a sharp divergence in the ransomware landscape. Overall victim postings fell to 207 (down from 242 the prior week, a 14.5% decline), but Qilin bucked the trend with a 31% surge to 42 victims, consolidating its position as the week's dominant threat actor. The drop in aggregate volume coincided with a reshuffling of the top 10, where seven new groups displaced established players, signaling an increasingly fragmented and competitive extortion ecosystem.

CISA added 11 vulnerabilities to the KEV catalog, heavily targeting developer and infrastructure environments. The three older CVEs (CVE-2021-23758, CVE-2015-3246, CVE-2015-5287) appeared in an AlienVault OTX pulse tied to a Chinese-speaking adversary integrating agentic AI into post-compromise operations, demonstrating that even legacy flaws remain actively weaponized when attackers adopt new tooling. The week's malicious IP snapshot showed a 71% hosting-to-residential split, with one address (45.148.10.157) accumulating 213,681 abuse reports, the highest volume of the week by an order of magnitude.

Ransomware Leak-Site Activity

Qilin's surge: Qilin posted 42 victims in the week ending August 30, up from 32 the prior week (a 31% increase, per ransomware.live as of August 31, 2026). This surge occurred while the overall ransomware volume fell 14.5%, making Qilin's momentum the clearest counter-trend signal of the week. With 2,248 total historical victims, Qilin remains one of the most prolific groups active today.

Reshuffled top 10: In total, seven groups entered the top 10 this week, including krybit at #3 with 13 victims, akira at #4 with 12, and SilentRansomGroup at #5 with 10. TheGentlemen dropped from 28 to 21 victims (down 25%), and direwolf fell from #3 to #9. The churn reflects an increasingly competitive and fragmented extortion landscape where no single group outside Qilin maintained week-over-week growth.

Geography: The United States remained the top target country with 54 victims, followed by 36 whose country could not be determined from public postings. The UK, Germany, and Mexico each saw between eight and 14 victims.

Most Active Groups by Victim Postings

qilin 42 thegentlemen 21 krybit 13 akira 12 SilentRansomGroup 10 Dark Project 6

Sector & Technology Watch

This week's CISA KEV additions concentrated risk in two technology classes: infrastructure and developer environments.

Infrastructure/OS, four CVEs: The two Linux Kernel vulnerabilities (CVE-2026-53362, CVE-2022-0995) and two Red Hat privilege-escalation flaws (CVE-2015-3246 in Libuser, CVE-2015-5287 in the Automatic Bug Reporting Tool) expose enterprise Linux deployments. The Red Hat CVEs, though years old, appeared in nine or 10 AlienVault OTX pulses tied to a Chinese-speaking adversary using agentic AI in post-compromise operations (per AlienVault OTX as of August 31, 2026), proving that legacy infrastructure remains a live target when combined with modern attack tooling.

Developer tooling, two CVEs: JFrog Artifactory (CVE-2026-66384, path traversal) and Gitea (CVE-2026-60004, code injection) both enable attackers to compromise software supply chains. The Artifactory flaw was linked to one OTX pulse describing an ownCloud exploit used to steal nuclear records from a Philippine research body (per AlienVault OTX as of August 31, 2026).

Also targeted: Citrix NetScaler edge appliances (CVE-2026-8452), Microsoft SQL Server (CVE-2019-1068), Oracle HTTP Server and WebLogic (CVE-2026-21962), Ajax.NET (CVE-2021-23758), and ownCloud file-sharing (CVE-2023-49105).

Directive: If you run developer tooling or Linux infrastructure, prioritize the CVEs with CISA due dates of August 27-30 (already passed) and September 9-10. Audit artifact repositories and CI/CD pipelines for unauthorized access or modified packages.

Technology Classes Targeted

Infrastructure/OS 4 Developer tooling 2 Web/middleware 2 Edge/network 1 Database 1 File sharing 1

Most-Reported Malicious IPs

AbuseIPDB listed 100 addresses at 100% confidence this week, and one TECHOFF SRV address drew 213,681 reports, an order of magnitude above the rest. Activity centered on SSH brute-force, email and credential attacks, and port scanning. The Censys address listed below is a benign scanner, per GreyNoise Community, and is not counted as malicious.

Attacker Infrastructure & Networks

Excluding the benign Censys scanner, 10 of the 14 enriched addresses sat on hosting networks (one of them a Tor exit) and four on residential ISPs, per AbuseIPDB usage type, with ownership from AlienVault OTX. The residential set includes a Vodafone Germany address, a compromised consumer endpoint rather than a malicious provider. None matched known malware command-and-control or payload hosting in abuse.ch ThreatFox and URLhaus.

