US seizes Virtualine bulletproof hosting domain used by cybercriminals
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
62
- Mentions · 7d2
- Mentions · 30d16
- All mentions17
- First seenAug 11, 2026
- Last mentioned2d ago
Timeline
17 articles · newest firstCheck Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
78
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
INC affiliates left servers open, exposing AI-assisted ransomware operations
SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.
72
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
78
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
82
SOCRadar page on INC and Gentlemen ransomware lacks article text
The extract is site navigation plus a banner claiming stolen AI logins, not the ransomware report.
12
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
88
12th October – Threat Intelligence Report
Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.
82
FBI and Secret Service Warn of FortiBleed Lockout Threat
FBI and Secret Service warn FortiBleed has compromised 86,644 Fortinet devices and can lock out administrators.
84
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
FBI says ongoing FortiBleed attacks still lock FortiGate VPN admins out using leaked and cracked credentials.
84
FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials
FBI warns FortiBleed operators compromised over 86,000 Fortinet firewalls and VPNs to steal credentials for ransomware brokers.
86
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
FBI and Secret Service warn FortiBleed is still harvesting Fortinet firewall credentials, with 86,644 logins tied to ransomware access brokers.
84
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
62
Related CVEs
by mentions- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2026-908289%9.8Actively Exploited SQL Injection in Drupal Core
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2026-1102641%10.0Unauthenticated RCE in GitLab CE/EE via regex integer overflow
- SYSTEM code execution via Backup Viewer in Veeam Backup
Appears with
- SOCRadarorganization · 7
- Fortinetvendor · 7
- Qilinthreat actor · 7
- Palo Alto Networksvendor · 7
- Unit 42organization · 6
- PAN-OSproduct · 6
- FortiGateproduct · 6
- Lynxthreat actor · 6
- GlobalProtectproduct · 5
- FBIorganization · 5
- The Gentlementhreat actor · 5
- CISAorganization · 5
- Payloadthreat actor · 4
- Prisma Accessproduct · 4
- Settrathreat actor · 3
- ReliaQuestorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.