[lockbit]

August 23, 2026

• LockBit is openly recruiting initial-access brokers, offering either outright purchase of access or a share of the ransom with the group handling negotiation (@FalconFeedsio). The group also listed U.S. Bank with a 3 September publication deadline; the bank says it has so far found no evidence of compromise (@DailyDarkWeb). Scepticism is warranted — @Zenul_Abidin argues the brand is "a shell of its former self" now padding its leak site. · Threat Activity

in A Good Day for Offensive Tooling: FortiOS Unpacking, GodPotato in Crystal, and an NTFS3 SUID Trick

August 22, 2026

• LockBit5 is reportedly recruiting initial-access brokers and affiliates, offering a cut of ransom payments or direct purchase of access to companies, banks and platforms — attribution to the LockBit brand is unconfirmed (@DarkWebInformer). · Threat Activity

in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight

August 10, 2026

• LockBit 5.0's Linux build uses ChaCha20 + Curve25519 offline encryption and strace-based evasion, per a technical analysis with IOCs (netacoding). · Threat Activity

in ResetNightmare PoC Drops at Black Hat: One Kerberos Flaw, Any Account's Password Reset

July 19, 2026

• Ransomware roundup: Qilin claimed eight new victims including a Bay Area private school and a Mississippi catfish processor (DarkWebInformer); The Gentlemen listed Colombian oil-and-gas firm Ecopetrol and the U.S. Navy's Military Sealift Command (FalconFeeds); LockBit 5.0 added six victims across India, Singapore, Argentina and the UK (FalconFeeds). · Threat Activity

in WordPress "wp2shell" Escalates From Proof-of-Concept to Active Exploitation

June 22, 2026

• Qilin named a Taiwanese machinery maker, a Bangkok hotel, and a US lighting distributor; LockBit 5.0 posted four new victims across Italy, the Dominican Republic, the US, and Vietnam. Qilin, LockBit. · Ransomware & Hacktivism

in Unpatchable iPhone BootROM Exploit Drops as a New Call-Stack Bypass Defeats 2024-Era EDR

June 18, 2026

• LockBit shows comeback signals with a 15+ victim wave across multiple continents; now the 6th most active group of 2026 (DarkFeed). · Threat Activity & Ransomware

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel