Threat Actor Conducts Large-Scale Exploit Testing Before Ransomware Deployment

First seen 9 Jan 2026, 20:34 UTC • Gbhackers

•37

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Between December 25–28, 2025, a threat actor executed a scanning campaign targeting internet-facing systems, testing over 240 different exploits. This operation, linked to CTG Server Limited, aimed to identify and collect data on vulnerable targets as a precursor to ransomware attacks.

How this analysis works

Attack Flow

Continue Reading

MuddyWater Targets U.S. Entities Amid Geopolitical Tensions MuddyWater's Operation Olalampo Targets MENA Region with New Malware Iranian APT MuddyWater Uses Chaos Ransomware as a False Flag for Espionage Iranian APT Groups Target Israeli Organizations with Modular C2 Frameworks Microsoft Word Vulnerability CVE-2026-21514 Exposes Millions to Malware Attacks China-Linked Hackers Deploy PlugX Malware in Qatar via Fake War News

Threat Actor Conducts Large-Scale Exploit Testing Before Ransomware Deployment

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading