SECTION 1 - EXECUTIVE SUMMARY

Five items, priority ranked by ecosystem-level strategic impact. All items confirmed. Each includes a supporting metric.

SECTION 2 - RANSOMWARE ECOSYSTEM: MAY 2026 STATISTICS

2.1 Monthly Volume & Active Groups

• Total victims, April 2026 (confirmed): 772 - Source: Breachsense April 2026 Report
• Total victims, May 2026 (tracking estimate as of late May): approximately 700, representing a 9.4% month-over-month decline - Source: Ransomware.live. Final count will update at month close.
• YTD 2026 total (through late May): approximately 3,894 across 97 active groups and 119 countries - Source: Ransomware.live
• Q1 2026 total (Jan-Mar confirmed): 2,122 victims - Source: Check Point Research State of Ransomware Q1 2026 (May 11, 2026). This is 12.2% below the Q4 2025 all-time record of 2,416 but the second-highest Q1 on record.
• 2026 on-pace annual projection: approximately 8,800 victims based on YTD run rate - a ~20% increase over 2025's confirmed 7,307.
• Active groups in 2026: 97 - Source: Ransomware.live
• New groups debuted in May 2026 (through late May): 8 - Fulcrumsec (23 victims), Leakbazaar (9), Blackwater (6), Cmdorganization (4), Prinzeugen (1), Icarus (1), Shadowbyt3$ (reactivated), Titan. Combined May victim count: 61.
• Estimated ransom volume - FY 2025 total on-chain ransomware payments: $820 million (8% YoY decline from $892 million in 2024). Median payment: $59,556 (up 368% from $12,738 in 2024), indicating a shift to fewer but larger payments. No May 2026 monthly aggregate available - No reliable data available for this specific metric. Source: Chainalysis 2026 Crypto Crime Report.

2.2 Sector Targeting Trend (April 2026 vs. March 2026)

Source: Breachsense April 2026 Report. April actuals; March provided for comparison.

2.3 Geographic Targeting Analysis

Source: Breachsense April 2026 Report.

• CIS-exclusion assessment: The CIS-exclusion norm has fractured among newer entrants. Qilin, The Gentlemen, and DragonForce show no consistent CIS-exclusion policy. No Russia/CIS victims attributed to these groups appeared in April or May tracking data, but this is assessed as opportunistic rather than policy-driven. LockBit 5.0 resumed operations without publishing a CIS-exclusion policy. Assessed CIS-exclusion weakening among non-legacy groups - ANALYST INFERENCE, medium confidence.
• SORM and deliberate non-enforcement - CONFIRMED CAPABILITY: Russia's SORM (System of Operative Investigative Measures) architecture requires all Russian ISPs and telecoms to install FSB-controlled intercept hardware ('black boxes') providing the FSB unmediated, real-time access to all communications traffic on Russian IP infrastructure - without ISP visibility into what is being collected. This is established technical and legal fact, documented in Russian federal law and confirmed by multiple Western intelligence assessments. Its analytical implication for this report: the FSB's technical visibility into Russian-IP ransomware operator behavior is categorical, not probabilistic. Russian authorities can observe operator communications, financial flows, and infrastructure in real time. 'Deliberate non-enforcement' of ransomware groups operating on Russian infrastructure is therefore not a capability gap - it is a confirmed policy choice made by an actor with full technical visibility. This upgrades the evidentiary basis of the non-enforcement inference from 'medium confidence' to 'high confidence' on the capability component, while the policy intent component remains ANALYST INFERENCE, high confidence.
• Thailand's entry into the April top-10 (tied 9th, 16 victims) is the clearest geographic expansion signal this cycle - Southeast Asia is emerging as a secondary growth market for ransomware targeting, consistent with The Gentlemen's confirmed Thailand presence in verified reporting.
• The U.S. share drop from 50% to 39.4% in April reflects geographic spread (79 countries hit in April vs. 75 in March), not reduced U.S. targeting. U.S. absolute victim count declined from 385 to 304 in April, consistent with overall volume decline.

2.4 Leak Site Three-Signal Composite

Composite interpretation: Post volume is trending down ~9.4% MoM, consistent with - though not exclusively attributable to - the Operation Saffron / Stark Industries infrastructure disruptions and the RAMP forum void. The RAMP 120+ day non-reconstitution is the single most anomalous structural signal this cycle; typical gap is 60-90 days. Time-to-publish data remains a collection gap. The volume decline combined with an unknown time-to-publish trajectory means we cannot confirm whether groups are publishing fewer victims or simply slower - analytically significant for ransom leverage assessment.

SECTION 3 - THREAT ACTOR LANDSCAPE

Russia/CIS-linked groups prioritized. Victim counts are April 2026 actuals from Breachsense April 2026 Report except where noted. Q1 counts from Check Point Research.

3.2 The Gentlemen - Operational Intelligence Deep-Dive (May 4, 2026)

Source: Check Point Research 'Thus Spoke...The Gentlemen' (May 13, 2026) - verified source. The May 4 internal backend breach of The Gentlemen's Rocket database is the most significant actor-specific intelligence event of the reporting period.

• Admin Identity: zeta88 / hastalamuerte - manages RaaS platform, builds the locker, runs payouts, AND directly conducts infections. TOX ID: F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E. Admin built the GLOCKER panel in 3 days using AI-assisted coding; prefers DeepSeek, Qwen, and Kimi models.
• Affiliate Structure: 8 distinct affiliate TOX IDs identified across 29 confirmed campaigns. Most active affiliate (TOX 98C132E2...) ran 11 of 29 campaigns. 90/10 split model (90% to affiliate). ~9 named operators in leaked communications.
• Cash-out chain (CONFIRMED): BTC → exchange chains via ~800 'buy desk' transactions → Tinkoff bank QR code cash-out (minimum 400,000 rubles / ~$4,400 per transaction) → OTC physical cash delivery. Non-custodial wallets (Guarda, Trust Wallet, Exodus) used to avoid KYC/AML at centralized exchanges.
• Confirmed payment: $190,000 received (initial ask $250,000) in one documented negotiation. Admin drafts tailored follow-up letters citing GDPR exposure, regulatory risk, and reputational damage to maximize payment pressure.
• CVEs actively tracked: CVE-2024-55591 (FortiOS), CVE-2025-32433 (Erlang SSH/Cisco - PoC shared in TOOLS channel and actively evaluated), CVE-2025-33073 (NTLM relay - integrated into RelayKing for systematic scanning). All three beyond typical threat intel tracking - the group evaluates PoC reliability before operational deployment.
• Novel dual-leverage tactic: Data stolen from a UK software consultancy was reused to attack a Turkish company. The UK firm was then publicly attributed as the 'access broker' on the DLS, pressuring the Turkish victim to pursue legal action against the UK victim - a cascading extortion chain multiplying pressure without additional intrusion cost.
• Infrastructure breach origin: Likely 4VPS hosting provider compromise. Admin immediately acknowledged the leak on underground forums May 4 and announced infrastructure overhaul: new NAS, restructured communications, updated locker (hardware breakpoint removal, NTDLL unhooking, ETW patching).
• Full breach dataset size: A screenshot shared on an underground forum shows a total leak size of approximately 16.22 GB - confirmed in the Check Point Research report (May 13, 2026). Check Point Research obtained and analyzed a partial 44.4 MB subset. The full 16.22 GB dataset likely contains complete victim records, negotiation logs, payment wallet history, and affiliate communications beyond what was analyzed in the partial leak. If this full dataset is in law enforcement or researcher hands, it would represent a near-complete operational record of the group since its mid-2025 founding.

3.3 Data Extortion Trend (Encryption-Free)

• Encryption-free extortion share: Kaspersky State of Ransomware 2026 (May 11) characterizes pure data extortion as the 'default playbook' as of 2026 but does not publish a specific percentage. A figure of approximately 35% for Q1 2026 appears in vendor reporting (Morphisec, Cybersecurity Insiders) but is not confirmed in a primary verified source - treat as CREDIBLE REPORTING, low-to-medium confidence. The more robustly sourced indicators are directional: ransom payment rates have collapsed from 76% (2019) to 28% (2026, Kaspersky); 69% of victims refused payment in 2025 (Verizon 2026 DBIR). These figures confirm the encryption leverage thesis is failing, which structurally drives the extortion-only shift regardless of the precise percentage. Competing explanation in Section 13.4: pre-encryption extortion pressure may be misclassified as encryption-free in some vendor datasets.
• Named groups confirmed operating extortion-only: WorldLeaks (Hunters International), ShinyHunters, Cl0p (Oracle zero-day campaign - see Section 8). DentaQuest listed by ShinyHunters in May using pure exfiltration model.
• Structural driver: Encryption-free is faster, harder to detect (no mass file modification signature), avoids decryptor operational complexity, and remains fully effective for payment pressure via regulatory and reputational threat. Backups provide zero protection against the extortion component, which now applies to an estimated one-third or more of attacks.

