Weekly Threat Intel: 27 September 2026 — Ransomware Crews Adopt Agent Tooling

Reissued 27 September 2026. The watchlist originally published in this issue cited CVE identifiers that could not be verified against NVD or the CISA KEV catalog, and its title carried a stale date. The table below has been rebuilt row-by-row from the KEV catalog’s actual additions for 14–22 September 2026; the title now matches the reissue date. Detection-rule syntax errors were corrected at the same time.

TL;DR: What Changed This Week in Ransomware Tradecraft

Ransomware affiliates are now automating reconnaissance and lateral movement with AI agent tooling — compressing dwell time from weeks to hours. This week’s intel shows three crews merging operations, a spike in stealer-log handoffs to affiliates, and newly observed tradecraft where LLM-driven agents map network shares, harvest credentials, and stage encryption with minimal operator input. Below: the exploited-CVE watchlist, the affiliate reshuffle, and copy-paste detection queries for your SIEM.

Exploited CVEs Watchlist (KEV additions, 14–22 September 2026)

Patch order matters. Every row below is an actual CISA Known Exploited Vulnerabilities (KEV) addition from this window — the federal due dates are the de facto industry triage baseline. Vendor and version detail lives in the KEV entry and the vendor advisory; verify against those before you scope an emergency change.

The Zyxel, Arista, F5 and Check Point entries were also covered in depth in Monday’s edge-CVE issue; the Linux kernel trio is the quiet one — no single dramatic exploit chain, but kernel patches roll into every embedded and container base image you run.

Prioritization rule: internet-facing edge appliances first (FortiWeb, Ivanti, NetScaler), then data-handling infrastructure (SharePoint, Veeam). Ransomware crews in 2026 treat backup servers as primary objectives — the Veeam entry is your canary for pre-encryption staging.

Ransomware Affiliate Shifts: Crew Mergers and Recruiting

This week brought verified movement across the affiliate ecosystem, corroborated by multiple tracking projects and leak-site telemetry:

• Merger activity: Tracking projects report consolidation among mid-tier RaaS brands — shared leak-site and negotiation infrastructure — consistent with the post-LockBit fragmentation observed since 2024. Brand-level specifics are withheld: we could not independently verify crew-identifying claims for this issue.
• Recruiting surge: Russian-language criminal forums show renewed recruiting posts explicitly requesting operators with “automation and agent framework experience” — a first at this scale. One post offers a signing bonus for candidates who can demonstrate agentic tooling on a lab network.
• Rebrand churn: At least one long-standing affiliate roster migrated to a successor brand, keeping the same encryptor lineage. Defender takeaway: encryptor-family attribution remains more stable than brand names. Track binaries and TTPs, not leak-site logos.

The recruiting signal is the headline. When crews start paying for agentic-automation skills, the tooling has crossed from experiment to operational standard.

Agent Tooling in the Ransomware Kill Chain

So what does “ransomware agent tooling” actually look like on a network? You’re no longer attacking a human operator running BloodHound interactively — you’re attacking an autonomous loop, wrapped in business logic, executing the classic kill chain at machine speed.

Observed and reported patterns this week follow a consistent architecture:

1. Recon agents. An LLM-driven agent chains enumeration commands — net share, LDAP queries, SMB share listing, AD discovery — evaluating each result and selecting the next step. The operator sets an objective (“find file servers with >500GB free and financial data”) and the agent iterates. Frameworks built on open-source agent scaffolds mirror the architecture OWASP describes in its GenAI security guidance: planning loop, tool execution, memory, reflection.
2. Credential orchestration. The agent pivots harvested credentials — from memory dumping, stealer logs, or brute-forced service accounts — directly back into the loop, re-running enumeration with new privileges. No human in the loop means no human-pace delays.
3. Staging automation. Agents stage exfiltration (often via cloud storage APIs), disable or evade endpoint protections based on process feedback, and trigger the encryptor only when staging confidence thresholds are met.

The net effect: dwell-time compression. Where a 2023 operator needed five to ten days from initial access to encryption, agent-driven intrusions observed this year frequently complete the loop in under 24 hours. Your detection window is shrinking accordingly.

The good news — the same uniformity that makes agents fast also makes them loud. Agents produce telemetry with machine-like cadence: near-constant intervals, perfect enumeration sweeps, and tool invocations that a tired human would skip. That’s what we hunt below.

Stealer-to-Ransomware Handoff Tradecraft

How does a stealer log become a ransomware breach? Through a mature broker market that predates agentic tooling but now feeds it perfectly.

Infostealer malware (RedLine-lineage successors, Lumma-class loaders) harvests browser cookies, saved passwords, and session tokens from consumer and corporate endpoints alike. Those logs are packaged and sold in bulk on Telegram channels and dedicated marketplaces. From there:

• Filtering: Brokers sort logs for corporate value — VPN portal URLs, SSO provider domains (Okta, Entra ID), Citrix gateways, Jira/Confluence instances.
• Access resale: Filtered “enterprise access” is resold at a premium on dedicated access marketplaces, priced by target revenue and privilege level.
• Affiliate handoff: Ransomware affiliates buy the access, validate session cookies against MFA-bypassable flows, and hand the foothold to their new agent tooling for the recon-to-encryption loop.

This week’s nuance: agent tooling is being pointed at validation — automatically testing thousands of stolen cookies against target VPN endpoints and flagging the live ones. Handoffs that once required manual trial-and-error now happen at scale, which is why we’re seeing shorter gaps between a stealer infection and a full breach. IBM’s Cost of a Data Breach report and CISA’s ransomware guidance at StopRansomware both increasingly flag initial-access-broker pipelines as the dominant entry vector.

Hands-On: Detecting Agent-Driven Lateral Movement

Agent loops produce three signature telemetry patterns: uniform timing, exhaustive enumeration, and scripted remote-execution cadence. Here’s how to catch each.

Uniform-interval enumeration (KQL)

Humans pause, mis-type, and read. Agents fire at fixed intervals. Flag process enumeration bursts with near-zero timing variance:

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("net share", "net view", "Get-ADComputer", "Get-SmbShare", "nltest")
| summarize Count=count(), FirstRun=min(Timestamp), LastRun=max(Timestamp),
    StdevSec=stdev(datetime_diff("second", Timestamp, FirstRun)) by DeviceId, bin(Timestamp, 1h)
| where Count > 30
| project DeviceId, Count, FirstRun, LastRun

Anomalous SMB/WMI volume (Splunk)

index=wineventlog EventCode=4688 OR EventCode=5145
| regex Process_Name="(?i)(wscript|cscript|cmd|powershell)"
| regex Process_Command_Line="(?i)(wmic.*process|smb|net use|Get-WmiObject)"
| stats count dc(ComputerName) as targets by Account_Name, _time span=5m
| where count > 40 AND targets > 15
| sort - count

Sigma rule: scripted share enumeration burst

title: Agent-Driven Share Enumeration Burst
id: 9f2c1a44-77b0-4d31-a1c8-0e5d2b6f8a91
status: experimental
description: Detects high-frequency, uniform-cadence share enumeration consistent with automated agent loops
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
    condition: selection | count() by Computer > 100
timeframe: 2m
falsepositives:
    - Bulk file-migration tooling
    - Vulnerability scanners
level: high

Tune thresholds against your baseline first — SCCM and vulnerability scanners generate legitimate enumeration noise. The discriminator is cadence regularity, not raw volume alone.

Hands-On: Hardening Against Automated Recon

Agents optimize for the path of least resistance. Every bit of friction you add multiplies across thousands of loop iterations — and agents have brittle failure modes when their tools error out repeatedly. Four config changes with outsized impact:

1. Enforce SMB signing

Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Set-SmbClientConfiguration -RequireSecuritySignature $true -Force

Blocks relay-based pivoting and forces agents onto noisier tradecraft. Windows Server 2025+ defaults to required; verify older systems.

2. Deploy Windows LAPS with tiered policy

Set-LapsAADPasswordExpirationTime -Identity "WEB-WKS-041" -WhenEffective (Get-Date).AddDays(4)
# Enforce via GPO: rotate daily, restrict password readability to Tier 0 admins only

Credential reuse is the fuel of agent loops. Rotated, per-device local admin passwords break the harvest-and-reuse cycle the agent depends on.

3. Deploy canary shares with alerting

Create decoy shares (FS01Finance_Q3_2026, DC01IT-Backups) with aggressive audit SACLs and instant SIEM alerts on any access. Agents that exhaustively enumerate share lists will touch them — and unlike human operators, they can’t be talked out of it. Any hit is a high-fidelity detection.

4. Tune EDR to slow agent loops

Configure EDR to kill PowerShell/WMI processes exceeding defined enumeration rates, and enable tamper protection with anti-tamper alerting. Agent frameworks often attempt self-remediation when a tool call fails — a blocked command can send the loop into a retry spiral that’s trivially detectable and buys your responders time.

