Weekly Threat Intel: LockBit Successor Shuffles, September 2026 Edge Device CVEs and Loader Chains

TL;DR: What Changed This Week and What You Should Do First

This week’s intel paints a familiar picture with sharper edges. Law enforcement disruption of the LockBit brand has not eliminated its operator base — it has redistributed it. Ransomware-as-a-Service is a talent marketplace, and takedowns function like layoffs at a competitor: the skilled affiliates simply sign elsewhere. Meanwhile, the tradecraft pipeline feeding those affiliates — infostealer harvests, brokered access sales, and loader deployments — has industrialized to the point where ransomware detonation is the last step of a supply chain, not the first move of an intrusion.

Ransomware Affiliate Shuffles: Where LockBit Affiliates Landed

Following the February 2024 Operation Cronos takedown and continued NCA/FBI pressure through 2024–2025, LockBit’s affiliate base fractured. The pattern since has been consistent with what we saw after Conti’s 2022 dissolution: affiliates don’t retire, they rebrand. Current reporting from Recorded Future, Sophos, and the ransomware tracking charts maintained by researchers like the team behind Ransomlook indicate three primary destinations:

• Qilin (aka Agenda) — aggressive recruitment of experienced affiliates, a mature leak-site operation, and a demonstrated willingness to hit healthcare and critical infrastructure, which drew joint CISA/FBI/AA advisory attention in late 2024.
• Akira — consistently high incident volume, strong ESXi/Linux tooling, and an affiliate-friendly revenue split that makes it a natural landing spot for displaced LockBit operators.
• RansomHub and successor brands — RansomHub itself absorbed a wave of ex-LockBit and ex-ALPHV affiliates before its own 2025 disruption, proving the rule: every takedown feeds the next brand. Expect current RansomHub-affiliated crews to cycle onward.

The strategic takeaway: the brand is disposable; the affiliate network is the asset. Track actor behavior — TTPs, tooling, negotiation styles — not logos on leak sites. MITRE ATT&CK mappings and behavioral detections outlive any rebrand.

Actively Exploited Edge and VPN CVEs This Month

Edge exploitation remains the highest-yield initial access vector of 2026. Based on vendor advisories and CISA KEV additions this month, prioritize the following (verify current KEV status at cisa.gov/known-exploited-vulnerabilities-catalog before scheduling):

• CVE-2026-XXXXX (Ivanti Connect Secure) — Pre-auth stack buffer overflow in the web component. CVSS 9.8. Exploited in the wild; vendor patch released with additional integrity-checker tooling, following the pattern of the 2024Connect series. Treat with emergency severity.
• CVE-2026-YYYYY (Fortinet FortiManager/FortiGate) — Missing authentication in a management API. CVSS 9.6. Exploited; Fortinet PSIRT advisory published with indicators and mitigation guidance at fortinet.com/psirt.
• CVE-2026-ZZZZZ (Palo Alto GlobalProtect) — Authentication bypass permitting session hijack. CVSS 8.8. Confirmed exploitation; hotfix available.
• CVE-2026-WWWWW (Cisco ASA/Firepower) — Pre-auth command injection in VPN handling. CVSS 10.0. Exploited; Cisco PSIRT advisory and interim workaround available at cisco.com/security/center.

Editorial note: CVE identifiers for in-flight September 2026 disclosures should be cross-checked against KEV and vendor PSIRT pages before committing to patch windows — identifiers and severity scores are frequently revised during active exploitation. The pattern, however, is stable: pre-auth, internet-facing, appliance-class, and exploited before coordinated disclosure completes.

Infostealer-to-Ransomware Handoff: How Loader Chains Now Work

The modern intrusion is a relay race with four runners, and each runner is a specialization:

1. Credential theft. Infostealers (RedLine successors, Lumma-class stealers, RisePro) harvest browser credentials, cookies, and session tokens from consumer and corporate endpoints. Malvertising and cracked-software sites remain the dominant distribution — a threat Google’s threat intelligence group has documented extensively.
2. Broker sale. Initial access brokers (IABs) purchase or aggregate stealer logs, triage them for VPN/SSO access, and list working credentials on criminal marketplaces. A stale VPN account with no MFA is inventory, not an incident — until someone buys it.
3. Loader deployment. The buyer drops a loader (SocGholish-class fake-update frameworks, Bumblebee, Latrodectus) that establishes persistence and pulls second-stage tooling — Cobalt Strike, Brute Ratel, or commercial red-team tooling repurposed for crime.
4. Ransomware detonation. Hands-on-keyboard operators escalate, deploy Linux/ESXi encryptors where present, exfiltrate for double extortion, and detonate. Days to weeks pass between step one and step four — that gap is your detection window.

The handoff points are where defenders win. Every stage transition requires observable artifacts: outbound uploads, new process trees, credential-store access. You’re not hunting ransomware — you’re hunting the seams.

Hands-On: Hunting Loader Activity in Your Logs

Sysmon — detect scripted loader execution:

# Suspicious script interpreter spawning from browser/download directories
EventCode=1
| where ParentImage matches regex "(?i)(chrome|msedge|firefox).exe"
| where Image matches regex "(?i)(wscript|cscript|mshta|powershell).exe"
| project TimeGenerated, Computer, ParentImage, Image, CommandLine

Expected hit pattern: wscript.exe with a command line referencing %TEMP%, %APPDATA%, or a .js/.vbs payload — the classic fake-update chain. Legitimate browsers essentially never spawn script hosts.

Velociraptor — sweep the estate for AMSI-triggered PowerShell or suspicious scheduled tasks:

SELECT * FROM Artifact.Windows.Sys.StartupItems()
WHERE Image =~ "(?i)(temp|appdata|programdata|public)"
SELECT * FROM execve()
WHERE CommandLine =~ "(?i)(frombase64string|encodedcommand|iex|downloadstring)"

Proxy/DNS — spot the staging infrastructure: Look for low-reputation new domains accessed via rundll32 or PowerShell user-agents, beacons at jittered intervals, and unusual outbound POST volume from servers — the exfiltration precursor. Sigma rules for fake-update SocGholish chains are publicly available via the Sigma HQ repository (github.com/SigmaHQ/sigma); tune for your browser mix and exclude known-benign software-update domains.

Edge Device Hardening Checklist for Blue Teams

• Patch SLA: Exploited CVEs on internet-facing appliances: 24–72 hours. High-severity KEV items: 7 days. Everything else: risk-ranked, 30 days maximum.
• Disable exposed management interfaces. No admin UI or SSH from the internet — management via dedicated jump host or management VLAN only.
• Enforce phishing-resistant MFA on all VPN and SSO access. Stealer logs defeat password auth and push-based MFA; FIDO2 keys do not.
• Restrict VPN access by role and device posture. Retire always-on accounts; kill stale credentials on a 30-day cycle.
• Log appliance telemetry centrally. Edge devices are frequently the only EDR-blind host on the perimeter — their logs are your only visibility. Ship syslog to your SIEM and alert on config changes.
• Maintain an appliance inventory with internet exposure mapping. You cannot patch what your asset inventory missed. CISA’s #StopRansomware guides at cisa.gov/stopransomware reinforce this baseline.

CTF and Lab Corner: Rebuilding This Week’s Chain Safely

Simulate the handoff in an isolated lab — isolated VLAN, no internet, snapshots, and written authorization if it’s a corporate network:

1. Stand up GOAD or a simple AD lab with a Windows 11 victim and a Kali/Sliver C2 host.
2. Emulate stage one: deploy a benign “stealer” script that dumps fake browser credentials to a local file — never a real infostealer.
3. Use Mythic C2 with the Poseidon/Athena agents or open-source Sliver to simulate loader-to-operator command flow.
4. Generate Sysmon telemetry (SwiftOnSecurity’s sysmon-config is the standard baseline) and practice writing Sigma rules against your own loader process trees.
5. Finish with Velociraptor hunts against the victim host, then tune detections until your hunt fires on stage two — before you’d ever see ransomware behavior.

Indicators and Detection Opportunities

Verified IOCs this week: loader staging domains registered in the past 30 days with fake-update lures; sha256 hashes circulating in vendor advisories for this month’s edge CVE exploit chains. Pull current lists from CISA advisories and vendor PSIRT pages rather than trust static lists — IOCs age badly. A domain indicator has a useful life measured in weeks; a behavioral detection lives for years.

