SECTION 1 - EXECUTIVE SUMMARY

Five items, ranked by ecosystem-level strategic impact. Each carries at least one supporting metric and a confidence label.

1. On 13 July the United States, European Union and United Kingdom announced simultaneous sanctions described by Chainalysis as one of the largest cyber enforcement actions to date, with the EU designating 9 individuals and 4 entities, the UK 24 individuals and entities, and OFAC 3 targets. The headline designation is Vitaly Nikolayevich Kovalev, alias Stern, senior administrator of the Trickbot and Conti syndicate, whose wallets received more than $300 million in ransom payments as his personal cut alone, likely making him the single most prolific ransomware operator ever identified. This is the first time any sanctioning body has publicly tied the Stern moniker to Kovalev by name, and it brings the total Trickbot members sanctioned to 19. CONFIRMED.

2. The same package confirms a doctrinal shift from operator-targeting to enabler-targeting, executed across six layers in nineteen days: bulletproof hosting (EU designated Media Land LLC and owner Alexander Volosovik on 13 July, the DOJ unsealed his indictment on 14 July over $62 million in losses), malware-as-a-service (EU designated LummaC2 developers Voronin and Gordienko; the UK cited at least 2,100 UK Lumma victims in six months per the NCA), VPN concealment (OFAC designated 1VPNS), cryptor services (OFAC designated Silayev), residential proxy anonymization (NetNut/Popa, at least 2 million devices, disrupted 2 to 3 July), and phishing-as-a-service (Kratos, 1,800-plus subscribers and roughly 15,000 campaigns per month, taken down 20 July with an arrest). CONFIRMED.

3. The stablecoin chokepoint was demonstrated at scale on 14 to 15 July, when OFAC added four Central Bank of Iran crypto addresses that had received $165 million in stablecoins and Tether froze $131 million of the balances immediately, bringing total Tether freezes against OFAC-identified CBI addresses to nearly $475 million. This is the strongest evidence to date that issuer-level freezing converts a designation into immediate asset denial, unlike infrastructure seizure. CONFIRMED.

4. Coveware by Veeam data published 30 July shows the ransomware payment model bifurcating: the average payment rose 176 percent quarter over quarter to $1.88 million while the median fell to $150,000 and the overall payment rate reached a record low, with the exfiltration-only payment rate at 15 percent. The ecosystem is extracting far more from far fewer payers, and encryption-free extortion has demonstrated a monetization ceiling for the first time. CONFIRMED.

5. Sysdig documented JADEPUFFER on 1 July, the first known end-to-end agentic ransomware operation, in which a large language model autonomously exploited Langflow via CVE-2025-3248, harvested credentials, moved laterally, encrypted 1,342 Nacos configuration items and dropped production databases across more than 600 distinct payloads, correcting a failed login to a working fix in 31 seconds without human intervention. CONFIRMED.

SECTION 2 - RANSOMWARE ECOSYSTEM: MONTHLY STATISTICS

No finalized July 2026 monthly analytical report had been published as of 1 August. The figures below are drawn from two independent live trackers with different inclusion rules, and are labelled accordingly.

• Total victims disclosed (July 2026): approximately 809 leak-site posts, derived from RansomLook's daily series of 731 posts across 4 to 31 July (28 days at 26.1 posts per day) extrapolated across the three days not displayed on the retrieved view. ANALYST INFERENCE, medium confidence.
• Cross-check: ransomware.live recorded 5,419 victims year to date through 26 July against 4,780 through 1 July in the prior reporting cycle, implying 639 victims across 26 days, or roughly 762 for the full month at the same daily rate. The two trackers converge on a July range of roughly 760 to 810. CREDIBLE REPORTING.
• Active group count: 115 active groups in 2026 to date across 132 countries (ransomware.live, data current to 26 July), up from 106 groups and 130 countries at the prior cycle. In the seven days to 1 August, RansomLook counted 34 active groups, down 15.0 percent week over week. CONFIRMED per source.
• New groups identified in July: five. Booba Project (added 6 July, 9 victims), Doommageddon (6 July, 8 victims), Cry0 (6 July, 1 victim), CRPxO (9 July, 6 victims) and D1R (13 July, 3 victims). This brings 2026 new-group debuts to 44. CONFIRMED (ransomware.live).
• Defunct or dormant groups: no reliable July-specific attrition count available. Structural context from Black Kite's report published 24 July: 61 new groups entered the market between April 2025 and March 2026, more than one per week, while the active group count reached 146 by June 2026.
• Estimated ransom volume: no aggregate July figure available. The closest in-window financial measure is Coveware's Q2 2026 dataset published 30 July, showing an average payment of $1.88 million (up 176 percent quarter over quarter) against a median of $150,000. CONFIRMED per source.
• Month-over-month change in total victims: approximately plus 8 to plus 12 percent against the June baseline of roughly 722. ANALYST INFERENCE, low confidence, because the July estimate and the June baseline come from different trackers. The same-methodology signal is stronger: RansomLook's final week of July was up 40.4 percent on the prior week.

Sector Targeting Trend Table

No July-specific sector breakdown was published. The table uses the two most recent finalized comparative datasets: Comparitech's H1 2026 healthcare series (published 7 July, updated 9 July) against H2 2025, and Black Kite's ecosystem-wide sector ranking for April 2025 to March 2026.

The healthcare sub-sector movement is the most analytically useful figure in the set. Attacks on direct-care providers were nearly flat at plus 3.3 percent while attacks on healthcare businesses, meaning pharmaceutical and device manufacturers, billing providers and health-tech firms, rose 34.7 percent. Within that, retailers such as device retailers and drug wholesalers rose 67 percent. Actors are migrating away from the patient-facing organizations that attract law-enforcement and regulatory attention, and toward the supply chain behind them, which holds comparable data with a lower political cost.