SECTION 4 - INITIAL ACCESS & TTP EVOLUTION

4.1 Access Vector Ranking (May 2026)

Ranked most to least common. Sources: Rapid7 H2 2025 IAB Report, S-RM 2026 Cyber Incident Insights, Check Point Research Gentlemen leak analysis.

• 1. RDP (Remote Desktop Protocol) - 21.2% of IAB listings (Rapid7 H2 2025). Direct exposure hardening is pushing attackers toward RDWeb portals (11.2% of listings, up from near-zero in prior periods).
• 2. VPN Exploitation - 12.8% of IAB listings but 68% of actual remote-access exploit cases handled by S-RM in 2026, with nearly 70% linked to Akira campaigns. FortiGate and Cisco SD-WAN are confirmed primary targets (CVE-2024-55591, CVE-2026-20182 - see Section 8).
• 3. RDWeb (Remote Desktop Web Access) - 11.2% of IAB listings; growing as direct RDP exposure declines.
• 4. Phishing / Infostealer-derived credential abuse - IBM X-Force: 84% YoY increase in infostealers delivered via phishing (2024 data). The Gentlemen's OWA/M365 credential log ('ЛБ logs') channel demonstrates direct stealer-to-RaaS pipeline with no IAB intermediary, compressing attack chain further.
• 5. Vulnerability exploitation of public-facing applications - CISA KEV additions accelerating (12 vulnerabilities added in a single April 2026 week). CVE-2026-20182 exploited by 10+ clusters; Oracle CVE-2025-61882 (CVSS 10.0) sold as zero-day on RAMP by Cl0p actor.
• 6. Supply chain / CI/CD compromise - Mini Shai-Hulud (May 10-11) and DAEMON Tools compromise (April-May) demonstrate software supply chain as a scaled access vector. See Section 9.

4.2 Significant TTP Developments This Cycle

• BYOVD EDR Killing: Qilin and Akira both confirmed using Bring Your Own Vulnerable Driver attacks to disable EDR before encryption. The Gentlemen's TOOLS channel systematically distributes EDR killer kits (EDRStartupHinder, gfreeze, glinker). 54 EDR killers exploiting 35 signed vulnerable drivers documented across the broader 2026 ecosystem.
• AI-Assisted Development: The Gentlemen admin built the GLOCKER RaaS panel in 3 days using AI coding assistance. Prefers DeepSeek, Qwen, and Kimi over Western LLMs. Operators discussing self-hosted uncensored LLMs for automated triage of exfiltrated victim data - not yet implemented but actively planned. First documented case of Chinese LLMs being operationally preferred in RaaS development.
• Dual-Leverage Extortion Chains: Documented in The Gentlemen case: stolen data from Victim A reused in attack on Victim B, then Victim A publicly attributed as the 'access broker' to pressure Victim B into legal action against Victim A - cascading extortion at zero additional intrusion cost.
• CI/CD OIDC Token Extraction: Mini Shai-Hulud demonstrated pull_request_target misconfiguration enables extraction of OIDC tokens from CI runner memory, producing malicious packages with valid SLSA provenance - bypassing software supply chain integrity controls deployed post-SolarWinds.

4.3 IAB Market Indicators

Note: H2 2025 $113,275 average is heavily skewed by DarkForums' premium listings; Rapid7 expanded sampling to include DarkForums and RAMP for the first time in H2 2025. Forum-normalized price comparison would show a more moderate increase. This report accepts the Rapid7 methodology while flagging the confound.

SECTION 5 - MALWARE & STEALER ECOSYSTEM

Sources: AhnLab ASEC Feb 2026, Flare 2026 State of Enterprise Infostealer Exposure (May 25, 2026), Recorded Future, TrendMicro, SOCRadar.

5.2 Infostealer-to-IAB Pipeline Assessment

• Pipeline scale: 18.7 million infostealer logs collected between January and May 2026 in one sample study (Flare 2026). 54% of ransomware victims had domain credentials appear in stealer log marketplaces before the attack was detected at the victim organization - Source: Flare 2026.
• Timing data: Chainalysis 2026 identifies IAB on-chain inflow spikes typically preceding ransomware payment spikes by approximately 30 days. This 30-day lead-time window is the primary detection opportunity for enterprise defenders - organizations monitoring their credential exposure in stealer markets have a documented window to rotate credentials before ransomware deployment.
• Log pricing: Fresh logs (under 48 hours old) command 3-5x the commodity price due to live session token value. Average commodity log price $10/bot; corporate domain-admin credentials command significantly higher ($100-$3,000+).
• Infrastructure pivot risk: Lumma's migration from Cloudflare to Selectel (Russian-hosted) places the C2 layer in a jurisdiction with documented lower responsiveness to Western LE requests, materially reducing takedown probability for the next disruption attempt. This is the most actionable infrastructure signal in the stealer ecosystem this cycle.

SECTION 6 - FINANCIAL & INFRASTRUCTURE SIGNALS

6.1 Sanctions & Enforcement Actions

6.2 Ransomware Financial Flow Observations

• FY 2025 aggregate: Total on-chain ransomware payments $820 million (down 8% YoY from $892 million in 2024). Median payment $59,556 - up 368% from $12,738 in 2024 - indicating a structural shift to fewer but larger payments. Source: Chainalysis 2026 Crypto Crime Report.
• Payment refusal: 69% of victims refused payment in 2025 (Verizon 2026 DBIR), up from 65% in 2024. Payment rates have collapsed from 76% (2019) to 28% (2026) - Kaspersky State of Ransomware 2026.
• Stablecoin dominance: 95% of illicit inflows to sanctioned entities/jurisdictions in 2025 transited stablecoins. Russia-linked sanctioned flows: $93 billion total in 2025; A7A5 token cluster alone: $72 billion. Source: TRM Labs 2026 Crypto Crime Report.
• IAB on-chain payments: At least $14 million tracked in 2025 - approximately 1.7% of total ransomware ecosystem on-chain flows. Source: Chainalysis.
• The Gentlemen specific cash-out (CONFIRMED, Check Point Research): ~800 transactions through 'buy desks' → Tinkoff bank QR code conversion to rubles (400,000 RUB / ~$4,400 minimum per transaction) → OTC physical cash delivery. Non-custodial wallets (Guarda, Trust Wallet, Exodus) used to avoid exchange-level KYC.

6.3 Infrastructure Hosting Patterns

• Stark Industries / WorkTitans BV: Operation assumed control of EU-sanctioned Stark Industries Solutions ASN after May 2025 sanctions failed to dislodge infrastructure by migrating to a Dutch-registered shell (WorkTitans BV / THE.Hosting brand). The FIOD sanctions-law prosecution (hosting provision as direct EU sanctions violation, not cybercrime) is a novel prosecutorial theory that if sustained creates precedent for EU liability against any ISP knowingly servicing sanctioned entities.
• Lumma C2 migration from Cloudflare to Selectel: Selectel is a commercially registered Russian hosting provider. This moves C2 infrastructure to a jurisdiction with documented lower Western LE cooperation responsiveness, increasing persistence vs. prior Cloudflare hosting. Actionable: see Section 11 leverage item F-2.
• First VPN exit node locations confirmed in LE action: U.S. nodes at 2.223.66.103, 5.181.234.59, 92.38.148.58; additional nodes across Australia, Belgium, France, Germany, Netherlands, Russia, Switzerland, Turkey, Ukraine, and 16 other countries.

SECTION 7 - LAW ENFORCEMENT & REGULATORY ACTIONS

7.1 May 2026 Actions

7.2 Reconstitution Status Tracker (180-Day Window)

Standing tracker updated monthly. Status as of May 31, 2026.

7.3 Cumulative Impact Assessment - May 2026

Short-term disruption (1-30 days): HIGH

Operation Saffron removed the anonymization layer for 25+ active groups simultaneously. Stark Industries dismantled the shared BPH platform used for Russian-nexus attack staging. The Gentlemen internal breach exposed operator identities creating an organic disruption event. The 9.4% MoM victim count decline in May is consistent with - though not exclusively attributable to - these events; seasonal variation and DLS publishing lag cannot be excluded.

Structural ecosystem impact (90+ days): MEDIUM

Historical reconstitution data is limiting: Lumma Stealer reconstituted within weeks post-May 2025 takedown; LockBit reconstituted as LockBit 5.0 within 8 months of Operation Cronos. Neither the Saffron nor the Stark seizure directly targeted RaaS platform operators - only enabling infrastructure. BPH customers will migrate within 1-7 days (historical pattern). The RAMP non-reconstitution at 120+ days is the one anomalous resilience-cost indicator; its cause (LE deterrence vs. private channel migration) will determine the structural significance of the January 2026 seizure.

SECTION 8 - VULNERABILITY EXPLOITATION MATRIX

Includes CVEs with confirmed or credible exploitation in ransomware/malware campaigns during the May 2026 reporting period. Sources: CISA KEV catalog (verified), THN (verified), Rapid7 blog, CERT-UA.

