Intelligence Insights: August 2026

Bridewell’s managed security services are built upon a proactive, threat-led defence strategy. Moving beyond reactive monitoring, we actively track adversary infrastructure and tradecraft. By seamlessly integrating Cyber Threat Intelligence (CTI), Incident Response (IR), and Managed Detection and Response (MDR), we ensure our clients remain ahead of the evolving threat landscape.

In a landscape defined by rapid adaptation, knowing what is attacking you is just as critical as knowing how. This month’s Threat Insights leverages data from Bridewell’s global MDR and Incident Response engagements to expose the top malicious infrastructure of August 2026. We go beyond the headlines to provide actionable detection guidance on the month's threat insights, equipping your team with the foresight to stay one step ahead.

Throughout August, our team tracked two ransomware operations that between them illustrate how varied the extortion ecosystem has become. The first was The Gentlemen, a Ransomware-as-a-Service programme that emerged in mid-2025 and has since become one of the most active operations of 2026. Tracked by Microsoft as Storm-2697, the group offers affiliates an unusually generous 90% share of paid ransoms, recruits openly through underground forums, and supports its affiliates with custom tooling rather than an encryptor alone. Its Go-based Windows encryptor pairs per-file encryption with a self-propagation module that attempts to deploy itself across every reachable host on a network, meaning a single successful execution can escalate rapidly into an enterprise-wide event. Initial access remains heavily focused on internet-facing infrastructure and stolen credentials rather than novel exploitation, reinforcing that edge device hygiene and credential exposure remain the dominant risk factors for ransomware intrusion.

Alongside this, August also saw continued activity from Everest, a long-running, closed Russian-speaking group active since at least December 2020. Everest is notable less for technical sophistication than for its business model, operating three parallel revenue streams: conventional double extortion, initial access brokerage, and a paid corporate insider recruitment programme that openly solicits employees willing to hand over remote access. Its encryptor is comparatively noisy, performing an extensive sequence of recovery sabotage, security control weakening and permission changes before a single file is encrypted, which offers defenders a meaningful window in which to detect and intervene. Recent reporting has also raised questions about the reliability of the group's leak site claims, a reminder that victim listings should be treated as allegations requiring verification rather than confirmed incidents.

The Gentlemen is a Ransomware-as-a-Service operation that emerged in mid-2025 and opened to affiliates around September of that year. Reporting indicates the operators were previously active as ArmCorp, an affiliate of the Qilin programme, with the split apparently precipitated by a dispute over unpaid commissions. The group is led by a Russian-speaking threat actor operating under the aliases hastalamuerte and zeta88, supported by a small, structured core team, variously reported as between nine and twenty operators, with individuals specialising in Fortinet exploitation, credential harvesting, NTLM relay attacks and post-exploitation activity. Growth has been substantial: one widely used tracking source counted 580 claimed victims across 77 countries by early July, with manufacturing the most affected sector and victim numbers in the first half of 2026 exceeding the second half of 2025 by more than six times, making The Gentlemen the second most active RaaS programme of the year.

Initial access is overwhelmingly opportunistic and focused on internet-facing infrastructure, with the exploitation of CVE-2024-55591 in FortiOS and FortiProxy the primary route, alongside exposed RDP, SSL VPN appliances, Cisco edge devices, brute-forced credentials and NTLM relay attacks. Just as significant is the group's reliance on infostealer credential logs; leaked internal communications show operators routinely searching data-breach and log aggregation services for valid corporate logins, with a dedicated team member responsible for acquiring and weaponising them. In practical terms, a historic infostealer infection on an employee, contractor or partner device functions as an open door until the exposed credentials are forcibly reset. Once inside, operators tailor their tooling to the security products they encounter, using a Bring Your Own Vulnerable Driver technique alongside a dedicated EDR killer framework to disable protection at the kernel level, before staging and exfiltrating data with tools such as WinSCP or Rclone.

The encryptor is written in Go and obfuscated with Garble, combining per-file ephemeral Curve25519 key exchange with the XChaCha20 stream cipher so that no key or nonce is reused. Smaller files are encrypted in full while larger files are partially encrypted across distributed chunks to reduce processing time. Before encryption begins, the malware disables Defender real-time monitoring and adds broad exclusions, deletes Volume Shadow Copies using both vssadmin and wmic, clears event logs with wevtutil, and removes prefetch files, RDP logs and PowerShell history, with persistence established redundantly through scheduled tasks and Run keys in both SYSTEM and user contexts. The most distinctive component is self-propagation: the encryptor stages itself in a hidden SMB share, drops or downloads PsExec, enumerates reachable systems, and then attempts as many as twenty-one separate remote execution operations against each discovered host, spanning remote file copy, PsExec, WMIC, scheduled tasks, service creation, PowerShell remoting and direct WMI invocation. Each method is attempted regardless of whether earlier ones fail, so a single success anywhere on the network is enough to continue propagation.

