Jun 17 – June 23, 2026 · 2 reports
- Prinz Eugen rebrands as a "for-profit hacking" outfit — the group relaunched its leak site, says it does not currently run a RaaS program, and closed membership to existing core members — an infrastructure/branding shift worth tracking. Ido Cohen · Jun 23 · none · Threat Intelligence
- DeadLock is expanding its abuse of Polygon blockchain smart contracts — moving beyond chat-proxy rotation to host its data-leak site entirely on-chain (75 victims since February), with HTML ransom notes fetching victim data live from the contract (ESET). Nextron flagged KRYBIT, a new double-extortion strain whose YARA profile overlaps heavily with the leaked Babuk codebase (Nextron), and Prinz Eugen emerged prioritizing recently-modified files for faster encryption while leaving no ransom note (BleepingComputer). · Jun 21 · observed · as deadlock, krybit · Ransomware & EDR Evasion