KEV lag analysis: CVE-2026-20182 was actively exploited by 10+ clusters from March 2026 but KEV-listed May 14-15 - a ~70-day gap. CVE-2025-61882 (Oracle EBS, CVSS 10.0) is being sold as a zero-day exploit on RAMP with Cl0p attribution and is not yet in KEV - the most significant current KEV gap for organizations dependent on Oracle EBS in finance, HR, and supply chain. The SimpleHelp CVEs (assigned 2024) took 4-16 months to achieve KEV status despite active MSP-targeting exploitation. Organizations relying solely on KEV for patch prioritization are exposed in these pre-KEV windows.

SECTION 9 - SUPPLY CHAIN & THIRD-PARTY COMPROMISE

Trend assessment: Verizon 2026 DBIR confirms nearly 30% of all data breaches now involve a third-party supplier - double the rate from 2024 (15%). Four confirmed supply chain incidents in a single reporting period is a notable clustering. The Mini Shai-Hulud campaign is technically the most significant: it demonstrates that OIDC-authenticated CI/CD pipelines can produce malicious packages with valid SLSA provenance, fundamentally undermining software supply chain integrity controls that organizations deployed as post-SolarWinds mitigations. The DAEMON Tools compromise is the most enterprise-relevant for traditional environments: a legitimately signed installer from the official vendor website bypasses all reputation-based defenses. TeamPCP's confirmed link to the CipherForce ransomware group means the CI/CD attack vector may soon feed ransomware deployments directly - ANALYST INFERENCE, medium confidence. CONFIRMATION SIGNAL: CipherForce DLS listing of a victim whose forensics identify initial access via CI/CD pipeline compromise.

SECTION 10 - ECOSYSTEM CONTROL NODE ANALYSIS

10.1 Top Control Nodes

A 'control node' is any entity whose disruption causes measurable cascading effects on other ecosystem participants.

10.2 Cascade Failure Analysis

Node: The Gentlemen RaaS (Rank 2) - HIGHEST IMMEDIATE LEVERAGE

• What breaks downstream: 9 identified operators lose coordination; 8 affiliate TOX IDs lose platform access; ~332 YTD victim pipeline disrupts; dual-leverage extortion tactic documented by CPR is disrupted. Secondary: affiliate talent migrates to Qilin or DragonForce, accelerating those groups.
• Realistic reconstitution timeline: 60-120 days based on historical RaaS averages, but faster if admin retains builder source code. Admin's AI-assisted development capability (panel built in 3 days) means rebuild is faster than traditional groups.
• Enforcement mechanism: Admin zeta88/hastalamuerte partially deanonymized via leaked TOX ID and shadow file. International warrant issuance against identified operators is feasible within weeks. THRESHOLD MET - act within 30-60 day window.

Node: Stablecoin Cashout Infrastructure (Rank 4) - HIGHEST STRUCTURAL LEVERAGE

• What breaks downstream: Guaranteed USDT access is the structural dependency for the entire ransomware payment ecosystem. Restricting USDT to sanctioned wallet addresses or mandating on-chain compliance checks by Tether would impair payment collection across all active RaaS groups simultaneously. Forces groups back to Bitcoin (more traceable) or extends victim negotiation windows due to cashout friction.
• Realistic reconstitution timeline: 90+ days for structural impact; no realistic reconstitution path if stablecoin issuers enforce wallet-level screening.
• Enforcement mechanism: OFAC designation of A7A5 token under CAATSA; Treasury regulatory guidance requiring Tether to implement SDN list wallet screening under penalty of USD correspondent banking access loss.

Node: Qilin RaaS (Rank 1) - HIGHEST VOLUME LEVERAGE

• What breaks downstream: 21% of global ransomware volume disrupted; 26 healthcare victims per year lose primary adversary; BreachForums partnership reaching 300,000+ users loses RaaS technical infrastructure. Displaced affiliates migrate to DragonForce/The Gentlemen within 30-60 days.
• Realistic reconstitution timeline: 30-60 day victim count impact; full affiliate migration within 60-90 days. LockBit model suggests multi-quarter disruption if operator identity is confirmed and arrests follow.
• Enforcement mechanism: No confirmed operator identity in public domain. Requires HUMINT penetration of affiliate network or infrastructure-level disruption via ISP coordination.

10.3 Structural Vulnerability Summary

The single most critical structural weakness in the current ecosystem is the dependence of the entire payment collection chain on stablecoin infrastructure - primarily USDT via the A7A5 token cluster. With 95% of illicit ransomware-related flows using stablecoins ($72B A7A5 alone per TRM Labs 2026), Tether Limited represents an unprecedented concentration of financial chokepoint leverage for law enforcement. The ecosystem is most brittle here because: (1) ransomware groups cannot collect payment without it; (2) Tether operates in a Western-accessible jurisdiction; and (3) existing BSA/AML regulatory frameworks already apply - they are simply not enforced at the wallet-screening level required. Simultaneously, The Gentlemen admin identity disclosure creates a rare narrow-window opportunity to decapitate a top-3 operator with confirmed identity intelligence. These two leverage mechanisms are independent and should be pursued in parallel: one is an immediate 30-day tactical action; the other is a 12-18 month regulatory campaign.

SECTION 11 - STRATEGIC LEVERAGE ASSESSMENT

11.1 Financial Pressure Points

LEVERAGE F-1: The Gentlemen Cryptocurrency Cash-Out Infrastructure

LEVERAGE F-2: Selectel OFAC Designation (Lumma C2 Host)

LEVERAGE F-3: USDT/Tether Stablecoin Wallet Screening Mandate

11.2 Infrastructure Pressure Points

LEVERAGE I-1: The Gentlemen Admin Identity (zeta88 / hastalamuerte)

LEVERAGE I-2: Post-Stark Industries BPH Migration Window

LEVERAGE I-3: Operation Saffron Intelligence Package Follow-On (90-Day Window)

11.3 Jurisdictional Pressure Points

LEVERAGE J-1: Russian Deliberate Non-Enforcement - State-Facilitation Argument with SORM Evidentiary Basis

11.4 Coming Month Focus - Top 3 Priority Actions (June 2026)

1. [CRITICAL] Act on The Gentlemen admin identity disclosure - 30-day window.

Expected outcome: Arrest or flight-forcing of zeta88/hastalamuerte; disruption of the ~332-victim YTD pipeline; intelligence windfall from full 16.22 GB Rocket DB; potential dismantlement of 8 confirmed affiliate operations.

2. [CRITICAL] OFAC: initiate A7A5 token and Tether wallet-screening regulatory action.

Expected outcome: $72B+ annual illicit flow disruption if sustained; forces Russian ransomware operators into less liquid cryptocurrency alternatives, extending cashout timelines from days to weeks and creating new traceability opportunities.

3. [HIGH] Cross-reference Stark Industries server logs against First VPN 506-user list before June 10.

Expected outcome: Identification of Russian-nexus actors using both services simultaneously; 10-50+ actionable investigative leads; potential identification of previously unknown ransomware group infrastructure.

SECTION 12 - UNCONFIRMED SIGNALS & HORIZON INDICATORS

• [UNCONFIRMED REPORTING] Cl0p Mass Exploitation Campaign via CVE-2025-61882 (Oracle EBS, CVSS 10.0): CVE-2025-61882 is being sold on RAMP forum by a Cl0p-attributed actor (Rapid7 blog). Cl0p's historical mass-exploitation pattern (MOVEit, GoAnywhere, Citrix Bleed) involves zero-day purchase followed by simultaneous mass-exploitation of thousands of vulnerable systems. CONFIRMATION SIGNAL: Mass Oracle EBS victim notifications or Cl0p DLS listings; Oracle emergency security advisory. REFUTATION SIGNAL: Oracle patch released and CVE added to KEV before observed Cl0p DLS listings.
• [ANALYST INFERENCE - HIGH CONFIDENCE] First VPN Successor Service Launch: Based on historical reconstitution patterns (Lumma: weeks; Hydra: 12 months; similar VPN services: 60-90 days), a First VPN successor anonymization service is likely to emerge by August 2026. CONFIRMATION SIGNAL: Dark web advertising of a new VPN service with similar pricing and capability profile; forum discussions on XSS/RAMP about replacement services. REFUTATION SIGNAL: No successor advertising by September 1, 2026, suggesting permanent migration to private channels.
• [ANALYST INFERENCE - MEDIUM CONFIDENCE] RAMP Non-Reconstitution Significance: The 120+ day absence of a primary Russian-language RaaS coordination forum is anomalous. Competing explanations: (1) LE infiltration deterring reconstitution attempts; (2) permanent migration to private invite-only channels invisible to open-source collection. The latter is more operationally concerning as it reduces LE and researcher visibility into ecosystem coordination. CONFIRMATION SIGNAL: New Russian-language ransomware forum with verifiable RaaS operator posts on XSS or Exploit by June 2026. REFUTATION SIGNAL: Continued absence through July 2026, supporting private migration hypothesis.
• [UNCONFIRMED REPORTING] Qilin Healthcare Targeting Escalation: Qilin's 26 confirmed healthcare victims in 2026 YTD represents 17% of all healthcare DLS listings (LinkedIn healthcare advisory, May 2026). If pace continues through Q2, Qilin becomes the #1 ransomware threat to healthcare globally. CONFIRMATION SIGNAL: Healthcare victim count exceeding 35 in a single month; DLS listing of a Tier 1 hospital network (500+ beds). REFUTATION SIGNAL: Significant LE action against Qilin infrastructure or shift in affiliate targeting instructions.
• [ANALYST INFERENCE - MEDIUM CONFIDENCE] TeamPCP/CipherForce CI/CD-to-Ransomware Pipeline: TeamPCP (Mini Shai-Hulud attacker) is also linked to CipherForce ransomware group (TechCrunch/SafeDep, May 2026). No confirmed ransomware deployment using CI/CD attack vector confirmed as of report date. CONFIRMATION SIGNAL: CipherForce DLS listing of a victim whose forensics identify initial access via CI/CD pipeline compromise. REFUTATION SIGNAL: CipherForce DLS remains empty through June 30, 2026.
• [UNCONFIRMED REPORTING] Russia April 2026 VPN Crackdown - Banking System Disruption: Reporting indicates that Russia's April 2026 enforcement action against VPN services - executed via TSPU (Technical Means for Countering Threats) deep packet inspection infrastructure deployed by Roskomnadzor - caused collateral disruption to banking system connectivity, with VPN-dependent payment processing and interbank communications experiencing outages. If confirmed, this event is analytically significant not for its cybercrime ecosystem impact but for what it demonstrates about Russian state behavior: Russia accepted verifiable macroeconomic self-harm from infrastructure control enforcement while simultaneously operating a permissive environment for ransomware operators whose FSB visibility under SORM is equally complete. This is the sharpest available evidence that ransomware non-enforcement is a deliberate policy trade-off, not a governance failure. CONFIRMATION SIGNAL: Russian financial sector reporting of payment processing outages correlated with Roskomnadzor VPN enforcement dates; TSPU blocking logs referencing VPN service IPs active in April 2026. REFUTATION SIGNAL: No corroborated reporting of banking connectivity disruption linked to the VPN enforcement action from multiple independent Russian financial media sources.
• [CREDIBLE REPORTING] FIFA World Cup 2026 Credential Harvesting Risk: CTM360 documented 11,000+ fake government portals in a GovTrap campaign targeting FIFA 2026 attendees (May 2026); specific targeting attribution (sectors, sponsors, harvesting methods) was not available in verified sources this cycle and is insufficient for a full indicator entry. Note only: World Cup-affiliated organizations should treat June-July 2026 as an elevated phishing risk window.

SECTION 13 - ANALYTIC CAVEATS & COLLECTION GAPS

13.1 Sources Blocked or Inaccessible During Collection

The following sources were unavailable or returned no substantive content during collection and are excluded from the citation pool. Information attributed to these sources in this report was corroborated via other verified sources or credited as search-result-only attribution:

• bleepingcomputer.com - Specific Stark Industries URL returned empty response (JavaScript-rendered). Stark Industries coverage sourced from corroborating search snippets.
• halcyon.ai - The Gentlemen threat assessment URL returned empty response. Halcyon data corroborated via Check Point Research verified source.
• securityweek.com - Stark Industries arrest URL returned empty response.
• ransomware.live homepage - JavaScript-rendered; /stats/2026 subpage fetched separately and verified.
• ofac.treasury.gov/recent-actions - No cybercrime-specific designations found beyond Sinaloa Cartel action; Iran CBI designation sourced from Chainalysis blog search snippet.
• ic3.gov - No monthly report available; IC3 publishes annual Internet Crime Reports only.
• mandiant.com, secureworks.com, crowdstrike.com blogs - Not individually fetched; no specific May 2026 reports identified via search.

13.2 Data Unavailable or Unreliable This Cycle

• May 2026 final victim count: Month-close figure not yet confirmed. The ~700 estimate and 9.4% MoM decline are directionally reliable from Ransomware.live tracking but will update at month close.
• Per-group May-specific victim counts: April actuals (Breachsense) are the most current confirmed monthly figures. May counts are estimated from DLS tracking.
• Average ransom payment for May 2026: No monthly figure. Most current is Chainalysis FY 2025 ($820M total, $59,556 median).
• Time-to-publish (leak site signal): Per-incident compromise-to-publication lag not systematically tracked in open sources this cycle - a persistent collection gap.

13.3 Known Biases in Victim Count Data

• Inflation bias: Groups list victims even when no ransom is paid; some victims are re-listed after non-payment. Check Point Q1 2026 estimates 3-5% of DLS listings are re-listings.
• Deflation bias: Victims who pay and whose data is not published are systematically undercounted - estimated 15-30% of actual attack volume goes unreported on DLS (ANALYST INFERENCE, low confidence). True victimization rate is higher than DLS counts.
• Reporting lag bias: Recently compromised victims may take 30-90 days to appear on DLS. May 2026 counts will grow retroactively.
• Geolocation bias: U.S. over-representation in IAB listings (30.9% per Rapid7) is reinforced by English-language researcher focus. Non-English-speaking markets (Brazil, India, Southeast Asia) are systematically under-reported in Western threat intelligence sources.

13.4 Competing Explanations for Major Observed Trends

• May 2026 victim count decline (9.4% MoM): Could reflect Operation Saffron/Stark disruption OR seasonal variation OR DLS publishing lag. Without a multi-year May baseline, LE attribution is ANALYST INFERENCE, medium confidence.
• IAB base price jump (+4,055% Rapid7 H2 2025): May partially reflect Rapid7's expanded sampling to DarkForums and RAMP (first inclusion) rather than genuine price inflation. DarkForums premium listings significantly skew the average upward.
• Encryption-free extortion growth: Could reflect genuine strategic shift OR improved detection/reporting of exfiltration-only incidents previously undercounted OR pre-encryption extortion pressure being misclassified as encryption-free. Current data does not differentiate these models reliably.

SOURCES

Verified sources (fetched and confirmed): starred (*). All others contributed via search-result-level attribution per Section 13.1.

Ransomware Tracking Platforms

• * ransomware.live/stats/2026 - YTD 2026 statistics, new groups table [verified May 31, 2026]
• Breachsense April 2026 Ransomware Report - April victim counts, sector/geography breakdowns [search-result attribution]

Vendor Threat Intelligence

• * Check Point Research - The State of Ransomware Q1 2026 (May 11, 2026): research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/
• * Check Point Research - Thus Spoke...The Gentlemen (May 13, 2026): research.checkpoint.com/2026/thus-spoke-the-gentlemen/
• Rapid7 - H2 2025 Initial Access Broker Report (March 2026) [search-result attribution]
• S-RM - 2026 Cyber Incident Insights Report [search-result attribution]
• Flare - 2026 State of Enterprise Infostealer Identity Exposure (May 25, 2026) [search-result attribution]
• TrendMicro - LummaC2 resurgence analysis [search-result attribution]
• Kaspersky - State of Ransomware 2026 (May 11, 2026) [search-result attribution]

Government & Law Enforcement

• * The Hacker News - First VPN Dismantled (Operation Saffron), May 22, 2026: thehackernews.com/2026/05/first-vpn-dismantled-in-global-takedown.html
• * The Hacker News - CISA Adds CVE-2026-20182 to KEV, May 15, 2026: thehackernews.com/2026/05/cisa-adds-cisco-sd-wan-cve-2026-20182.html
• * The Hacker News - BKA Identifies REvil Leaders, April 6, 2026: thehackernews.com/2026/04/bka-identifies-revil-leaders-behind-130.html
• CISA KEV Catalog - April-May 2026 additions [search-result attribution]
• CERT-UA - CVE-2025-48700 Zimbra advisory [search-result attribution]

Cybersecurity News

• * TechCrunch - DOJ says ransomware gang tapped into Russian government databases (May 6, 2026): techcrunch.com/2026/05/06/doj-says-ransomware-gang-tapped-into-russian-government-databases/
• Verizon 2026 DBIR - Ransomware payment statistics [search-result attribution]
• TechCrunch / SafeDep / StepSecurity - Mini Shai-Hulud TanStack npm worm (May 19-20, 2026) [search-result attribution]
• techtimes.com, hackread.com - Stark Industries Netherlands FIOD seizure [search-result attribution; BleepingComputer URL failed fetch]

Financial Intelligence

• Chainalysis 2026 Crypto Crime Report (February 2026; FY 2025 data) - $820M total, $59,556 median, $14M IAB on-chain [search-result attribution]
• TRM Labs 2026 Crypto Crime Report - $93B sanctioned-entity flows, A7A5 $72B, 95% stablecoin [search-result attribution]