CTF and Lab Exercise: Simulating the Handoff

Want to practice detecting this end-to-end without touching production? Build a two-stage lab:

• Range: GOAD (Game of Active Directory) or a lightweight three-VM AD lab (domain controller, file server, workstation) on Proxmox or VirtualBox. Isolate with a host-only network.
• Stage 1 — stealer exfil: On the workstation, simulate stealer behavior safely — use a benign credential-exfil emulator (or hand-craft fake browser-export artifacts) and log the outbound POST to a local listener. Never run live infostealer malware, even in labs.
• Stage 2 — ransomware staging: Use Atomic Red Team and Caldera to replay the relevant techniques: T1087 (account discovery), T1135 (network share discovery), T1021 (remote services), T1486 (data encrypted for impact — simulate with benign file-marker writes).
• Detection: Ship Sysmon + Windows Event logs to a free Splunk instance or Elastic Security stack, then write and tune the queries above against your own generated noise.
• Success criteria: Detect stage 1 within 10 minutes, and detect the agent-pattern enumeration burst before the staging simulation runs.

What Blue Teams Should Do This Week

Prioritized, in order:

1. Patch all five KEV entries in the watchlist table — internet-facing edge appliances today, KEV-dated entries ahead of their federal due dates
2. Hunt for stealer infections on endpoints. Sweep for anomalous browser-process parentage and credential-store access; treat any hit on a user with VPN/SSO access as a potential active foothold, and rotate their sessions.
3. Review egress for credential dumps. Watch for bulk POST traffic to unfamiliar domains and cloud-storage APIs — stealer exfil is the upstream signal for the handoff pipeline.
4. Deploy the detection queries above and baseline them over 48 hours before tuning thresholds.
5. Verify SMB signing and LAPS coverage across the estate; add canary shares where none exist.
6. Rehearse the compressed timeline. Your incident-response playbooks likely assume days of dwell time. Agent tooling gives you hours — confirm your on-call escalation actually works at that speed.

Further Reading and Indicators

• CISA Known Exploited Vulnerabilities Catalog — cisa.gov/known-exploited-vulnerabilities-catalog
• CISA #StopRansomware guidance — cisa.gov/stopransomware
• OWASP GenAI Security Project (agent threat modeling) — genai.owasp.org
• MITRE ATT&CK technique references for detections above — attack.mitre.org
• IBM Cost of a Data Breach Report — ibm.com/reports/data-breach

Verified IOCs (source: aggregated vendor telemetry and community reporting this week; validate before deploying): encryptor binaries matching the consolidated crew lineage (SHA-256 hashes distributed via private threat-sharing channels — request via your ISAC); C2 nodes rotating through compromised residential proxies — block at ASN granularity, not IP; stealer-panel exfil domains observed saturating this week’s filtering lists. We publish confirmed hashes only after multi-vendor corroboration; treat single-source lists with suspicion.

Frequently Asked Questions

What is ransomware agent tooling?

Automation frameworks that use LLM-driven agents to run reconnaissance, credential harvesting, lateral movement, and encryption staging with minimal operator involvement. The operator defines an objective; the agent chains enumeration and exploitation tools autonomously, iterating on results until staging conditions are met — compressing intrusions that once took days into hours.

How do infostealer logs lead to ransomware attacks?

Stealer malware harvests credentials, cookies, and session tokens, which are sold in bulk on criminal marketplaces. Brokers filter logs for corporate VPN and SSO access, resell that access at a premium, and ransomware affiliates buy it — validating stolen sessions against MFA-exempt flows and handing the foothold to their automation stack for the full breach cycle.

Which CVEs should I patch first this week?

Start with the KEV-based watchlist table above. Prioritize internet-facing entries first — this window’s KEV additions put edge and management appliances at the top (Zyxel GS1900, Arista VeloCloud Orchestrator, F5 BIG-IP APM, both Check Point entries), followed by the Linux kernel trio; Microsoft SharePoint (added to KEV on 25 September) is the collaboration-infrastructure entry ransomware crews favor for staging.

How can I detect AI agent-driven lateral movement?

Look for the machine’s fingerprints: uniform timing between enumeration commands, exhaustive sweeps of shares and AD objects, and high-volume scripted SMB/WMI activity. The KQL, Splunk, and Sigma rules in the hands-on sections above flag these cadence patterns directly.

Is this a hands-on digest for beginners?

It’s written for practitioners, but approachable: plain-English explanations of the tradecraft, copy-paste detection queries for your SIEM, and a full CTF lab walkthrough. If you can read a Windows event log, you can run everything in this digest.

Related reading

• Weekly Threat Intel: OAuth App Abuse, Autumn 2026 CVE Exploitation, and Malware Loader Trends
• WPA3 and SAE: Dragonfly Handshakes, Dragonblood and the Honest Transition

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy