US seizes Virtualine bulletproof hosting domain used by cybercriminals
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
62
- Mentions · 7d3
- Mentions · 30d27
- All mentions51
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
51 articles · newest firstUnit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
34
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
56
Nord Security counts 2,894 ransomware attacks in third quarter
The July–September total is up 50% year over year and 8.6% from the prior quarter, led by The Gentlemen and Qilin.
62
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
78
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
82
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
82
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
88
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
86
Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families
Semperis says 37% of successful ransomware attacks included threats against employees’ friends or relatives.
74
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
78
Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability
Qilin and Settra ransomware gangs actively exploit Palo Alto GlobalProtect auth bypass CVE-2026-0257 to hijack VPN sessions and breach networks.
88
Security Affairs newsletter Round 599 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs round 599 collects weekly headlines on breaches, arrests, ransomware, and exploited flaws.
32
Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access
Qilin and Settra are exploiting Palo Alto GlobalProtect CVE-2026-0257 for unauthorized VPN access.
83
Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention
Germany arrested a suspected Qilin leader extradited from Japan, while the gang kept listing new victims.
76
Japan confirms arrest of Russian Qilin operative, extradition to Germany
Japan arrested a 28-year-old Russian Qilin suspect in Osaka and extradited him to Germany.
66
Germany arrests alleged core Qilin ransomware member after extradition
Germany arrested an alleged core Qilin ransomware member, a Russian national extradited from Japan, over a ransomware attack in Germany.
62
Q3 2026 Sets New Record for Ransomware Attacks
Comparitech recorded a record 2,627 claimed ransomware attacks in Q3 2026, up 27% from Q2, led by Qilin and The Gentlemen with triple extortion rising.
55
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.
58
Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
A 28-year-old Russian alleged core Qilin ransomware member, arrested in Osaka, was extradited to Germany over a $160,000 crypto extortion.
65
Japan hands over ‘Qilin’ hacker group member to Germany
Japan extradited a suspected Russian Qilin ransomware member to Germany.
60
Rethinking automotive cyber risk for the age of accelerated vulnerability discovery
Automotive vulnerabilities jumped to 345 in Q2 2026, with shared cloud and supplier flaws widening fleet exposure.
42
Ransomware Attacks Reach Record High for 2026
NCC Group reports a record 1,073 organizations hit by ransomware in August 2026, with Qilin and The Gentlemen the most prolific groups.
62
Check Point warns of Management Server zero-day exploited in attacks
Check Point patched CVE-2026-93616, an exploited unauthenticated Management Server zero-day.
84
New Check Point flaw lets hackers execute code with root privileges
Check Point patched CVE-2026-91843, a stack-based buffer overflow in Security Management Server logins enabling unauthenticated root remote code execution.
80
Manufacturing Accounts for 22% of all Ransomware Victims
Black Kite finds manufacturing was the most ransomware-targeted sector for a fifth year, with incidents up roughly 40% and European victims growing 85.4%.
65
Should you care about an “AI slowdown?”
Cisco Talos argues an AI slowdown would barely affect cybersecurity, urging focus on fundamentals and Qilin ransomware trends in Japan.
28
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Black Kite reports manufacturing ransomware incidents up 40% in 2026, with new gang The Gentlemen responsible for 12% of attacks.
55
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.
62
Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware
Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.
90
Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware
Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.
87
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.
82
Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware
State-sponsored and ransomware actors actively exploit critical Cisco FMC flaws CVE-2026-20079 (CVSS 10.0) and CVE-2026-20316 to gain root access and deploy ransomware.
82
Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
Cisco Talos confirms nation-state (Sandworm) and ransomware (Qilin) actors actively exploit CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center.
88
Organizations Warned of Cisco Secure FMC Exploitation
Cisco and CISA warn that critical FMC authentication bypass CVE-2026-20079 is actively exploited; CISA added it to the KEV catalog with a September 12 deadline.
88
Related CVEs
by mentions- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2026-5075185%9.3Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-162324%9.3Authentication Bypass in Check Point SmartConsole Grants Full Admin Access
- Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-247701%9.8RAGFlow: In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to…
Appears with
- The Gentlementhreat actor · 15
- Palo Alto Networksvendor · 11
- PAN-OSproduct · 11
- GlobalProtectproduct · 9
- Unit 42organization · 9
- CISAorganization · 9
- Prisma Accessproduct · 8
- Sandwormthreat actor · 8
- Ciscovendor · 7
- Incthreat actor · 7
- ReliaQuestorganization · 7
- UAT-11988threat actor · 6
- UAT-11823threat actor · 6
- Cyclops Blinkmalware · 6
- FBIorganization · 6
- Qilinmalware · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.