← threat actors
threat actor
Storm-1567
also tracked as akira 5, qilin 3, inc 2, the gentlemen 2, dragonforce 1, 8base 1, black basta 1, interlock 1, kongtuke 1, rhysida 1, woodgnat 1
5 stories · 4 in the wild · June 21, 2026 – August 14, 2026
evidence: 4 observed
how they got in
- credential stuffing 1 · Aug 13
sectors
- critical infrastructure 1 · Aug 14
- education 1 · Jun 25
- technology 1 · Jun 25
malware and tools
- akira 1 · Aug 13
- mistic 1 · Jun 25
techniques
- data exfiltration 1 · Aug 14
- edr evasion 1 · Aug 14
- safe mode bypass 1 · Aug 14
- credential access 1 · Aug 13
- defense evasion 1 · Aug 13
- impact 1 · Aug 13
attack phases seen
- Defense evasion 2 · Aug 14
- Impact 2 · Aug 13
- Initial access 2 · Aug 13
- Exfiltration 1 · Aug 14
what we reported, newest first, grouped by story
Aug 13 – August 14, 2026 · 2 reports
- Akira affiliates now reboot victims into Safe Mode with Networking to strip EDR — Huntress published full analysis of the technique, and in the observed cases the crew exfiltrated data but failed to encrypt (earlier coverage). (BleepingComputer)
· Aug 14 · observed · as akira · Threat Activity
- An Akira affiliate rebooted a victim into Safe Mode to strip EDR before encrypting — then broke its own encryptor in the process. The intrusion started with a VPN credential-spray, and defenders should watch for Safe Mode and boot-configuration changes alongside MFA enforcement, per The Register and SC Media.
· Aug 13 · observed · via credential stuffing · as akira · Threat Activity
Jun 17 – July 11, 2026
- Qilin continues to lead the 2026 ransomware landscape by volume (708 tracked attacks), ahead of The Gentlemen, Akira, INC, and DragonForce. DarkFeed via Ido Cohen
· Jul 11 · none · as qilin, the gentlemen, akira, inc, dragonforce · Threat Intelligence
Jun 19 – June 25, 2026 · 2 reports
- Mistic, a stealthy new RAT, is the entry point for initial-access broker Woodgnat (aka KongTuke), who feeds ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta, hitting insurance, education, IT, and professional-services targets. BleepingComputer, SecurityWeek
· Jun 25 · observed · as woodgnat, kongtuke, qilin, interlock, rhysida, akira, 8base, black basta · Threat Intelligence
- INC has grown into one of 2026's most prolific RaaS operations with 830+ victims since August 2023, absorbing affiliates after the LockBit and BlackCat disruptions (The Hacker News). Current leaderboard tracking puts Qilin at 651 attacks, The Gentlemen at 430, and Akira at 282 (DarkFeed).
· Jun 21 · observed · as inc, qilin, the gentlemen, akira · Ransomware & EDR Evasion