Defence should begin with the initial access vectors that consistently work for the group. Organisations should scope for and patch the vulnerabilities known to be exploited, including CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182 and CVE-2025-7771, and audit internet-facing firewalls, VPNs and RDP endpoints for evidence of prior compromise. Phishing-resistant multifactor authentication and regular credential rotation reduce the value of stolen credential logs, and monitoring for infostealer exposure across employees, contractors and third parties should be treated as a preventative control. On the endpoint, EDR tamper protection should be enabled and alerting configured for unsigned or known-vulnerable driver loads, log clearance via wevtutil, and shadow copy deletion. Given the propagation model, containment carries particular weight: enforcing SMB signing, disabling SMBv1, restricting lateral movement between segments, and treating virtualised infrastructure as tier-0 with ESXi management interfaces isolated. High-severity alerting on scheduled tasks and services matching the group's naming conventions provides a reliable late-stage detection opportunity, and validated offline backups remain the last line of defence.

Microsoft Defender XDR KQL Query

Identifies suspicious activity associated with scheduled tasks, WMIC process creation, and lateral movement using XCOPY that may indicate malicious tooling deployment.

DeviceProcessEvents
| where (FileName =~ "schtasks.exe"
        and ProcessCommandLine has "/create"
        and ProcessCommandLine has_any ("WinSvcUpdate2", "WindowsUpdSvc31", "WindowsUpdateSvc", "SysUpdate", "PRO-TECH"))
    or (FileName =~ "wmic.exe"
        and ProcessCommandLine has_all ("process", "call", "create")
        and ProcessCommandLine has_any ("certutil", "cu.msi", "cons_update.msi", "cons_c1.0.1.msi"))
    or (FileName =~ "xcopy.exe"
        and ProcessCommandLine contains @"\C$\"
        and ProcessCommandLine has_any ("wsu.exe", "cu.msi", "cons_update.msi", "cons_c1.0.1.msi"))
| project TimeGenerated, Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessFileName, InitiatingProcessCommandLine, IsProcessRemoteSession, ProcessRemoteSessionIP
| sort by TimeGenerated desc

Everest is a closed, Russian-speaking ransomware and data extortion operation active since at least December 2020, targeting Windows environments with a C# and .NET encryptor that appends the .everest extension. What distinguishes Everest is that ransomware deployment is only one of three revenue streams. Since November 2021 the group has also sold compromised network access and harvested credentials to other threat actors, and since October 2023 it has advertised cash payments and profit sharing on dark web forums to employees willing to provide remote access to organisations in the United States, Canada and Europe. Initial access consequently spans internet-exposed RDP without multifactor authentication, vulnerable VPN endpoints, credentials purchased from other brokers or obtained through stuffing attacks, and access supplied directly by recruited insiders. The group targets healthcare, financial services, legal, construction, government, manufacturing, aviation and energy organisations, with more than a third of victims based in the United States.

Analysed samples are protected with ConfuserEx and employ anti-tamper protection, control flow obfuscation, encrypted strings resolved at runtime and dynamic API resolution, leaving only a handful of statically imported functions and limiting the value of import-based detection. The cryptographic implementation is deliberately misleading: the code declares RSA-4096 and AES-256 but silently downgrades both at runtime to RSA-1024 and AES-128 in CBC mode. The encryption seed is generated locally on the victim host rather than retrieved from command and control infrastructure, a trait that technically links Everest to the C# variant of BlackByte and means encryption proceeds regardless of network connectivity. That seed is stretched into an AES key and initialisation vector using PBKDF2, then wrapped with the attacker's pre-embedded RSA public key. Smaller files are fully encrypted while larger files are partially encrypted across several non-contiguous regions, sufficient to render databases, virtual disks and archives unusable while dramatically reducing encryption time. Notably, while the ransom note in the analysed sample claimed roughly a terabyte of stolen data, no exfiltration capability was identified in the binary itself, suggesting any data theft occurred earlier in the intrusion.

The pre-encryption phase is where Everest is most visible, and most detectable. The malware first checks system culture and locale identifiers against a hardcoded list of Commonwealth of Independent States values and exits silently on a match. It then launches three persistent background threads: one terminating debuggers, disassemblers and network analysis tools via the Windows Restart Manager, one disabling security, backup and database services on a rolling basis, and one killing any process exceeding 250 MB of private memory outside a small allowlist, an effective if crude means of disrupting sandboxes and forensic tooling. It contains a dedicated routine to remove Raccine, an open-source anti-ransomware tool, stripping its registry entries, autorun entry and scheduled task before recovery sabotage begins, demonstrating that operators specifically anticipated this control. The malware also modifies its own process security descriptor to insert an access-denied entry for the World SID, causing standard termination attempts to fail even when run as SYSTEM. Recovery sabotage follows, deleting backup files across multiple drive letters, removing shadow copies through WMI, resizing shadow storage to force the purge of any that survive, removing System Restore points and emptying the Recycle Bin. Environment preparation then disables Controlled Folder Access, re-enables the legacy SMB1 protocol, opens Network Discovery and File and Printer Sharing firewall rule groups, relaxes remote token filtering through registry changes, grants the Everyone group full control across fixed drives via icacls, and mounts previously unlettered volumes so hidden partitions fall within encryption scope. A particularly unusual feature is the use of Wake-on-LAN packets, broadcast to MAC addresses harvested from the local ARP cache, in an attempt to wake dormant systems before network enumeration begins.

From a defensive perspective, the noisy nature of Everest's pre-encryption sequence is its greatest weakness. Alerting on the disabling of Controlled Folder Access, the re-enablement of SMB1, changes to remote token filtering registry values, and the use of icacls to grant the Everyone group full control across a drive would each independently justify investigation, as would shadow copy deletion, bulk removal of backup file extensions and any attempt to strip Raccine artefacts. Unexplained Wake-on-LAN traffic and network scanner output in publicly writable directories are further useful indicators. Because initial access frequently relies on valid credentials rather than exploitation, enforcing multifactor authentication on all remote access, eliminating internet-exposed RDP, and monitoring for anomalous authentication remain the highest-value preventative controls. The group's insider recruitment programme also warrants consideration in internal risk assessments, where privileged access reviews and monitoring for unusual remote access provisioning address a vector no endpoint control can mitigate.

Microsoft Defender XDR KQL Query

Detects potential ransomware pre-encryption activity by identifying mass permission changes using ICACLS or CACLS. The query focuses on recursive access control modifications applied to root drives while filtering known legitimate administrative and installer activity.

DeviceProcessEvents
//To perform this activity, the actor was reported to use "icacls" however, use of "cacls" may also be relevant if the actor changes the tool.
| where FileName has_any ("icacls.exe", "cacls.exe")
or ProcessCommandLine has_any ("icacls", "cacls.exe")
// Look for mass permission changes targeting root drives or recursive flags
| where ProcessCommandLine has_any ("Everyone:F", "Everyone:(OI)(CI)F", "/grant")
// /T = recursive, /C = continue on error, /Q = Supress output
and ProcessCommandLine has_any ("/T", "/C", "/Q")
//Focus on root drives and wide folder paths to mirror threat actor behavior.
| where ProcessCommandLine has_any ("C:\\*", "D:\\*", "E:\\*", "C:", "D:", "E:")
//False Positives: Remove known legitimate installers such as Lenovo.
| where not(InitiatingProcessFileName has_any ("ics.exe", "u7siprex.exe", "u7si_mcx.exe", "tvsukernel.exe", "setupex.exe", "wccoanextgenarch.exe", "udcuseragent.exe", "udclientservice.exe", "udcinfinstaller.exe", "onedrivesetup.exe", "msiexec.exe", "smartstandbyinst.exe", "onedrivesetup", "simfox simulator.exe", "smartstandbyinst.exe", "lvfinstallservice.exe"))
| where not(ProcessCommandLine contains ("/grant Administrators:F"))
| where not(InitiatingProcessFileName contains "lenovo")
| where not(InitiatingProcessFileName contains "sccm")
| where not(InitiatingProcessFileName contains "nessus")
| where not(InitiatingProcessFileName contains "motorolaitmproxy")
| where not(AccountName contains ("svc"))
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName
| sort by Timestamp desc