Skip to content

Threat reports14 briefs · Fall/Winter 2026/2027 Edition

Z7 Cyber Intelligence

Cyber threat intelligence reports from Z7 Solutions™: ransomware analysis, APT tracking, and breach investigations for security professionals.

Threat Pulse20 third-party feeds, one view
  • 14briefs
  • 417numbered sources
  • 14PDFs
  1. 01What happened
  2. 02How it works, as a living map
  3. 03Who is at risk
  4. 04What changed since the last edition
  5. 05What to do now
  6. 06Numbered sources

Browse the intelligence briefs

Each brief covers what happened, how the attack works, who is at risk, what changed since the last edition and what to do now, with numbered sources and a PDF you can share. Filter by subject type or by status.

  • SeriesQilin2 parts

    RW-01Ransomware group active

    Part 1 of 2

    Qilin still tops most ransomware counts

    TakeawayPatch VPN gateways and require MFA first.

    • 165 Qilin incidents ZeroFox counted in August 2026
    • 17 months consecutive months as the most active group (ZeroFox)
    • Qilin
    • Ransomware group
    • Manufacturing
    PDF934 KB
    RW-02Ransomware group active

    Part 2 of 2

    Qilin still hits hospitals and infrastructure

    TakeawayPatch edge gateways, enforce MFA and vet IT provider access.

    • 2,367 victims listed on Qilin's leak site since October 2022
    • 1 patient death linked to the Synnovis outage
    • Qilin
    • Ransomware group
    • Healthcare and diagnostic suppliers
    PDF875 KB
  • RW-03Ransomware group active

    LockBit 5.0 returns after Operation Cronos

    TakeawayPatch edge devices and protect hypervisors now.

    • 163 victims posted by LockBit in Q1 2026 (Check Point)
    • 7,000+ attacks built with LockBit services (NCA)
    • LockBit
    • Ransomware group
    • Business services
    PDF849 KB
  • RW-04Ransomware group active

    Akira still exploits SonicWall VPNs in 2026

    TakeawayPatch, reset VPN credentials, require MFA and watch failed logins.

    • $244.17M ransomware proceeds Akira had claimed as of late September 2025
    • 750 Akira leak-site claims in 2025 (ransomware.live)
    • Akira
    • Ransomware group
    • Manufacturing
    PDF884 KB
  • RW-05Ransomware group dormant

    ALPHV BlackCat dormant, Change breach 192.7M

    TakeawayRequire MFA on remote access and vet your vendors.

    • 192.7M people in the Change Healthcare breach, final estimate
    • $395.3M ALPHV/BlackCat ransom payments reported to FinCEN
    • ALPHV BlackCat
    • Ransomware group
    • Healthcare and health insurance
    PDF849 KB
  • SE-01Social engineering crew disrupted

    Scattered Spider convicted, help desk playbook lives

    TakeawayHarden resets and MFA now.

    • $115M+ ransoms the DOJ alleges victims paid
    • 5.5 yrs sentence each for Jubair and Flowers, July 16, 2026
    • Scattered Spider
    • Social engineering crew
    • Retail
    PDF870 KB
  • RW-06Ransomware ecosystem active

    RaaS fragments as Qilin and The Gentlemen lead

    TakeawayHarden edge devices, identity and hypervisors now.

    • 93 active leak-site groups in Q2 2026
    • 2,139 leak-site victims in Q2 2026
    • Ransomware-as-a-service ecosystem
    • Ransomware ecosystem
    • Critical manufacturing
    PDF837 KB
  • RW-07Ransomware ecosystem ongoing risk

    Most dangerous cybercrime groups, re-ranked

    TakeawayPatch edge devices, require phishing-resistant MFA and test backups first.

    • 2,139 leak-site victims in Q2 2026, up 33 percent year over year
    • 93 active groups in Q2 2026, a record for a quarter
    • Most dangerous cybercrime groups
    • Ransomware ecosystem
    • Manufacturing
    PDF887 KB
  • IS-01Infostealer active

    Odyssey Stealer now leads macOS stealers

    TakeawayBlock Terminal paste lures, patch macOS and revoke sessions fast.

    • 62.7% of macOS stealer detections, first half of 2026
    • 100+ countries with infections, per Moonlock in July 2026
    • Odyssey Stealer
    • Infostealer
    • Technology and software development
    PDF901 KB
  • SeriesIntellexa2 parts

    SP-01Spyware vendor active

    Part 1 of 2

    Predator persists as Greece convicts four

    TakeawayPatch phones fast and use Lockdown Mode for high-risk staff.

    • 15 zero-days attributed to Intellexa since 2021
    • 4 convicted in Athens, sentences suspended pending appeal
    • Intellexa (Predator spyware)
    • Spyware vendor
    • Journalists and press freedom organizations
    PDF857 KB
    SP-02Spyware vendor ongoing risk

    Part 2 of 2

    Spyware vendors lead zero-days; Aladdin unconfirmed

    TakeawayPatch phones fast and harden browsers.

    • 15 of about 70 Google-documented zero-days attributed to Intellexa
    • 90 zero-days exploited in 2025, vendors ahead of state groups
    • Spyware vendor
    • Journalists and press freedom organizations
    PDF880 KB
  • SP-03Spyware vendor ongoing risk

    Spyware vendors outlast sanctions and verdicts

    TakeawayPatch fast; treat Apple alerts as incidents.

    • 90 zero-days exploited in the wild in 2025
    • 110 countries in Apple's August 2026 spyware alert wave
    • Commercial spyware industry
    • Spyware vendor
    • Government officials and legislators
    PDF844 KB
  • BA-01Breach analysis ongoing risk

    SitusAMC breach settlement and vendor risk

    TakeawayTier vendors by the data they hold.

    • 662,792 people on the settlement class list
    • $5.3M proposed class settlement fund
    • SitusAMC
    • Breach analysis
    • Banking and mortgage lending
    PDF774 KB
  • TR-01Technology risk ongoing risk

    Post-quantum deadlines set, attack estimates fall

    TakeawayInventory your cryptography, turn on hybrid key exchange, and put PQC into every purchase.

    • Dec 31, 2030 federal deadline for PQC key establishment
    • 70% of browser traffic to Cloudflare uses hybrid ML-KEM
    • Technology risk
    • Federal agencies and contractors
    PDF843 KB

Z7 Weekly Intelligence

One email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

  • In business since 2012
  • 24/7 SOC, NOC, and help desk
  • SBA 8(a), MWBE, and DBE certified
  • GSA MAS 47QTCA26D000F
  • Navy SeaPort NxG
  • CMMC Level 2 aligned
  • ISO 27001 aligned

Talk to Z7 about these threats

Ask Zeus what a report means for your environment, or book a call with the team that runs the Z7 SOC.

Ask Zeus AI assistant