← threat actors
threat actor · not yet in the cluster map
settra
also tracked as qilin 2, play 1, ralord 1, redact 1, safepay 1
2 stories · 2 in the wild · June 29, 2026 – October 12, 2026
evidence: 2 observed
sectors
- critical infrastructure 1 · Oct 12
- defense 1 · Oct 12
- education 1 · Oct 12
- energy 1 · Oct 12
- finance 1 · Oct 12
- government 1 · Oct 12
- healthcare 1 · Oct 12
- manufacturing 1 · Oct 12
- telecom 1 · Oct 12
geography
- germany 1 · Jun 29
- united states 1 · Jun 29
malware and tools
- bloodhound 1 · Oct 12
- cobalt strike 1 · Oct 12
- sharphound 1 · Oct 12
techniques
- auth bypass 1 · Oct 12
- lateral movement 1 · Oct 12
attack phases seen
- Initial access 1 · Oct 12
- Lateral movement 1 · Oct 12
- Impact 1 · Jun 29
what we reported, newest first, grouped by story
October 12, 2026
- Ransomware crews are exploiting CVE-2026-0257 for unauthorized GlobalProtect access. Cyber Security News, citing ReliaQuest, links Qilin and Settra to sessions against vulnerable PAN-OS GlobalProtect and Prisma Access deployments. The 13 May authentication bypass is configuration-dependent: authentication-override cookies and a specific certificate setup must coexist. Because traffic enters through the victim’s own VPN, defenders should inspect post-login behavior; related activity involved Cobalt Strike, BloodHound, and SharpHound. Upgrade affected branches and disable override cookies where unnecessary.
· Oct 12 · observed · as qilin · Vulnerabilities & Exploits
June 29, 2026
- Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA ("if there is access, there is a target") and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer)
· Jun 29 · observed · as safepay, ralord, redact, qilin, play · Threat Activity