Geographic Targeting Analysis

• United States: 49.3 percent of all observed victims in the Black Kite reporting period, remaining the single most targeted country. In healthcare specifically, the US absorbed 225 of 410 H1 2026 attacks, more than half the global total, though US healthcare provider attacks fell just over 7 percent half over half. CONFIRMED per sources.
• Europe: the four most affected European countries collectively recorded more than 250 additional victims over the reporting period, with several strengthening their global top-10 position. In healthcare, Germany rose 40 percent half over half. CREDIBLE REPORTING.
• Asia: parts of Asia recorded the largest percentage increases of any region. India's healthcare provider attacks rose 700 percent half over half, the single largest national movement in the dataset. Canada rose 83 percent and Australia 33 percent. CONFIRMED per source.
• Geographic breadth is expanding faster than volume: Q2 2026 saw victims in 108 countries against 97 in Q1 2026 and 84 one year earlier, a 29 percent widening of the target aperture in twelve months. CONFIRMED (GuidePoint).
• CIS-exclusion status: resolved this cycle after four cycles as a collection gap. The Cybercrime Directorate of the Russian MVD published weekly detention summaries covering at least 8 detentions between 16 and 23 July and at least 7 between 23 and 30 July, roughly 15 in a fortnight across multiple regions. On 29 July the MVD reported more than 24,000 registered cases of Telegram used for fraud and remote theft since the start of 2026. Separately, the leadership of bulletproof hosting provider Aeza Group, arrested in Russia in April 2025 on organised criminal community charges over hosting the BlackSprut darknet market, remained in pretrial detention as of July 2026. CONFIRMED per source, STATE-ALIGNED (RUSSIA) origin noted.
• The analytic finding is that the safe harbour is selective, not absent. Russia is not failing to police cybercrime. It polices it at a tempo of roughly seven to eight detentions per week and will hold a bulletproof hosting provider's leadership in pretrial detention for fifteen months and counting. What it does not police is ransomware against foreign victims. The variable is victim nationality and domestic political salience, not capability or will. Aeza was prosecuted for hosting a drug market serving Russians, not for hosting ransomware serving no Russians. ANALYST INFERENCE, high confidence, resting on three independent legs: MVD weekly tempo, the Aeza prosecution, and the continued absence of any Russian case against a ransomware operator with foreign victims.
• Structural note on the enabler layer: the 13 July OFAC action designated a Ukrainian administrator (Dmytro Rashevskyi, 1VPNS) and a Belarusian cryptor seller (Yevgeniy Vladimirovich Silayev). The enabler tier servicing Russian-language ransomware operations is not itself exclusively Russian, and that distinction carries direct jurisdictional consequences addressed in Section 11. CONFIRMED (US Treasury).

Leak Site Three-Signal Composite

Composite interpretation. The three signals are not moving together, and the divergence is the finding. Post volume is rising steeply into month-end while the active operator count is contracting 15 percent in the same window, which means fewer groups are publishing more victims each. Set against Coveware's record-low payment rate and 176 percent jump in average payment, the coherent reading is a volume-and-concentration strategy: publish more victims to sustain pressure across a population where fewer will pay, and price the ones who do far higher. The takedown-to-relaunch signal continues to diverge from the other two. Forum-layer disruption is imposing durable cost, with RAMP now past 184 days and an administrator publicly declining reconstitution, while the RaaS layer it once served is posting record volume. Enforcement is succeeding against the coordination layer and failing to slow the production layer. ANALYST INFERENCE, medium confidence.

SECTION 3 - THREAT ACTOR LANDSCAPE

Russia and CIS-linked groups prioritized. Where July-only victim counts are unavailable, the most recent finalized quarterly or monthly figure is used and dated explicitly.

Three new entrants appeared in the final week of July and immediately posted at scale: Global Secret Group (24 posts), Booba Team (16 posts) and Exfilsquad (14 posts). Combined, these three accounted for 54 of the week's 240 posts, or 22.5 percent, on their debut. CONFIRMED (RansomLook). This is the pattern Black Kite describes as new groups launching high-volume campaigns immediately on market entry rather than building gradually.

Legacy and Structurally Significant Actors Named in the 13 July Designations

These actors are not among July's highest-volume operators but were designated during the reporting period and carry structural significance for attribution, financial tracing and the CIS safe-harbour question.

Analytic significance. Two findings follow from this set. First, the Volosovik case establishes that layered designation is now operationally routine: an OFAC designation, an EU designation and a US indictment landed on the same individual and entity within eight months, and the EU and DOJ actions fell within 48 hours of each other. Second, the Martino sentencing is the only July action reaching inside the victim-response industry, and it documents a failure mode the ecosystem has not previously been shown to exploit at this level: the negotiator advising the victim was selling the victim's reserve price to the attacker. This bears directly on the payment-layer leverage described in Section 11. CONFIRMED.

Data Extortion Trend

• Current share of encryption-free extortion: no single July percentage is available. The strongest in-window figure is Coveware's Q2 2026 exfiltration-only payment rate of 15 percent, published 30 July, described as a historically low level. CONFIRMED per source.
• Named extortion-only actors active in July: ShinyHunters (Abbott, Medtronic), Kairos (US county government), and World Leaks carried forward from the prior cycle. CREDIBLE REPORTING.
• Month-over-month change: no reliable data. Longer-baseline context: Unit 42 recorded encryption use in extortion cases falling to 78 percent in 2025 from levels at or above 90 percent across 2021 to 2024, and Arctic Wolf recorded an elevenfold rise in data-only extortion between November 2024 and November 2025. CREDIBLE REPORTING.
• Counter-signal worth flagging: Black Kite's April 2025 to March 2026 dataset finds encryption remained the primary pressure method across the period, with Qilin and Akira pairing encryption and data theft rather than abandoning encryption. The encryption-free model is growing as a share of incidents but has not displaced encryption, and the 15 percent payment rate suggests why. CREDIBLE REPORTING.

Analytic judgement. The 15 percent exfiltration-only payment rate is the first hard quantitative evidence in this reporting series that encryption-free extortion carries a structural monetization penalty. Data theft alone gives the victim a recovery path that does not require the attacker, so the only leverage is reputational, and reputational leverage converts to payment less reliably than operational paralysis. If Q3 confirms the figure, expect volume-oriented groups to partially revert to encryption while the extortion-only model consolidates among actors targeting data-sensitive verticals with regulatory exposure. ANALYST INFERENCE, medium confidence.

SECTION 4 - INITIAL ACCESS AND TTP EVOLUTION

No net-new July initial-access ranking with published percentages was retrieved. The ranking below orders vectors by the volume of confirmed July incident reporting attached to each, and states the supporting metric for every position.

1. Paste-and-run social engineering (ClickFix class). Microsoft's Defender Experts team observed ACR Stealer activity climbing across customer environments from late April to mid-June and published two full delivery chains on 16 July, both opening with a user pasting a command into the Run dialog. Red Canary's April telemetry placed ClearFake, the web-inject cluster feeding ACR Stealer since at least March 2025, at number one on its most-prevalent-threat list for the first time, with ACR Stealer entering the top ten at a tie for sixth. Microsoft published no victim count, no affected-customer figure and no baseline for the increase it reported. CREDIBLE REPORTING with an explicit quantification gap.

2. Edge and management-plane exploitation. Six vulnerabilities were added to the CISA KEV catalog during July across ColdFusion, SharePoint, Check Point management servers, Langflow and two Joomla page builders. CVE-2026-16232, an unauthenticated authentication bypass against Check Point Security Management and Multi-Domain Security Management, was confirmed exploited with a handful of customers affected and notified; a federal remediation deadline of 25 July applied. This vector is distinguished by target selection: the compromised asset is the system that pushes policy to firewalls, not a firewall. CONFIRMED.

3. Valid accounts obtained through vishing and help-desk manipulation. ShinyHunters reached Abbott Laboratories through a June voice-phishing campaign against employees that yielded a corporate Microsoft Entra single sign-on account tied to the Cancer Diagnostics business. Microsoft's 13 July research maps a year of the same actor abusing trusted OAuth relationships and long-lived application tokens across Salesforce environments in retail, education and manufacturing, exploiting the trust relationship rather than the platform. CREDIBLE REPORTING.

4. Credentials purchased from initial access brokers. Chainalysis found that IAB on-chain inflow spikes precede increases in both global ransomware payments and US victim leak-site posts by roughly 30 days, making IAB purchasing a leading indicator rather than a coincident one. IABs received at least $14 million on-chain in 2025 against approximately $820 million in ransomware payments, a return ratio near 58 to 1. CONFIRMED per source.

5. Unauthenticated exploitation of AI orchestration infrastructure. Sysdig observed the first active exploitation of CVE-2026-55255 in Langflow on 25 June, and JADEPUFFER's initial access on the same platform used CVE-2025-3248. These hosts are attractive because they routinely hold LLM provider API keys and cloud credentials in their environment and are frequently stood up without network controls. CONFIRMED.

Significant TTP Developments

• Adaptive exploitation at machine speed. JADEPUFFER's agent diagnosed a failed login caused by a subprocess PATH issue, deleted the broken account, rebuilt the credential hash through a direct import and reinserted it, all in 31 seconds across a 15-line coordinated payload. Sysdig's assessment is that no human operator reads an error, identifies that root cause, drafts a corrective script and submits it in that window. CONFIRMED.
• Payload concealment in image pixels. The fileless ACR Stealer chain retrieves a JPEG from a public image host with the payload embedded in the pixels, carves it out, decrypts, decompresses and executes it reflectively in memory, then reads Chrome and Edge Login Data and Web Data databases and invokes DPAPI to decrypt passwords, cookies and tokens. CONFIRMED.
• EtherHiding. In a subset of ACR Stealer intrusions, a second Python loader queries public blockchain RPC endpoints and Web3 node infrastructure to retrieve a payload or C2 address from a public ledger. There is no attacker-controlled resolver left to seize, which removes the standard takedown lever. CONFIRMED.
• Same-day exploitation of maximum-severity flaws. KEVIntel researchers reported exploitation of CVE-2026-48282 in Adobe ColdFusion beginning less than two hours after details became public, from 103.207.14[.]220. For Page Builder CK, a live web shell was flagged on a production Joomla site within hours of the 27 June fix. CONFIRMED.
• Microsoft's remediation guidance for ACR Stealer instructs victims to revoke tokens rather than only rotate passwords, reflecting that session tokens, not credentials, are the operationally valuable artifact. CONFIRMED.

IAB Market Indicators Table

No July-specific IAB market telemetry was retrieved. Figures are from Chainalysis and Darkweb IQ data current to Q1 2026 and are dated explicitly as the best available baseline.

The price collapse is the analytically significant movement. Darkweb IQ attributes the fall from $1,427 to $439 to industrialized access pipelines, AI-assisted tooling and infostealer-log proliferation producing an oversupply of cheap but operationally constrained inventory. The market is bifurcated rather than uniformly cheap: validated domain-level access still commands premium pricing. For enforcement, the implication is that price pressure at the low end is not a sign of ecosystem stress, it is a sign of successful automation upstream in the stealer layer.

SECTION 5 - MALWARE AND STEALER ECOSYSTEM

Families ranked by the volume and specificity of July reporting attached to each.

ACR Stealer (Amatera)

• Market position: entered Red Canary's top-ten most-prevalent threat list at a tie for sixth on April telemetry. Microsoft observed activity climbing across customer environments from late April to mid-June. No victim count, affected-customer figure or increase baseline was published. CREDIBLE REPORTING with explicit gap.
• Pricing and model: malware-as-a-service, priced from $199 per month to $1,499 per year following the ACR to Amatera rebrand. CREDIBLE REPORTING (Proofpoint, cited secondarily).
• Distribution in July: two documented chains, both opening with ClickFix paste-and-run. One mounts a WebDAV share and executes a DLL via rundll32 with the console suppressed through conhost headless; the other runs almost entirely in memory via mshta, an embedded VBScript loader and PowerShell. CONFIRMED.
• Collection targets: saved browser passwords, live session tokens, PDFs from Desktop and Downloads, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders. Persistence via a hidden scheduled task posing as a software update, with timestomping from notepad.exe and PowerShell history clearing. CONFIRMED.
• Disruption status: none. Neither chain exploits a vulnerability, so patching does not remove the path. Microsoft shipped three Defender XDR hunting queries and 16 campaign domains. CONFIRMED.

StealC, Amadey and SocGholish

• Disruption status: infrastructure actioned in the Operation Endgame phase of 15 to 24 June, with 326 servers and 142 domains taken down, approximately 27 million stolen credentials recovered from over 385,000 compromised systems, and between EUR 41 million and $46 million in criminal cryptocurrency identified and frozen depending on the reporting figure used. CONFIRMED.
• Reconstitution at 30 to 45 days: no confirmed C2 re-emergence was identified in July collection. This is a negative finding from a limited collection set, not a positive assessment of durable denial. ANALYST INFERENCE, low confidence.

LummaC2

• Assessed to lead 2026 distribution alongside StealC and Vidar per AhnLab trend data current to February 2026. Fully reconstituted following its May 2025 takedown, which disrupted over 2,300 domains. No verified July infection-volume figure was obtained. CREDIBLE REPORTING.

NetNut / Popa (residential proxy)

• Scale: Google Threat Intelligence Group estimates at least 2 million compromised devices globally, including smart TVs and streaming boxes, powered by trojanized applications and botnets such as Badbox 2.0 that package proxy plugins. CONFIRMED.
• Criminal usage intensity: in one week in June, GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes, spanning both cybercriminal and espionage groups, for password-spray attacks, access to their own infrastructure, and reaching victim environments. CONFIRMED.
• Disruption status: disrupted 2 to 3 July. Google disabled the accounts and services used for command and control, flagged the SDK in Play Protect, and shared SDK and backend detail with platform providers and law enforcement. The FBI and IRS seized netnut.com, proxyjet.io and divinetworks.com. CONFIRMED.

Kratos / Sneaky2FA (phishing-as-a-service)

• Scale before takedown: more than 1,800 criminal subscribers running an estimated 15,000 phishing campaigns per month, each capable of reaching thousands of recipients, with victims across more than 30 countries running into the hundreds of thousands since late 2024. The group earned more than EUR 300,000 (approximately $342,000) since 2024. CONFIRMED.
• Capability: adversary-in-the-middle relay of live Microsoft 365 authentication sessions, capturing credentials and session tokens in transit, which defeats MFA rather than merely harvesting passwords. Browser-in-the-browser login windows were added in November 2025. CONFIRMED.
• Disruption status: taken fully offline 20 July in Operation Olympus Blade, with more than 200 servers shut down and the developer and technical administrator arrested in Indonesia. CONFIRMED.

Infostealer-to-IAB Pipeline

Chainalysis identifies infostealer-log proliferation as a primary driver of the collapse in average corporate access pricing from $1,427 in Q1 2023 to $439 in Q1 2026, alongside industrialized access pipelines and AI-assisted tooling. The pipeline's timing characteristic is now measurable at the market level rather than the individual-log level: spikes in IAB on-chain inflows precede increases in global ransomware payments almost immediately, and increases in US victim leak-site posts after roughly a ten-day lull, with the full effect visible at 30 days. This makes IAB payment volume the single most useful leading indicator available to defenders and enforcement planners. CONFIRMED per source. Median time from individual infection to dark-web listing: no reliable data, a persistent gap across reporting cycles.

SECTION 6 - FINANCIAL AND INFRASTRUCTURE SIGNALS

Sanctions and Enforcement Actions

The 13 July tri-lateral package is the defining action of the reporting period and is broken out by designating authority below.

Three observations. First, the 13 July package is the EU's largest-ever cyber sanctions round and, per High Representative Kaja Kallas, its biggest round of individual designations since the 2022 full-scale invasion. Second, it confirms a deliberate shift from designating operators to designating the enabler tier: VPN providers, malware-as-a-service developers, bulletproof hosting, and cryptor developers were all named in a single coordinated action. Third, the 1VPNS designation follows a repeatable and fast evidentiary model, building on on-chain payment traces from named ransomware operators to the enabler rather than on victim-impact attribution, which is substantially slower to assemble. CONFIRMED.

Financial Flow Observations

• Coveware by Veeam, Q2 2026, published 30 July: average ransom payment $1.88 million, up 176 percent quarter over quarter; median payment $150,000, down; overall payment rate at a record low; exfiltration-only payment rate at 15 percent. CONFIRMED per source.
• Chainalysis 2026 Crypto Crime Report baseline: $820 million in total on-chain ransomware payments in 2025, down 8 percent from $892 million in 2024, against a 50 percent rise in claimed attacks. The share of victims paying reached an all-time low of 28 percent. Median ransom payment rose 368 percent from $12,738 in 2024 to $59,556 in 2025. CONFIRMED per source, dated February 2026.
• INTERPOL Operation First Light 2026, results announced 9 July: $293 million in illicit assets intercepted, 31,014 bank accounts blocked, 152,808 cases analysed. A single 20-year-old suspect's digital wallet in Thailand had processed more than $122.5 million in ten months, laundering romance-scam proceeds through cross-chain token swaps. CONFIRMED.
• Operation Endgame, June phase, carried forward: between EUR 41 million and $46 million in criminal cryptocurrency identified and frozen. CONFIRMED.
• Kairos received approximately $1 million (9.44 BTC at the time) from a US government entity in a pure data-theft extortion with no encryption, reported 3 July. This is a rare confirmed single-payment figure from a public-sector victim. CREDIBLE REPORTING; neither the county nor the group has confirmed the identification.
• Stablecoin issuer freezing is now demonstrably the highest-yield financial lever available. Tether froze $131 million immediately upon the 14 to 15 July Central Bank of Iran designation update, and cumulative freezes against OFAC-identified CBI addresses approach $475 million. Chainalysis notes the upstream counterparties for the newly designated addresses were an institutional liquidity provider and an Asia-based payment processor, both of which are themselves actionable nodes. CONFIRMED.
• The Martino prosecution establishes a documented dollar figure for negotiator-side compromise: one victim paid approximately $1.2 million in Bitcoin, affiliates shared 20 percent of ransoms with BlackCat operators, and law enforcement seized $10 million in assets from Martino alone, including cryptocurrency, vehicles, a food truck and a luxury fishing boat. CONFIRMED (DOJ via Security Affairs).

Infrastructure Hosting Patterns

• Media Land LLC and ML.Cloud LLC, both headquartered in St. Petersburg, are named in the unsealed indictment as providing hosting and infrastructure support to criminal and state-backed actors. Treasury previously sanctioned both for allowing LockBit, BlackSuit and Play to use their infrastructure. CONFIRMED.
• JADEPUFFER infrastructure, from Sysdig's telemetry: command and control at 45.131.66[.]106 with a crontab beacon to port 4444 every 30 minutes, and a staging or exfiltration server at 64.20.53[.]230, attributed to InterServer, AS19318. The staging claim is the agent's own self-narrated assertion and was not independently verified as exfiltration. CONFIRMED as an indicator, ANALYST INFERENCE as to exfiltration.
• Structural finding worth carrying forward: Chainalysis assesses that the infrastructure layer has converged, with financially motivated cybercriminals and state-aligned actors using the same bulletproof hosting providers and residential proxy networks to evade detection. Dismantling or sanctioning an infrastructure node therefore generates cascading effects across ransomware affiliates, scammers and state-aligned operators simultaneously. CONFIRMED per source.
• Counter-pressure on that logic, from the same month: Mandiant told BleepingComputer that disrupting one proxy service often prompts operators to purchase replacement capacity from competing providers, turning those competitors into resellers, because the proxy industry is deeply interconnected with operators constantly buying and reselling each other's botnet capacity. CONFIRMED.

SECTION 7 - LAW ENFORCEMENT AND REGULATORY ACTIONS

New Actions This Month

Impact rationales. The Stokes extradition is scored Medium-High because it is a completed transfer into custody of a named individual, the outcome this series most often lacks, though it reaches an English-speaking Scattered Spider subject rather than a Russia-based operator. The tri-lateral package is scored High because it names the ecosystem's most financially significant identified operator for the first time and simultaneously covers four enabler categories across three jurisdictions, which closes the forum-shopping gaps that single-jurisdiction designations leave open. NetNut is scored High because the anonymization layer is cross-cutting: 316 distinct threat clusters were observed using it in a single week, spanning criminal and espionage actors. Olympus Blade is scored Medium-High as the only July action combining infrastructure removal with the arrest of a principal. The 1VPNS designation is scored Medium-High because it establishes a repeatable evidentiary model and reaches a Ukrainian subject in a cooperating jurisdiction. The Martino sentencing is scored Medium: it is a custodial result with $10 million recovered, but it addresses an insider failure mode rather than reducing adversary capacity. The Media Land indictment is scored Medium on its own because it carries no custodial or infrastructure-seizure component, though in combination with the EU designation of the same individual one day earlier its practical effect is greater. First Light is scored Medium for ransomware specifically because its focus was social engineering fraud and associated laundering, though its impact on the broader fraud ecosystem is High.

Reconstitution Status Tracker

Prior-cycle actions updated at 30, 90 and 180-day intervals. Status options: Fully Reconstituted, Partially Reconstituted, Not Reconstituted, Pending, No Data.

Cumulative Impact Assessment

Short-term disruption (1 to 30 days): High. Six enablement layers were removed, degraded or designated inside nineteen days: anonymization, phishing-as-a-service, VPN concealment, cryptor services, malware-as-a-service and bulletproof hosting. The measurable capacity removed is substantial and specific: at least 2 million proxy nodes serving 316 observed threat clusters, a PhaaS platform running roughly 15,000 campaigns per month for 1,800 subscribers, a VPN service with traced payments from three named ransomware operators, and $131 million in stablecoins frozen at the issuer within a day of designation. Thirty-seven designations landed across three jurisdictions on a single day, plus one custodial sentence and one arrest.

Custodial outcomes. July produced two, which is unusual for this series and revises the standing assessment that enforcement reaches infrastructure but not people. Peter Stokes was extradited from Finland into US custody on 1 July. Angelo Martino was sentenced to 70 months on 10 July with $10 million in assets recovered. A third, the Kratos developer, was arrested in Indonesia on 20 July. Set against that, every Russia-based principal named during the month remains beyond reach.

Structural ecosystem impact (90-plus days): Medium-High, revised upward from the prior cycle. Two factors raise the score. First, the tri-lateral coordination closes jurisdictional gaps that single-authority designations leave open, and naming Stern removes the pseudonymity that has protected the Trickbot syndicate's most senior figure for a decade. Second, the Iran Central Bank action proves that issuer-level stablecoin freezing converts designation into immediate asset denial at nine-figure scale, which no infrastructure seizure in this series has achieved. Three factors hold it below High. Reconstitution history remains unfavourable, with Lumma fully reconstituted and now assessed to lead 2026 distribution even as its developers are designated, which shows designation alone does not remove capability. Mandiant's on-record assessment that disrupting one proxy service converts competitors into resellers means the NetNut action displaces capacity rather than removing it. And every Russia-based principal named in July, Kovalev, Volosovik, Zatolokin, Pankova, Voronin, Gordienko and Bashev, remains beyond custodial reach. The actions with the highest probability of durable structural results are the two that reach cooperating or domestic jurisdictions: the 1VPNS designation of a Ukrainian administrator, and the Martino sentencing. ANALYST INFERENCE, medium confidence.

SECTION 8 - VULNERABILITY EXPLOITATION MATRIX

CVEs with confirmed exploitation during the reporting period, cross-referenced against the CISA KEV catalog. All cisa.gov fetches returned empty bodies during collection (see Section 13); KEV facts are corroborated through Security Affairs, The Hacker News and Help Net Security.

Lag analysis. The reporting period contains both extremes of the KEV-to-exploitation interval. CVE-2025-3248 was KEV-listed in May 2025 and used as the entry point for the first documented agentic ransomware operation disclosed on 1 July 2026, a gap of roughly fourteen months. CVE-2026-48282 inverts it entirely, with exploitation beginning under two hours after public disclosure. Sysdig's assessment explains why both are now dangerous simultaneously: agentic tooling makes spraying the entire historical vulnerability catalogue effectively free, so the long tail of unpatched systems becomes more exposed over time rather than less. The operational implication is that KEV age is no longer a useful triage input for exposed internet-facing assets.

SECTION 9 - SUPPLY CHAIN AND THIRD-PARTY COMPROMISE

ShinyHunters OAuth and Identity Abuse (SaaS supply chain)

• Attacker: ShinyHunters, tracked as UNC6240, active since 2020, having moved from consumer telecom and retail data theft into the Salesforce ecosystem and enterprise identity infrastructure. CREDIBLE REPORTING.
• Compromised components: trusted OAuth relationships and long-lived application tokens rather than the SaaS platforms themselves. Microsoft's Defender Security Research team published research on 13 July mapping a year of this activity across Salesforce environments in retail, education and manufacturing. CREDIBLE REPORTING; the Microsoft primary post was not retrieved during collection.
• July incident: Abbott Laboratories was added to the group's leak site in mid-July after a June voice-phishing campaign against employees compromised a corporate Microsoft Entra single sign-on account tied to the Cancer Diagnostics business. The group set an 18 July leak deadline before extending negotiations to 21 July. CREDIBLE REPORTING.
• Downstream impact estimate: no reliable data on the number of affected environments. The technical fingerprint shared across the Abbott intrusion and the mapped Salesforce campaigns indicates a single reusable access pattern rather than isolated incidents.
• Related carryover: Google Threat Intelligence Group and Mandiant attributed a zero-day campaign against Oracle PeopleSoft to the same group and its affiliates in June 2026; Oracle subsequently released an out-of-band fix. CREDIBLE REPORTING.
• Detection and remediation status: Abbott investigating as of month-end; no public confirmation of scope. CREDIBLE REPORTING.

JADEPUFFER (AI orchestration platform as supply-chain entry)

• Attacker: an agentic threat actor, meaning an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit. CONFIRMED (Sysdig Threat Research Team).
• Compromised components: an internet-facing Langflow instance reached through CVE-2025-3248, then the Langflow backing Postgres database, then a MinIO object store using default credentials minioadmin:minioadmin, from which the agent listed all buckets including a terraform-state bucket and fetched credentials.json and .env from an internal configuration bucket. The true target was a separate internet-exposed production server running MySQL and an Alibaba Nacos configuration service. CONFIRMED.
• Downstream impact: 1,342 Nacos service configuration items encrypted with MySQL AES_ENCRYPT, the config_info and his_config_info tables dropped, an extortion table created, and multiple production database schemas dropped after the agent disabled foreign key checks. The AES key was generated from two UUIDs, printed to stdout and never persisted or transmitted, so the victim cannot recover the configurations even on payment. CONFIRMED.
• Detection and remediation status: documented and published 1 July with full indicators. Recommendations centre on patching Langflow, removing provider API keys and cloud credentials from AI-orchestration server environments, hardening Nacos default token signing keys, and applying egress controls. CONFIRMED.

Trend Assessment

Supply chain attacks as a percentage of total incidents: no reliable July figure is available, and none was published in the retrieved reporting. What is verifiable is a structural characterisation rather than a percentage. Black Kite's April 2025 to March 2026 dataset finds that third-party services including SaaS platforms, ERP systems, CRM applications, OAuth tokens, remote access tools and connected business software have become common attack paths, and that organizations with strong internal controls remain exposed through them. The July evidence supports a specific refinement of that finding: the two documented supply-chain vectors this month, OAuth token abuse and AI orchestration compromise, both bypass the vulnerability model entirely. Neither the ShinyHunters Abbott intrusion nor the Langflow credential harvest depended on exploiting the trusted platform. They depended on the trust relationship itself, and on credentials stored in an adjacent service. Patching does not close either path. CREDIBLE REPORTING with an explicit quantification gap.

SECTION 10 - ECOSYSTEM CONTROL NODE ANALYSIS

Top Control Nodes Table

Cascade Failure Analysis

Node 2, infostealer-to-IAB credential pipeline. What breaks downstream: the credential supply that sets affiliate operating cost. The measurable effect of this node functioning well is that corporate access now averages $439 against $1,427 three years ago, a 69 percent reduction in the entry cost of a ransomware operation. Remove it and affiliate unit economics invert immediately, because the 58-to-1 return ratio between ransomware payments and IAB spend collapses when access has to be earned rather than bought. Realistic reconstitution timeline: weeks. Lumma reconstituted within weeks of a takedown that removed 2,300 domains and now leads 2026 distribution. Enforcement mechanism that could realistically work: none in single-strike form. The only demonstrated approach is repeated coordinated action on the Operation Endgame model, treating each strike as one increment of sustained cost rather than a terminal event. Chainalysis's finding that IAB inflow spikes lead payment spikes by 30 days also means this node offers the ecosystem's best early-warning telemetry, which is an intelligence value independent of any disruption value.

Node 3, residential proxy and anonymization layer. What breaks downstream: attribution resistance for every actor category simultaneously. In a single week, 316 distinct threat clusters spanning criminal and espionage operations routed through one provider. Remove it and password-spray campaigns, victim-environment access and operator infrastructure management all lose their residential-IP cover at once. Realistic reconstitution timeline: 30 to 60 days, and by substitution rather than rebuild. Mandiant states directly that disrupting one proxy service prompts operators to buy replacement capacity from competitors, converting those competitors into resellers, because the industry is built on mutual capacity trading. Enforcement mechanism that could realistically work: simultaneous rather than sequential action against the reseller and whitelabel tier. Taking the largest provider offline while its whitelabel partners remain operational transfers customers instead of denying capacity.

Nodes 4 and 5 treated jointly, the RaaS affiliate labour market. What breaks downstream: nothing durable, and that is the finding. The number one position changed hands in June because a former Qilin affiliate offered a 90/10 split after a payout dispute, not because of superior tooling. Halcyon assesses roughly half the names on any given month's top-15 list were absent the month before. Removing either platform displaces its affiliates into the competing platform within weeks, which is precisely what the June transition demonstrated in reverse. Realistic reconstitution timeline: weeks, and it is not reconstitution, it is migration. Enforcement mechanism that could realistically work: nothing targeting the platforms. The mechanism that would work targets affiliate expected value directly, meaning the payment layer, which is Node 1 and the subject of Section 11.

Structural Vulnerability Summary

The single most critical structural weakness in the current ecosystem is the payment layer, and July produced the first direct proof of it. Every other node reconstitutes by substitution: proxies by reseller transfer within 30 to 60 days, stealers within weeks, RaaS platforms by affiliate migration in the same cycle they are disrupted, bulletproof hosting by re-registration under Russian jurisdiction. LummaC2 makes the point sharply, remaining operational and assessed as a 2026 distribution leader on the same day its named developers were designated by the EU. The payment layer does not substitute, because it is the only node that must interface with the regulated financial system to convert extortion into value, and on 14 to 15 July Tether froze $131 million within a day of an OFAC designation, taking cumulative freezes against those addresses to nearly $475 million. No infrastructure seizure in this reporting series has produced comparable denial on comparable timescales. Coveware's Q2 data shows the layer is already under strain from the other direction: the payment rate is at a record low, exfiltration-only extortion converts at 15 percent, and the ecosystem's revenue now flows through a shrinking population of transactions averaging $1.88 million. That concentration is a vulnerability, not a strength, because a small number of large traceable payments is a far more tractable enforcement surface than a large number of small ones. The Martino case exposes the adjacent weakness: the professional layer advising victims through those transactions is domestic, licensed and reachable, and it has now been shown to be corruptible. The ecosystem is most brittle where extorted value converts to spendable funds, and least brittle at the infrastructure and platform layers where the majority of July's operational effort was directed.

SECTION 11 - STRATEGIC LEVERAGE ASSESSMENT

Financial Pressure

Infrastructure Pressure

Jurisdictional Pressure

Coming Month Focus (Top 3)

1. Apply the designate-then-freeze sequence proven against the Central Bank of Iran to ransomware-attributed wallet clusters, starting with the Stern clusters published in the 13 July EU designation. Expected outcome: nine-figure asset denial on a 24-hour timeline, replicating the $131 million Tether freeze, against a target set where the wallet attribution is already complete and public. This is the highest expected-value action available because it requires no new investigation and no foreign cooperation.

2. Pursue Rashevskyi through a Ukrainian criminal referral and seek seizure of 1VPNS subscriber records. Expected outcome: the first custodial result against a named ransomware enabler in this reporting series, and a subscriber list identifying the ransomware operations that purchased concealment, converting a single designation into a multi-target evidentiary base.

3. Pre-position the simultaneous NetNut reseller and whitelabel takedown inside the 30-to-60-day substitution window. Expected outcome: denial of replacement proxy capacity rather than transfer of it, producing the first measurable net reduction in available anonymization supply rather than a redistribution among providers.

SECTION 12 - UNCONFIRMED SIGNALS AND HORIZON INDICATORS

[UNCONFIRMED REPORTING] AsyncAPI npm organization compromise, 14 July 2026. Five package versions across four package names were reportedly republished within roughly ninety minutes, each carrying the same injected loader, with an actor identifying as TeamPCP claiming credit. The Microsoft Threat Intelligence primary post was not retrieved during collection and no downstream install count is available.

Confirm via: retrieval of the Microsoft Security Blog post and an npm advisory carrying affected-version download counts.

[UNCONFIRMED REPORTING] A malicious jscrambler npm package, version 8.14.0, reportedly reached the registry on 11 July carrying a preinstall hook that dropped a Rust infostealer on Windows, macOS and Linux, targeting cloud credentials and CI tokens.

Confirm via: an npm security advisory or a vendor writeup with affected-version download figures.

[UNCONFIRMED REPORTING] Q2 2026 initial-access telemetry placing phishing at 65 percent of intrusions. The figure surfaced in collection but the primary quarterly dataset was not retrievable, so it is excluded from the Section 4 ranking.

Confirm via: a retrievable ReliaQuest or LevelBlue Q2 2026 dataset with methodology.

[RESOLVED, RE-DATED] The Spanish arrest of an individual linked to CARR, Z-Pentest and NoName057(16) is substantively confirmed but is a July disclosure of a March 2026 action, not a July arrest. The investigation opened in August 2025 on an FBI tip; the arrest took place in Palencia in March 2026; reporting appeared 7 July 2026. The suspect allegedly provided logistical and operational support to a Ukrainian hacker operating for CARR and attempted to facilitate that hacker's escape to Russia via Poland and Belarus. Charges include membership of and collaboration with a terrorist organisation. The case sits under Operation Riptide. Significance is higher than first assessed: the EU designated both CARR and Z-Pentest on 13 July, pairing designation with custody against the same network inside one quarter.

Status: CREDIBLE REPORTING. Corroborated across five named outlets at search level; primary not yet fetched. Verification pending next cycle.

[UNCONFIRMED REPORTING] Medtronic reportedly notified 3.8 million individuals following a ShinyHunters breach. Headline-level verification only. If accurate, this materially raises the assessed downstream impact of the ShinyHunters identity-abuse campaign described in Section 9.

Confirm via: an HHS OCR breach portal entry with the affected-individual count.

[ANALYST INFERENCE] The final-week volume surge (240 posts, up 40.4 percent) may reflect three new entrants front-loading their leak sites to attract affiliates rather than a genuine rise in compromises. Global Secret Group, Booba Team and Exfilsquad accounted for 54 of the 240 posts, or 22.5 percent, on their debut week.

Refute via: August post volume from the same three groups. A debut spike that decays within one month is an affiliate-recruitment signal; one that sustains indicates real capacity.

[ANALYST INFERENCE] The 15 percent exfiltration-only payment rate indicates the encryption-free extortion model has reached a monetization ceiling. If confirmed, expect partial reversion to encryption among volume-oriented groups while extortion-only consolidates among actors targeting verticals with heavy regulatory exposure.

Confirm or refute via: the Coveware Q3 2026 exfiltration-only payment rate and Unit 42's updated encryption-use percentage. A Q3 figure below 15 percent confirms; above 20 percent refutes.

[ANALYST INFERENCE] Early warning for August: expect a second documented agentic ransomware operation, and expect StealC or Amadey command-and-control re-emergence at the 60-to-90-day mark from the June Operation Endgame action, which falls between mid-August and late September.

Confirm via: new C2 telemetry attributed to those families on fresh infrastructure, and vendor disclosure of a second LLM-driven end-to-end intrusion chain. Sysdig has already published a JADEPUFFER follow-on describing ransomware built to destroy AI models, which suggests the case count is already moving.

[ANALYST INFERENCE] Qilin's 44.7 percent week-over-week decline at month-end may mark a durable position change rather than cadence variance. The group held the top position for five consecutive quarters and lost it in June on affiliate economics, and the RAMP forum that once arbitrated its affiliate disputes no longer exists.

Confirm via: August and September monthly counts. Two further consecutive months below The Gentlemen confirms a structural shift; recovery within one month indicates variance.

SECTION 13 - ANALYTIC CAVEATS AND COLLECTION GAPS

Sources Blocked or Dropped During Verification

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog - fetch succeeded at the transport level but returned an empty body with no content. Dropped from the citation pool. All KEV facts in Section 8 are corroborated through Security Affairs, The Hacker News and Help Net Security.
• https://www.europol.europa.eu/media-press/newsroom - returned only the JavaScript application shell with the message that JavaScript must be enabled. No article content rendered. Dropped from the citation pool. Operation Endgame figures are corroborated through secondary reporting carried forward from the prior cycle.

Data Unavailable or Unreliable This Cycle

• No finalized July 2026 monthly analytical report was published as of 1 August. The July total is an estimate derived from two live trackers.
• RansomLook's retrieved daily series covers 4 to 31 July only; 1 to 3 July were not displayed. The full-month estimate extrapolates those three days at the observed daily mean.
• The ransomware.live dataset was last updated 26 July, so its year-to-date figure understates the month by approximately five days.
• July-specific sector and geographic victim breakdowns were unavailable. Section 2 substitutes Black Kite's April 2025 to March 2026 dataset and Comparitech's H1 2026 healthcare series, both dated explicitly in the tables.
• Time-to-publish, meaning the interval from compromise to leak-site publication, remains unresolved for a fourth consecutive cycle. The only in-window proxy is the four-day gap between Coca-Cola's 16 July 8-K filing and Anubis listing Fairlife on 20 July, which measures disclosure-to-publication rather than compromise-to-publication.
• No CIS-exclusion enforcement event was identified in July. The June Nova and Eriell case remains the most recent confirmed instance. Absence of an observed event is not evidence the norm has lapsed.
• IAB market metrics derive from Chainalysis and Darkweb IQ figures current to Q1 2026, not July telemetry.
• Microsoft published no victim count, affected-customer figure or increase baseline for the ACR Stealer surge, a gap noted explicitly in the secondary reporting.
• No supply-chain-as-percentage-of-incidents figure was published for the period. Section 9 states this rather than estimating.

Known Inflation and Deflation Biases in Victim Count Data

• Leak-site counts are simultaneously an overcount and an undercount. They include unverified claims, and they exclude victims who paid quietly. Comparitech's H1 2026 healthcare series illustrates the scale of the problem directly: 333 of 410 attacks were unconfirmed by the victim organization.
• Arete told Chainalysis that some groups repost old victims or victims taken from other groups' leak sites, which skews posting rates upward independent of any change in operational tempo.
• Cross-tracker comparison bias applies to the headline month-over-month figure. The July estimate comes from RansomLook and the June baseline from BreachSense via the prior cycle, and the two use different inclusion rules. The same-methodology weekly figure of plus 40.4 percent is the more defensible number.
• Vendor quarterly datasets from Coveware, GuidePoint, Black Kite and Halcyon each reflect their own client and telemetry populations. Coveware's payment figures in particular describe cases where a negotiation firm was engaged, which skews toward larger and better-resourced victims.
• Disclosure lag distorts monthly attribution. Comparitech notes that group claims often arrive a month or more after the attack, so a July-claimed attack may be a May or June compromise.

Competing Explanations for Major Observed Trends

• July volume rise: genuine growth in compromises, versus three new entrants front-loading leak sites for affiliate recruitment, versus a publication-cadence shift within existing groups. Unresolved pending August data.
• Qilin's 44.7 percent weekly decline: affiliate migration to The Gentlemen, which is Halcyon's reading and is supported by the documented 90/10 split differential, versus ordinary posting-cadence variance measured across a single seven-day window. A one-week sample cannot distinguish these.
• Record-low payment rates: improved defensive posture, backups and regulation suppressing payment, which is the Chainalysis reading, versus attackers succeeding in extracting far more per remaining payer, which Coveware's 176 percent average-payment jump equally supports. Both mechanisms are probably operating and they are not mutually exclusive.
• Lengthening takedown-to-relaunch cycles: durable enforcement cost imposed on the forum layer, versus voluntary operator dormancy to evade attention. The RAMP administrator's public statement declining to rebuild is weak evidence for the first reading, but it is a statement by an interested party.
• Healthcare business attacks rising 35 percent while provider attacks rose 3 percent: deliberate migration toward lower-political-cost targets holding comparable data, versus a reporting artifact in which business-sector victims are simply more likely to appear on leak sites because they are less likely to be covered by mandatory breach disclosure regimes.

Sections Omitted

No sections were omitted. All thirteen standing sections met the minimum data threshold, with explicit no-reliable-data notation applied wherever July-specific figures were unavailable rather than substituting hedged language.

Publication note: this is the published edition of the July 2026 cycle. It carries the full analytic content, figures, confidence labels and source list, together with a supplementary pass dated 2 August 2026 covering the Stokes extradition, the full 13 July designee roster including the Rybar tranche, and the Aeza pretrial-detention datapoint.

SOURCES

Every URL below was retrieved by direct fetch during verification. URLs that failed retrieval are listed in Section 13 and appear nowhere in the report body.

Ransomware Tracking Platforms

RansomLook - open ransomware intelligence, live post and group statistics - https://www.ransomlook.io

Ransomware.live - 2026 statistics, active groups and new-group registry - https://www.ransomware.live/stats/2026

Comparitech - Healthcare Ransomware Roundup, H1 2026 - https://www.comparitech.com/news/healthcare-ransomware-roundup-h1-2026-stats-on-attacks-ransoms-and-data-breaches/

Government and Law Enforcement

US Treasury - Treasury Sanctions Malware and Infrastructure Providers Supporting Ransomware Attacks Against Americans, 13 July 2026 - https://home.treasury.gov/news/press-releases/sb0559

OFAC - Recent Actions index - https://ofac.treasury.gov/recent-actions

TechCrunch - US charges Russian bulletproof web hosts over cyberattacks that netted $62M, 15 July 2026 - https://techcrunch.com/2026/07/15/us-charges-russian-bulletproof-web-hosts-over-cyberattacks-that-netted-62m-from-cybercrime-victims/

Security Affairs - INTERPOL Operation First Light nets 5,811 arrests and seizes $293 million, 9 July 2026 - https://securityaffairs.com/195056/security/interpol-operation-first-light-nets-5811-arrests-and-seizes-293-million.html

Security Affairs - Former ransomware negotiator sentenced to 70 months for secretly helping the BlackCat gang, 10 July 2026 - https://securityaffairs.com/195081/cyber-crime/former-ransomware-negotiator-sentenced-to-70-months-in-prison-for-secretly-helping-blackcat-gang.html

Vendor Threat Intelligence

Sysdig - JADEPUFFER: Agentic ransomware for automated database extortion, 1 July 2026 - https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion

Trend Micro - Law Enforcement Takes Down Kratos/Sneaky2FA Phishing Service, 22 July 2026 - https://www.trendmicro.com/en_us/research/26/g/kratos-takedown.html

Halcyon - Why The Gentlemen Beat Qilin: A Lesson in Ransomware Affiliate Economics, 14 July 2026 - https://www.halcyon.ai/blog/why-the-gentlemen-beat-qilin-a-lesson-in-ransomware-affiliate-economics

GuidePoint Security - Ransomware Insights from Q2 2026 (GRIT Q2 2026 Report), 9 July 2026 - https://www.guidepointsecurity.com/blog/ransomware-insights-q2-2026/

Cybersecurity News

The Hacker News - SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation, 2 July 2026 - https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html

The Hacker News - ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files, 17 July 2026 - https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html

Security Affairs - CISA adds Adobe ColdFusion, Joomlack Page Builder, Langflow and JoomShaper SP Page Builder flaws to KEV, 8 July 2026 - https://securityaffairs.com/194927/hacking/u-s-cisa-adds-adobe-coldfusion-joomlack-page-builder-langflow-and-joomshaper-sp-page-builder-flaws-to-its-known-exploited-vulnerabilities-catalog.html

Help Net Security - Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232), 23 July 2026 - https://www.helpnetsecurity.com/2026/07/23/check-point-vulnerability-cve-2026-16232/

Help Net Security - Ransomware in 2026: More groups, more victims, no slowdown (Black Kite 2026 Ransomware Report), 24 July 2026 - https://www.helpnetsecurity.com/2026/07/24/ransomware-attack-trends-2026-report/

BleepingComputer - NetNut proxy network disrupted, 2 million infected devices cut off, 3 July 2026 - https://www.bleepingcomputer.com/news/security/netnut-proxy-network-disrupted-2-million-infected-devices-cut-off/

SWK Technologies - Cybersecurity News Recap July 2026 - https://www.swktech.com/swk-cybersecurity-news-recap-july-2026/

Financial Intelligence

Coveware by Veeam - Ransomware Payment Trends Q2 2026, 30 July 2026 - https://www.veeam.com/blog/cyber-extortion-payment-trends-q2-2026.html

Chainalysis - Crypto Ransomware: 2026 Crypto Crime Report - https://www.chainalysis.com/blog/crypto-ransomware-2026/

Chainalysis - Stern, likely most prolific ransomware operator ever, sanctioned by EU, 14 July 2026 - https://www.chainalysis.com/blog/cyber-sanctions-trickbot-administrator-july-2026/

Chainalysis - OFAC sanctions Iran Central Bank crypto wallets, freezing $131 million in stablecoins, 15 July 2026 - https://www.chainalysis.com/blog/ofac-sanctions-iran-central-bank-crypto-wallets-freezing-131m-in-stablecoins/

Help Net Security - EU and UK blacklist Russia's cyber operators over efforts to destabilize Europe, 13 July 2026 - https://www.helpnetsecurity.com/2026/07/13/eu-uk-russia-cyber-activity-sanctions/

Infrastructure Intelligence

BleepingComputer - NetNut disruption, Google GTIG, FBI, Lumen and Shadowserver coordination detail - https://www.bleepingcomputer.com/news/security/netnut-proxy-network-disrupted-2-million-infected-devices-cut-off/

Chainalysis - infrastructure convergence between criminal and state-linked actors; bulletproof hosting and residential proxy analysis - https://www.chainalysis.com/blog/crypto-ransomware-2026/

END OF REPORT