Late August tightened around infrastructure and access: Qilin widened its ransomware lead, technology moved into the top victim sector, and the U.S. remained dominant even as its share fell again. Enterprise-facing vulnerabilities clustered around Oracle/WebLogic, SharePoint, vCenter, Zimbra, PaperCut, and NetScaler, while malware activity leaned heavily into stealers, loaders, mobile banking fraud, and remote access. The common thread is speed. Actors are exploiting exposed services, abusing social engineering, and rotating infrastructure quickly, putting fast patching and stronger identity controls at the center of the defensive picture.
Report Links
Download Threat Brief For August 16-31 2026
Byer-Nichols Threat Brief Podcast August 16-31 2026
Ransomware Actors
| Ransomware | Percentage | Last Period | Two Ago |
|---|---|---|---|
| Qilin | 17.71% | 1 | 2 |
| The Gentlemen | 9.48% | 2 | 1 |
| Dire Wolf | 4.65% | 9 | N/A |
| INC Ransom | 4.29% | 5 | 5 |
| LockBit | 3.94% | N/A | 16 |
Qilin separated from the pack, climbing to 17.71% and adding 4.82 percentage points while holding the top spot. The Gentlemen stayed #2 but cooled to 9.48%. Dire Wolf is the real mover, jumping from ninth to third, while INC Ransom remained steady and LockBit returned to the top five. Notably, the top-five share fell from 44.34% to 40.07%, so Qilin’s surge is happening inside a more fragmented field rather than a broader consolidation.
Victim Sector
| Sector | Percentage | Last Period | Movement |
|---|---|---|---|
| Technology | 16.28% | 2 | 2 -> 1 |
| Manufacturing | 15.74% | 1 | 1 -> 2 |
| Financial Services | 14.13% | 5 | 5 -> 3 |
| Construction | 12.88% | 4 | same |
| Retail | 8.94% | 3 | 3 -> 5 |
Victim Location
| Victim | Percentage | Last Period | Movement |
|---|---|---|---|
| USA | 41.32% | 1 | same |
| Germany | 6.62% | 4 | 4 -> 2 |
| Italy | 5.19% | 3 | same |
| UK | 3.94% | 4 | same |
| Canada | 2.50% | 2 | 2 -> 5 |
Victim Org Size
| Size | Percentage | Last Period | Change |
|---|---|---|---|
| Small Business (500 or less) | 76.57% | 73.28% | +3.29% |
| Mid-Market (501-5000) | 16.99% | 17.49% | -0.50% |
| Large Enterprise (5000+) | 6.44% | 9.23% | -2.79% |
Trending Adversaries
Aur0ra brings a newer AI-assisted criminal angle, while Cl0p remains the most recognizable mass-exploitation specialist in the set. Dark Caracal, Mabna Institute, and Transparent Tribe skew toward longer-term espionage and intelligence collection, while Storm-1175 operates at ransomware speed, weaponizing exposed web-facing systems and newly disclosed flaws quickly. Together, the group shows the current split clearly: persistent intelligence collection on one side and rapid exploitation-for-impact on the other.
- Aur0ra
- Cl0p
- Dark Caracal
- Mabna Institute
- Storm-1175
- Transparent Tribe
Trending & Actively Exploited Vulnerabilities
Late August’s exploited-vulnerability list is concentrated in enterprise infrastructure rather than everyday end-user software: Oracle/WebLogic, SharePoint, VMware vCenter, Zimbra, PaperCut, and Citrix NetScaler all sit in high-value administrative or collaboration paths. Microsoft IKE and the Linux kernel broaden the exposure into core operating-system components, while two PaperCut entries reinforce how often attackers return to centralized management platforms with broad network reach. Internet-facing admin services and management tools should remain at the front of the patch queue.
| CVE | Vendor | Product |
|---|---|---|
| CVE-2026-21962 | Oracle | HTTP Server and Oracle Weblogic Server Proxy Plug-in |
| CVE-2026-33824 | Microsoft | Internet Key Exchange (IKE) Service Extensions |
| CVE-2026-53362 | Linux | Kernel |
| CVE-2026-55040 | Microsoft | SharePoint |
| CVE-2026-59310 | Broadcom | VMware vCenter |
| CVE-2026-65400 | Apple | macOS |
| CVE-2026-73570 | Synacor | Zimbra Collaboration Suite (ZCS) |
| CVE-2026-81578 | PaperCut | NG/MF |
| CVE-2026-82078 | PaperCut | NG/MF |
| CVE-2026-8452 | Citrix | NetScaler ADC and NetScaler Gateway |
Trending Malware
| Trending Malware | Details |
|---|---|
| Amatera Stealer | Amatera Stealer is an evolved successor to ACR Stealer, sold as malware-as-a-service and actively maintained by its operators. It's typically delivered via ClearFake-style web injects, using multi-stage browser exploitation chains to land on victim endpoints. The malware focuses on harvesting browser credentials, cookies, crypto-wallet data, and other application secrets, then exfiltrates them over stealthy HTTPS and NTSockets-based C2. Recent builds add WoW64 syscall evasion and secondary payload execution, making Amatera both a data-stealer and a flexible initial access tool. |
| C2Looper | C2Looper is a compact but capable Rust backdoor used by ransomware-aligned actors to gain and maintain a foothold in enterprise networks. It's delivered through multi-stage ClickFix chains, where victims are tricked into running "fix" commands that ultimately install the malware. Once resident, C2Looper collects host telemetry, polls its C2 for tasks, and can execute arbitrary commands, run remote shells, perform reconnaissance, and fetch additional payloads. Newer variants update themselves via OneDrive DLL sideloading and abuse GitHub repositories for command-and-control and data storage, blending into normal developer traffic. |
| MacSync Stealer | MacSync Stealer targets macOS (and some Windows) users by abusing poisoned search results, fake GitHub repos, and AI-themed malvertising to push "installation guides" that hide ClickFix one-liner commands. When a victim pastes the curl/zsh command into Terminal, a multi-stage chain downloads loaders and AppleScript components that harvest browser data, Keychain secrets, SSH and cloud credentials, and other sensitive files. Collected data is staged, compressed, and exfiltrated over carefully profiled HTTP requests tied to rotating domains. Recent campaigns show MacSync being used against developers and admins, turning their everyday command-line habits into a high-value compromise path. |
| SynkLoader | SynkLoader is distributed through Microsoft Teams phishing where attackers impersonate internal IT support and direct users to install a fake "PowerShell Cleaner" MSI hosted on Azure. The installer drops PowerShell and Python components plus fake Microsoft DLLs, then selectively activates modules based on the environment. Capabilities include system profiling, scheduled-task persistence, a PhishLocker module that mimics the Windows lock screen to capture passwords, reverse-proxy tunneling, interactive PowerShell shells, and VNC-style desktop streaming. This "kitchen-sink" design makes SynkLoader a versatile initial access and remote-operations platform, well suited to staging ransomware or broader intrusions. |
| ToxicPanda 2.0 | ToxicPanda 2.0 is an updated Android banking Trojan and remote-access tool built specifically for "on-device fraud," operating directly from the victim's handset rather than an attacker machine. It's delivered via sideloaded apps hosted in AWS buckets, wrapped in fake installation flows that request VPN privileges and then decrypt an embedded payload. Once active, it abuses Android Accessibility Services to inspect UI elements, automate interactions, capture PINs, and display banking overlays over legitimate apps. By acting from the victim's device, IP, and app session, ToxicPanda 2.0 can bypass many anomaly-based fraud checks and execute high-risk transactions while maintaining longer-term control of the phone. |
| ValleyRAT | ValleyRAT is a multi-stage remote access Trojan deployed in campaigns that rely on social engineering and Trojanized installers rather than exploits. Recent activity shows it being bundled inside signed Chinese adware such as QN Wallpaper, which users may add to antivirus exclusion lists, allowing DLL sideloading of a malicious libcef.dll under a trusted process. Once loaded, ValleyRAT injects itself into system processes, establishes persistence via registry keys, and can mark its process as "critical" to trigger a BSOD if terminated. Its capabilities include keylogging, clipboard theft, screenshot capture, command execution, and modular plugin loading, making it well suited for long-term espionage and system control, particularly against Chinese-speaking targets. |
Top News
- Chinese ZBT Routers Sold Worldwide Contain Backdoors
- Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
- Delta flight carrying DEF CON “hackers” hit by Wi-Fi attack mid-air
- Interpol's Jackal IV Disrupts West African Crime Infrastructure
- NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month
- Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
- Russian Hackers Phish EU Officials Over Messaging Apps
Contributors
Written by Jeremy Nichols, Director, Security Programs & Strategy at SecureSky Executive Summaries & Adversary Bio's by Geoff Rehmet, Cybersecurity Architect Produced & Distributed By Phish Tank Digital