🎯 Ransomware deployment

The items that name it 5

• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  writeup2026-09-09

  UAT-11988 deployed Qilin ransomware on selected endpoints after reconnaissance and credential theft

• CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
  writeup2026-07-09

  Pulling and executing a DragonForce ransomware binary (1.exe) to encrypt the environment.

• Akira, LimeWire, and the Sour Taste of Data Exfiltration
  writeup2026-06-12

  Threat actor renamed a cross-platform Akira encryptor to akira.exe and launched it against several mounted shares

• Data Exfiltration and Threat Actor Infrastructure Exposed
  writeup2026-03-12

  Execution of INC ransomware executable win.exe with --sup --hide --mode medium flags from c:\perflogs\

• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeup2025-12-03

  Warlock ransomware deployed following Velociraptor-based access and lateral movement in Incident 3