Worst Offenders

☠ Worst Offenders

The highest-impact entities across every dimension, ranked by indicator volume and severity. Attach any row to a new case (linked entities auto-pulled).

Attributed actors

—
tracked

Malware families

—

Sanctioned

—
indicators

Ransomware crews

23
active

🏹 Top Threat Actors

No data yet — run resolvers / attribution to populate.

🦠 Top Malware Families

No data yet — run resolvers / attribution to populate.

🌎 Worst Countries (hosting volume)

No data yet — run resolvers / attribution to populate.

📡 Worst ASNs (bulletproof / abuse-prone)

No data yet — run resolvers / attribution to populate.

🔒 Ransomware Crews (leak-site victims)

GroupVictimsCountries
clop401+ case
qilin117+ case
Orova111+ case
dragonforce41+ case
Dark Project43+ case
Barracuda44+ case
akira32+ case
chaos22+ case
thegentlemen21+ case
play21+ case
Panzer22+ case
lynx22+ case
incransom21+ case
gunra22+ case
Gammax11+ case
everest11+ case
cry011+ case
bravox11+ case
threeam11+ case
spacebears11+ case
lockbit511+ case
krybit11+ case
Global Secret Group11+ case

🛡 Most-Exploited Vulnerabilities

CVEVendorProductRansomware
CVE-2026-15409SonicWallSMA1000 AppliancesKnown+ case
CVE-2026-15410SonicWallSMA1000 AppliancesKnown+ case
CVE-2026-12569PTCWindchill and FlexPLMKnown+ case
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleToolsKnown+ case
CVE-2026-50751Check PointSecurity GatewayKnown+ case
CVE-2026-0257Palo Alto NetworksPAN-OSKnown+ case
CVE-2026-45321TanStackTanStackKnown+ case
CVE-2026-48027NxNx ConsoleKnown+ case
CVE-2026-41940WebProscPanel & WHM and WP2 (WordPress Squared)Known+ case
CVE-2024-1708ConnectWiseScreenConnectKnown+ case
CVE-2024-57726SimpleHelp SimpleHelpKnown+ case
CVE-2024-57728SimpleHelp SimpleHelpKnown+ case
CVE-2026-33825MicrosoftDefenderKnown+ case
CVE-2023-27351PaperCutNG/MFKnown+ case
CVE-2024-27199JetBrainsTeamCityKnown+ case
CVE-2023-21529MicrosoftExchange ServerKnown+ case
CVE-2026-20131CiscoSecure Firewall Management Center (FMC)Known+ case
CVE-2025-26399SolarWindsWeb Help DeskKnown+ case
CVE-2026-1731BeyondTrustRemote Support (RS) and Privileged Remote Access (PRA)Known+ case
CVE-2026-24423SmarterToolsSmarterMailKnown+ case
CVE-2025-52691SmarterToolsSmarterMailKnown+ case
CVE-2026-23760SmarterToolsSmarterMailKnown+ case
CVE-2025-55182MetaReact Server ComponentsKnown+ case
CVE-2025-61884OracleE-Business SuiteKnown+ case
CVE-2025-61882OracleE-Business SuiteKnown+ case

⚖ Sanctioned Entities

EntityListProgramCountry
suex.ioOFACCYBER2Russia+ case
chatex.comOFACCYBER2Latvia+ case
garantex.orgOFACCYBER2Estonia+ case
tornado.cashOFACCYBER2+ case
0x722122dF12D4e14e13Ac3b6895a86e84145b6967OFACCYBER2+ case
0x098B716B8Aaf21512996dC57EB0615e2383E2f96OFACDPRK3North Korea+ case
Bitzlato LimitedFinCENFinCEN 311Hong Kong+ case
Tornado CashOFACCYBER2+ case
blender.ioOFACCYBER2Russia+ case
Garantex Europe OUOFACCYBER2Estonia+ case
ChatexOFACCYBER2Latvia+ case
SUEX OTC, S.R.O.OFACCYBER2Russia+ case
Chosun Expo Joint VentureOFACDPRK2North Korea+ case
Park Jin HyokOFACDPRK2North Korea+ case
AndarielOFACDPRK3North Korea+ case
BluenoroffOFACDPRK3North Korea+ case
Lazarus GroupOFACDPRK3North Korea+ case
Igor Olegovich TurashevOFACCYBER2Russia+ case
Maksim Viktorovich YakubetsOFACCYBER2Russia+ case
Evil CorpOFACCYBER2Russia+ case

🔗 Pivot

Fusion Center →Correlation Graph →Analytics →Cases →Country risk →Nation-State theater →
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center