Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
2026 Ransomware Cartelization: Qilin, LockBit and Akira Convergence
Threat Actors
Malware Families
Excerpt
The ransomware threat landscape has entered a structurally distinct phase. In September 2025, DragonForce publicly proposed forming a coalition with LockBit and Qilin, announcing it on dark web forums with an explicit invitation to _"create equal competition conditions, no conflicts, and no public insults"_ and to _"dictate market conditions"_. LockBit's operator responded affirmatively, and DragonForce subsequently declared the coalition active. This…
Read the original report →Diamond Model
Adversary(8)
Infrastructure
Capability(13)
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2024-40711 | Medium | Score 53/100 | First seen |
| CVE | CVE-2020-3259 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-0282 | High | Score 63/100 | First seen |
| CVE | CVE-2024-21762 | Medium | Score 56/100 | First seen |
| CVE | CVE-2023-27532 | Medium | Score 58/100 | First seen |
| CVE | CVE-2023-3519 | High | Score 63/100 | First seen |
| CVE | CVE-2025-6543 | Medium | Score 58/100 | First seen |
| CVE | CVE-2025-22457 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-20269 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-7776 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-7775 | Medium | Score 51/100 | First seen |
| CVE | CVE-2024-40766 | High | Score 80/100 | First seen |
IOC Relationship Graph
Building graph…