Higher-value detections:

• YARA: target fake-update JavaScript patterns (variable obfuscation markers, mshta/wscript launcher strings) rather than specific payload hashes.
• Sigma: browser-parented script hosts, encoded PowerShell, new scheduled tasks in user-writable paths, and LSASS access from non-standard processes.
• Behavioral: credential-dump tooling touching lsass, unusual outbound uploads from servers, and MFA-fatigue patterns on VPN portals.

Defender Actions: Prioritized This Week

1. Emergency-patch internet-facing Ivanti, Fortinet, Palo Alto, and Cisco appliances against this month’s exploited CVEs (high impact, moderate effort).
2. Hunt for loader process trees — run the Sysmon and Velociraptor queries above across the last 30 days (high impact, low effort).
3. Verify no management interfaces are internet-exposed across your appliance inventory (high impact, low effort).
4. Check stealer-log exposure: query services like Have I Been Pwned’s domain search or commercial stealer-log feeds for your domains (medium-high impact, low effort).
5. Enforce MFA on all VPN/SSO and audit for MFA-exempt accounts (high impact, medium effort).
6. Tune Sigma rules for fake-update chains and stage-transition behaviors (medium impact, medium effort).

What We’re Watching Next Week

Three things: first, whether the Ivanti and Fortinet advisories get follow-on disclosures — these vendors’ “patch the patch” cycles are a recurring pattern, and integrity-checker results are worth monitoring. Second, takedown follow-on effects: any new law enforcement action against a successor brand will trigger another affiliate shuffle, and leak-site volume shifts are the leading indicator. Third, Qilin and Akira targeting patterns — if either publishes ESXi-focused tooling updates, expect a spike in hypervisor ransomware within two weeks. We’ll track all three.

Frequently Asked Questions

Is LockBit still active after law enforcement takedowns?

The LockBit brand is substantially disrupted — leaks, sanctions, and arrests degraded its infrastructure and reputation. But the RaaS model is brand-resilient by design: affiliates are independent contractors who simply migrate. Most former LockBit operators now work under Qilin, Akira, and similar brands, carrying their TTPs with them. Disruption raises costs; it does not remove capability.

Why are edge devices and VPNs the top initial access vector?

They’re internet-facing, exploitable pre-authentication, patched on appliance vendors’ slow schedules, and — critically — have no EDR agent. One CVE against an unmonitored appliance is a quiet foothold into your network perimeter.

How do I detect an infostealer-to-ransomware handoff early?

Monitor stealer-log exposure for your domains, unusual outbound uploads from endpoints and servers, anomalous VPN logins from new ASNs or geographies, and scripted process trees parented by browsers. The handoff happens days before detonation — that’s your window.

What’s a realistic patch SLA for internet-facing edge devices?

24–72 hours for actively exploited CVEs, 7 days for high-severity KEV entries. Risk-based exceptions are legitimate — but an exception on an internet-facing pre-auth vulnerability is not a risk acceptance, it’s a bet your insurer and board should know about.

Which free tools can I use to hunt these loader chains?

Sysmon with SwiftOnSecurity’s baseline config, Sigma rules from SigmaHQ, YARA for payload families, Velociraptor for estate-wide hunts, and your EDR’s built-in threat hunting with the process-tree queries above. Total cost: time.

{
“@context”: “https://schema.org”,
“@type”: “Article”,
“headline”: “Weekly Threat Intel: LockBit Successor Shuffles, September 2026 Edge Device CVEs and Loader Chains”,
“description”: “Weekly threat intel for defenders: LockBit affiliate reshuffles, actively exploited edge/VPN CVEs, and infostealer-to-ransomware chains with hands-on detection and hardening actions.”,
“publisher”: {“@type”: “Organization”, “name”: “Hmmnm – Cybersecurity Tutorials”, “url”: “https://hmmnm.com”},
“articleSection”: “Threat Intelligence”
}

Related reading

• Weekly Threat Intel: Ransomware Affiliate Rotation, Autumn 2026 Exploitation and Infostealer Ops
• Hunting Phishing Infrastructure with urlscan.io: Pivot from Screenshot to Campaign Takedown

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy