Threat Actor Conducts Large-Scale Exploit Testing Before Ransomware Deployment
Article Content
Browse articles 
Between December 25–28, 2025, a threat actor executed a scanning campaign targeting internet-facing systems, testing over 240 different exploits. This operation, linked to CTG Server Limited, aimed to identify and collect data on vulnerable targets as a precursor to ransomware attacks.
Ask AI about this cluster
Answers cite the sources they use
Updated 217d ago How this analysis works
More articles in this cluster (3)
Following this threat?
Track MuddyWater in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that… 
Group-IB Launches Arabic Cyber Threat Intelligence Podcast Group-IB has launched Masked Actors: BelArabi, the first Arabic-language edition of its global podcast series. The podcast aims to make complex cyber threat intelligence accessible to Arabic-speaking audiences in the Middle East, Türkiye, and Africa. The inaugural episode discusses the motivations behind cyberattacks…