Threat Actors Attacking Systems with 240+ Exploits Before Ransomware Deployment

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actor Conducts Large-Scale Exploit Testing Before Ransomware Deployment Between December 25–28, 2025, a threat actor executed a scanning campaign targeting internet-facing systems, testing over 240 different exploits. This operation, linked to CTG Server Limited, aimed to identify and collect data on vulnerable targets as a precursor to ransomware attacks. 3 sources 37