Summary
Attackers are turning trusted software and hardware against organizations, with ransomware crews like Gentlemen using vulnerable Windows drivers to disable defenses and encrypt files. Cyware.com tracks how this Russian-speaking operation leverages Safetica and Lenovo drivers to evade detection, targeting manufacturing, healthcare, and technology firms across the United States and Europe. Over 800 attacks have been claimed, with outages translating directly into lost revenue and operational downtime.
SafePay ransomware is slashing through global defenses, clocking more than 600 victim organizations since 2024. The gang exploits internet-facing systems using phishing, password guessing, and known vulnerabilities such as CVE-2020-3259 and CVE-2023-20269, then moves laterally with admin tools before exfiltrating data and demanding cryptocurrency. Recent disruptions have hit companies like Microlise and Conduent, with attacks spanning North America, Europe, Latin America, and Australia.
A new breed of autonomous threat is sweeping the internet as Skynet agents hijack exposed AI models, running up to 100,000 steps without human intervention. These agents use SSRF, command injection, and debugger PIN abuse to steal credentials and mine cryptocurrency, leaving organizations with unexpected cloud bills and compromised secrets. The campaign underscores the risk of leaving AI endpoints exposed without authentication.
Critical vulnerabilities are exposing core infrastructure, with two PHP bugs (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) enabling remote code execution across platforms like WordPress, Drupal, and Magento. Exploit code has leaked ahead of the official patch, and attackers are actively compromising unpatched systems. CERT-EU and CloudLinux have issued urgent guidance, while a permanent fix is scheduled for October 21.
Threat actors are innovating with AI-powered phishing, as Lazarus Group targets South Korean firms using spear-phishing emails and AI-generated photos. The campaign, dubbed Operation FlashHole, leverages hijacked GitHub accounts and advanced encryption, including post-quantum algorithms, to maintain persistent espionage access. Researchers link this activity to the broader Cascade Hole effort, highlighting the evolving sophistication of state-linked cyber operations.
Top Malware Reported in the Last 24 Hours
Gentlemen ransomware abuses trusted Windows drivers
Gentlemen is a Russian-speaking ransomware operation that turns trusted hardware and security software components against victims to knock out defenses before encrypting files. It uses a bring-your-own-vulnerable-driver (BYOVD) approach, exploiting Safetica’s ProcessMonitorDriver version 11.26.18 and Lenovo’s BootRepair.sys version 2.5.30.11281 to terminate security processes and help its payload run uninterrupted. After that, it encrypts data with ChaCha20 using per-file keys, adds the .cyvzca extension, and attempts to cover its tracks by disabling Microsoft Defender, clearing event logs, and removing PowerShell histories. Researchers describe it as a ransomware-as-a-service (RaaS) provider with historical affiliations to LockBit and Qilin. Manufacturing, technology, healthcare, professional services, and retail organizations in the United States and Europe are among those in the crosshairs, where outages can quickly become lost revenue and operational downtime.
SafePay ransomware scales attacks across continents
SafePay has become one of the most active ransomware gangs since 2024, with officials citing more than 600 victim organizations, including recent disruptions affecting Microlise and Conduent. It breaks in through phishing, password guessing, and automated exploitation of internet-exposed systems, including known flaws such as CVE-2020-3259 and CVE-2023-20269. Once inside, it uses common admin-style tooling for lateral movement such as PsExec and WinRM, then stages theft and exfiltration using tools including FileZilla, 7-Zip, RClone, WinRAR, WinSCP, and OneDrive before encrypting systems and demanding cryptocurrency. U.S. authorities say it operates across North America, South America, Europe, and Australia, hitting businesses as well as critical infrastructure. In guidance tied to this activity, agencies emphasize measures such as multi-factor authentication, maintaining offline backups, and network segmentation to reduce the blast radius of an intrusion.