Hosting Providers

  • AS48090 Techoff Srv Limited: 45.148.10.157
  • AS215930 Cipher Operations Doo: 62.60.130.253
  • AS14618 Amazon.com, Inc.: 44.212.15.65
  • AS45090 Shenzhen Tencent Computer: 192.144.140.170
  • AS198364 Banatsync Srl: 77.239.124.203
  • ASN not resolved, ISP Microsoft Corporation: 20.121.117.218, 20.65.217.214
  • ASN not resolved, ISP Netiface LLC: 130.12.182.196
  • AS8075 Microsoft Corporation: 40.119.43.218

Residential Networks

  • AS3209 Vodafone GmbH: 178.27.90.142
  • AS45629 JasTel Network International Gateway: 180.183.245.232
  • AS56231 MEASAT Broadcast Network Systems: 38.56.84.145
  • ASN not resolved, ISP Chunghwa Telecom Data: 125.229.165.119

Business Networks

Tor Exit Nodes

  • AS215125 Church of Cyberology: 192.42.116.15

Exploited-Vulnerability Watch

CISA added 11 CVEs to the Known Exploited Vulnerabilities catalog between August 24 and 30, 2026 (per CISA KEV feed pulled August 31, 2026):

Active weaponization signals (AlienVault OTX pulse search as of August 31, 2026):

  • CVE-2021-23758 (Ajax.NET deserialization): nine pulses, including "Chinese-speaking adversary integrates agentic AI into post-compromise operations"
  • CVE-2015-3246 (Red Hat Libuser race condition): 10 pulses, same AI-driven campaign
  • CVE-2015-5287 (Red Hat ABRT privilege escalation): nine pulses, same campaign
  • CVE-2022-0995 (Linux Kernel out-of-bounds write): 12 pulses
  • CVE-2026-66384 (JFrog Artifactory path traversal): one pulse, "ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body"

Recently added (weaponization not yet confirmed in OTX):

The Hunting Takeaway

Hunt for data exfiltration from developer environments tied to Qilin's surge. Qilin's 31% week-over-week increase, combined with two CISA KEV additions in developer tooling (JFrog Artifactory, Gitea), points to supply-chain compromise as a likely vector. Qilin has historically targeted large enterprises where source-code theft or artifact poisoning provides high-value ransom leverage.

Telemetry to hunt:

  • Outbound connections from artifact repositories (Artifactory, Nexus) or Git servers to non-business IPs
  • Unusual volume or timing of file downloads from internal package registries
  • New SSH keys or API tokens created in CI/CD systems
  • External DNS queries or HTTP requests from build agents to paste sites, file-sharing services, or newly registered domains
  • Sudden increases in egress traffic volume from developer VLAN segments

Query example (Splunk SPL):

index=proxy (src_ip="artifact-repo-subnet/*" OR src_ip="cicd-subnet/*")
| where NOT match(dest, "known-good-domains")
| stats count, sum(bytes_out) as egress_bytes by src_ip, dest, user
| where egress_bytes > 10485760
| sort - egress_bytes

Query example (Microsoft KQL):

CommonSecurityLog
| where DeviceVendor == "Palo Alto Networks" or DeviceVendor == "Fortinet"
| where SourceIP has_any ("10.50.0.0/24", "10.60.0.0/24")
| where DestinationIP !has_any ("github.com", "gitlab.com", "known-artifact-cdn")
| summarize EgressMB = sum(SentBytes) / 1048576, ConnectionCount = count() by SourceIP, DestinationHostName, DestinationIP
| where EgressMB > 10
| order by EgressMB desc

Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.

Check Your Environment

Malicious IP sweep: Check firewall, proxy, and authentication logs for connections involving this week's high-confidence malicious IPs (excluding the benign Censys scanner and the Tor exit node, which may appear in legitimate traffic):

Splunk SPL:

index=firewall OR index=proxy OR index=auth
| where src_ip IN ("45.148.10.157", "62.60.130.253", "178.27.90.142", "44.212.15.65", "180.183.245.232", "192.144.140.170", "77.239.124.203", "40.119.43.218", "125.229.165.119", "20.121.117.218")
   OR dest_ip IN ("45.148.10.157", "62.60.130.253", "178.27.90.142", "44.212.15.65", "180.183.245.232", "192.144.140.170", "77.239.124.203", "40.119.43.218", "125.229.165.119", "20.121.117.218")
| stats count by src_ip, dest_ip, action, user, timestamp
| sort - count

Microsoft KQL:

union CommonSecurityLog, SigninLogs, AzureActivity
| where TimeGenerated >= ago(7d)
| where SourceIP in ("45.148.10.157", "62.60.130.253", "178.27.90.142", "44.212.15.65", "180.183.245.232", "192.144.140.170", "77.239.124.203", "40.119.43.218", "125.229.165.119", "20.121.117.218")
   or DestinationIP in ("45.148.10.157", "62.60.130.253", "178.27.90.142", "44.212.15.65", "180.183.245.232", "192.144.140.170", "77.239.124.203", "40.119.43.218", "125.229.165.119", "20.121.117.218")
| project TimeGenerated, SourceIP, DestinationIP, UserPrincipalName, Activity, ResultDescription
| order by TimeGenerated desc

Vulnerability check: Cross-reference the 11 CISA KEV CVEs added August 24-30 against your asset inventory. For each confirmed presence, prioritize patching by the CISA due date (several have already passed as of August 31): CVE-2023-49105 (ownCloud), CVE-2026-53362 (Linux Kernel), CVE-2026-66384 (JFrog Artifactory), CVE-2021-23758 (Ajax.NET), CVE-2015-3246 and CVE-2015-5287 (Red Hat), CVE-2022-0995 (Linux Kernel), CVE-2026-8452 (Citrix NetScaler), CVE-2019-1068 (Microsoft SQL Server), CVE-2026-60004 (Gitea), CVE-2026-21962 (Oracle HTTP/WebLogic). See the KEV catalog and each CVE's NVD page for patch links.

Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.

Related Focused Hunts Resources

Appendix: Data Tables

Top Ransomware Groups

ransomware.live, August 31, 2026

RankGroupVictims
1qilin42
2thegentlemen21
3krybit13
4akira12
5SilentRansomGroup10
6Dark Project6
7chaos6
8lockbit56
9direwolf5
10Orova5

Most-Reported Malicious IPs

AbuseIPDB, August 31, 2026

RankIP AddressTotal ReportsISPOrigin
145.148.10.157213,681TECHOFF SRV LIMITEDhosting
262.60.130.25338,337CIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRADhosting
3178.27.90.1426,463Vodafone GmbHresidential
4192.42.116.15698TOR EXIT AND MOREhosting
544.212.15.65470Amazon Data Services Northern Virginiahosting
6180.183.245.232462Triple T Broadband Public Company Limitedresidential
7192.144.140.170397Tencent Cloud Computing (Beijing) Co., Ltdhosting
877.239.124.203287ROCKET & MARINICA LTDhosting
920.121.117.218139Microsoft Corporationhosting
10130.12.182.196115Netiface LLChosting

New KEV Additions

CISA KEV, August 24-30, 2026

CVE IDProductDue Date
CVE-2023-49105ownCloud ownCloud2026-08-30
CVE-2026-53362Linux Kernel2026-08-30
CVE-2026-66384JFrog Artifactory2026-09-10
CVE-2021-23758Ajax.NET Professional Ajax.NET Professional2026-09-09
CVE-2015-3246Red Hat Libuser2026-09-09
CVE-2015-5287Red Hat Automatic Bug Reporting Tool2026-09-09
CVE-2022-0995Linux Kernel2026-09-09
CVE-2026-8452Citrix NetScaler ADC and NetScaler Gateway2026-08-29
CVE-2019-1068Microsoft SQL Server2026-08-29
CVE-2026-60004Gitea Gitea2026-08-28
CVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in2026-08-27

Methodology & Sources

This weekly recap aggregates open-source threat intelligence from ransomware.live, AbuseIPDB, and the CISA KEV catalog, with enrichment from GreyNoise (community tier), AlienVault OTX, Pulsedive (community tier), and abuse.ch. Figures represent aggregate public statistics captured at a point in time (August 31, 2026) rather than Focused Hunts detections, and all claims trace back to the raw snapshot retained at output/weekly/data/2026-W35.json. Week-over-week trends compare against the prior edition's snapshot (2026-W34.json).

Ransomware victim counts derive from the rolling ledger accumulated every six hours from ransomware.live; this week's total (207) represents the full Monday-Sunday window of August 24-30 with complete coverage (no missing days). AbuseIPDB's blacklist is a point-in-time snapshot, not a cumulative week; IP rankings use total reports and distinct user counts as the activity signal. CISA KEV entries are filtered by dateAdded falling within the window. Where sources were unavailable (OTX timeouts on several CVE pulse searches) or operate in degraded modes (GreyNoise and Pulsedive community tiers), the limitation is noted inline and affected sections are either omitted or presented with reduced confidence. All provider names, pull dates, and per-figure attributions appear inline in the body and appendix; actor claims (e.g., ransomware group postings) are kept separate from confirmed external listings.

← Back to Last Week in Threats