Digital Rage

Late September saw ransomware leaders The Gentlemen and Qilin hold the top positions while identity abuse, supply-chain attacks, exposed services, and AI-assisted cloud attacks accelerated the convergence of trusted-access threats.

The first half of September brought an unusually heavy vulnerability window, a return to the top spot for The Gentlemen, and a broader mid-market victim footprint. Exploited Microsoft Windows and Chromium V8 flaws, identity-driven access, and new cross-platform malware make rapid patching and stronger identity controls urgent.

Late August tightened around infrastructure and access: Qilin widened its ransomware lead, technology moved into the top victim sector, and the U.S. remained dominant even as its share fell again. Enterprise-facing vulnerabilities clustered around Oracle/WebLogic, SharePoint, vCenter, Zimbra, PaperCut, and NetScaler, while malware activity leaned heavily into stealers, loaders, mobile banking fraud, and remote access.

Threat activity stayed busy in early August, with ransomware crews pushing sharper extortion tactics, cloud-aware espionage groups refining their stealth, and a wave of edge-device and management-tool exploits giving attackers quick footholds. Botnets and stealers kept expanding through unpatched IoT and browser weaknesses, while social-engineering-driven mobile fraud added a fresh twist. Overall, fast patching, tighter access controls, and closer log scrutiny mattered more than ever as actors s

The back half of July showed a sharp rise in stealthy, long-dwell threats: ransomware crews leaned on faster automation, cloud pivots, and polished extortion, while APTs pushed supply-chain abuse, identity attacks and browser-based C2. Active exploits across Fortinet, Cisco, Langflow, SharePoint and WordPress kept pressure high, making rapid patching and tighter admin controls essential for defenders.

The first half of July saw threat actors ramp up fast, high-touch intrusions with aggressive ransomware playbooks. UAT-7810 built ORB (Operational Relay Box) meshes by hijacking routers and edge devices for stealthy persistence, while the group known as The Gentlemen leaned into aggressive extortion boosted by AI-driven automation and quick RCE chaining. Identity compromise and edge-device abuse were the two biggest entry points. The takeaway from the Byer Co. team: tighter patching, firmware up

The first half of July showed threat actors pushing harder with high-touch intrusions, router-based persistence, and faster ransomware playbooks. UAT-7810's expanding ORB mesh and The Gentlemen's aggressive extortion stood out, while fresh web app exploits and AI-driven automation kept pressure on defenders. The big theme was speed and stealth: identity compromise, edge device abuse, and quick RCE chaining that demand tighter patching and sharper visibility across networks.

The second half of June stayed active with SETTRA ransomware bursting into the top five after 22 victims in a single week, FortiBleed dominating vulnerability headlines, and Technology climbing to the top victim sector. Large enterprises saw a sharp spike in targeting while U.S. organizations remained the most impacted.

An AI marketing operating system for technology manufacturers connects positioning, source material, templates, review rules, and reporting into one specialist-guided workflow.

Threat activity in early June picked up across the board, with DeadLock's sharp debut driving over a fifth of observed ransomware activity and mid-market organizations seeing a nearly 38% spike in targeting. Manufacturing held the top sector spot while retail surged to second. Shadow-Earth-066 emerged as the most concerning adversary with its rapid shift to automation-driven reconnaissance, and actively exploited vulnerabilities in WebLogic, Android, Cisco SD-WAN, and Check Point gateways kept d