Skynet agent hijacks exposed AI models
Skynet is an autonomous offensive agent that scans the internet for exposed AI models and then “LLMjacks” them—turning the victim’s own compute into a platform for credential theft and cryptocurrency mining. It can run for up to 100,000 steps without human intervention, using each successful compromise to help fund the next. Reported exploitation methods include SSRF, command injection, and abuse of the Werkzeug debugger PIN, paired with layered identity camouflage and secret “normalization” to stay operational. For organizations hosting model endpoints, the consequence is direct: unexpected cloud bills, stolen secrets, and servers repurposed for criminal workloads. The associated recommendations stress not exposing LLM APIs or model servers to the internet without authentication, treating AI API keys as high-value credentials, and enforcing Instance Metadata Service v2 with a hop limit of one.
Top Vulnerabilities Reported in Last 24 hours
Leaked PHP bugs open websites to takeovers
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) can enable remote code execution, turning vulnerable web servers into easy entry points for full system compromise. Reports tie exploitation to PHP’s session upload-progress handling in multipart requests and to file-upload request patterns, putting widely used PHP-based platforms such as WordPress, Drupal, Magento, Joomla, and Laravel in the blast radius. Attackers are actively exploiting these issues in the wild, and separate reporting says exploit code has leaked publicly ahead of the official patch release. CERT-EU has issued a warning, while CloudLinux notes its Imunify360 ruleset 8.83 can provide interim blocking for the known exploit shape. The PHP security team has scheduled a permanent fix release for October 21 at 14:00 UTC, with guidance centered on upgrading PHP to a safe version once available; affected versions are described as spanning PHP 5 through 8 (with one advisory calling out 8.2 to 8.5).
FortiSIEM bug lets strangers run code
A critical Fortinet FortiSIEM vulnerability (CVE-2026-106173, CVSS 9.4) allows unauthenticated remote code execution, meaning an internet attacker could take over an exposed monitoring server without logging in. The attack path described involves path traversal and null byte injection against FortiSIEM’s gRPC service, enabling file overwrites outside intended directories. Exploitation write-ups show attackers can manipulate the query-id parameter to overwrite operational scripts—such as a Redis health-check script run by cron every 60 seconds—turning routine automation into an execution pathway. No active exploitation claim is stated in the source, but a public write-up indicates the technique is practical and weaponizable. Fortinet has patches for FortiSIEM 7.5.1 and above (the issue affects 7.5.0), and guidance also emphasizes restricting access to the gRPC service and monitoring for unusual file modifications or executions.
Ransomware crews abuse PAN-OS VPN bypass
Palo Alto Networks says ransomware groups Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS and Prisma Access that enables unauthorized VPN connections (CVE-2026-0257, CVSS 7.8). In plain terms, the flaw can let intruders slip into corporate networks while sidestepping multi-factor authentication, creating a fast lane to ransomware deployment. Attackers are already exploiting this in the wild, and Palo Alto’s account describes follow-on activity including lateral movement and targeting of virtualization layers, including actions against ESXi environments. The company says impacted victims span sectors including education, financial services, and healthcare, where downtime can quickly become a real-world service disruption. The issue was patched in May 2026, and the vendor guidance highlighted includes applying patches, monitoring for unauthorized VPN connections, and tightening protections around virtualization infrastructure.
Top Threat Actors Reported in Last 24 hours
Lazarus Group uses AI-phishing in Korea
Lazarus Group, a North Korea-linked threat actor, is behind “Operation FlashHole,” a campaign that blends spear-phishing with AI-generated photos to draw targets into a multi-stage malware infection chain. They have been active since July 2025, focusing on South Korean software, construction, and communication firms while using hijacked GitHub accounts to support the operation. Once access is gained, they deploy a cluster of tooling including TechHub, Cubridge, TouchShift, and ClientHub to maintain control and move through affected systems. For organizations in the crosshairs, the practical impact is heightened risk of long-lived espionage access and data theft triggered by what looks like routine business email. The campaign also stands out for its use of advanced encryption, including post-quantum cryptography (ML-KEM-1024) and the Threefish algorithm, aimed at concealing payloads and complicating analysis. Researchers tied the activity to the broader “Cascade Hole” effort.
Gentlemen ransomware abuses Lenovo, Safetica drivers
Gentlemen, a suspected Russian-speaking ransomware operation, is using a “bring your own vulnerable driver” approach to shut down security tools by abusing legitimate drivers from well-known vendors. They exploit Safetica’s ProcessMonitorDriver version 11.26.18 and Lenovo’s BootRepair.sys version 2.5.30.11281 to terminate security processes before encrypting systems. The group targets manufacturing, technology, healthcare, professional services, and retail, raising the risk of downtime and business disruption for everyday operations like production, appointments, and customer support. Their ransomware uses ChaCha20 with per-file keys and appends the .cyvzca extension to encrypted files, while also working to weaken defenses and obscure traces. The operation emerged in mid-2025 and has claimed over 800 attacks, with a heavy focus on the United States and Europe.
SafePay ransomware spreads via remote tools
SafePay, a ransomware gang that has become one of the most active groups since 2024, is linked to attacks on more than 600 organizations, with operations that resemble the now-defunct LockBit. They break in using a mix of automated scripts targeting internet-exposed systems, phishing, and password guessing, then lean on legitimate remote-access software such as AnyDesk and TeamViewer to push their ransomware deeper into victim networks. Once inside, they create or take over accounts, disable security protections, and move laterally using built-in system tools before locking systems and changing user passwords to block recovery. For companies and public-sector targets, the human consequence is operational paralysis—staff can be locked out of core systems while sensitive files are compressed and exfiltrated ahead of cryptocurrency ransom demands. Recent victims include Microlise and Conduent, and the group has also hit dozens of German companies alongside organizations across Latin America and the U.S.
Frequently Asked Questions
What is Gentlemen? Gentlemen is a Russian-speaking ransomware operation that turns trusted hardware and security software components against victims to knock out defenses before encrypting files. It uses a bring-your-own-vulnerable-driver (BYOVD) approach, exploiting Safetica’s ProcessMonitorDriver version 11.26.18 and Lenovo’s BootRepair.sys version 2.5.30.11281 to terminate security processes and help its payload run uninterrupted.
What is SafePay? SafePay has become one of the most active ransomware gangs since 2024, with officials citing more than 600 victim organizations, including recent disruptions affecting Microlise and Conduent. It breaks in through phishing, password guessing, and automated exploitation of internet-exposed systems, including known flaws such as CVE-2020-3259 and CVE-2023-20269.
What is Skynet? Skynet is an autonomous offensive agent that scans the internet for exposed AI models and then “LLMjacks” them—turning the victim’s own compute into a platform for credential theft and cryptocurrency mining. It can run for up to 100,000 steps without human intervention, using each successful compromise to help fund the next.
What is CVE-2026-109618? Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) can enable remote code execution, turning vulnerable web servers into easy entry points for full system compromise. Reports tie exploitation to PHP’s session upload-progress handling in multipart requests and to file-upload request patterns, putting widely used PHP-based platforms such as WordPress, Drupal, Magento, Joomla, and Laravel in the blast radius.
What is CVE-2026-106173? A critical Fortinet FortiSIEM vulnerability (CVE-2026-106173, CVSS 9.4) allows unauthenticated remote code execution, meaning an internet attacker could take over an exposed monitoring server without logging in. The attack path described involves path traversal and null byte injection against FortiSIEM’s gRPC service, enabling file overwrites outside intended directories.
What is CVE-2026-0257? Palo Alto Networks says ransomware groups Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS and Prisma Access that enables unauthorized VPN connections (CVE-2026-0257, CVSS 7.8). In plain terms, the flaw can let intruders slip into corporate networks while sidestepping multi-factor authentication, creating a fast lane to ransomware deployment.
What is Lazarus Group? Lazarus Group, a North Korea-linked threat actor, is behind “Operation FlashHole,” a campaign that blends spear-phishing with AI-generated photos to draw targets into a multi-stage malware infection chain. They have been active since July 2025, focusing on South Korean software, construction, and communication firms while using hijacked GitHub accounts to support the operation.