Full Report
Since April 2025, Team Cymru has worked with a digital forensics and incident response (DFIR) company on more than 20 ransomware investigations, predominantly impacting small-to-medium-sized enterprises located in the United Kingdom. For each investigation, our trusted partner shared live indicators of compromise (IOCs) they uncovered from manual host-based forensic analysis as the incidents were ongoing to provide Team Cymru with the best opportunity to analyze and track the operators in our global netflow data and internet telemetry. Using all of the IOCs provided by our trusted partner, Team Cymru analyzed the IP address attributes and NetFlow communications. This led us to identify useful trends in hosting, services used, protocols, and software leveraged by multiple ransomware gangs.
Analysis Summary
# Incident Report: Ransomware Infrastructure Analysis (April 2025 – April 2026)
## Executive Summary
From April 2025 to April 2026, Team Cymru and a DFIR partner investigated over 20 ransomware incidents primarily targeting UK-based SMEs. The analysis tracked multiple high-profile groups—including Akira, Clop, and Qilin—revealing a heavy reliance on dual-use tools (Rclone, AnyDesk) and Virtual Private Servers (VPS) for data exfiltration and Command and Control (C2). The investigations successfully mapped attacker infrastructure to global netflow data, enabling the creation of proactive detection tags.
## Incident Details
- **Discovery Date:** April 2025 (Start of investigative period)
- **Incident Date:** Ongoing (Incidents documented through April 2026)
- **Affected Organization:** Multiple Small-to-Medium Enterprises (SMEs)
- **Sector:** Various
- **Geography:** United Kingdom (Predominantly)
## Timeline of Events
### Initial Access
- **Date/Time:** Various (Investigations spanning 2025-2026)
- **Vector:** Exploitation of edge devices and credential abuse.
- **Details:** Attackers leveraged vulnerabilities in SonicWall SSL-VPNs, brute-forced exposed RDP ports, and used stolen credentials to access Fortinet Fortigate devices.
### Lateral Movement
- Attackers utilized Offensive Security Tools (OSTs) such as Cobalt Strike.
- Dual-use remote desktop software, specifically AnyDesk, was frequently abused to move between systems.
### Data Exfiltration/Impact
- **Tools:** Rclone and FileZilla were the primary utilities used for data theft.
- **Method:** Data was staged and moved to attacker-controlled VPS infrastructure or SOCKS5 proxy chains (e.g., GOST) before encryption to facilitate double extortion.
### Detection & Response
- **Discovery:** Identified through manual host-based forensic analysis by a DFIR partner.
- **Response Actions:** Live IOCs were shared with Team Cymru to track operator activity in global netflow and internet telemetry data.
## Attack Methodology
- **Initial Access:** Exploitation of VPN vulnerabilities (SonicWall, Fortinet), RDP Brute-forcing.
- **Persistence:** Use of Cobalt Strike beacons and remote access tools.
- **Defense Evasion:** Use of legitimate dual-use tools (AnyDesk, Rclone) to blend with normal traffic; use of VPN/Tor nodes to mask origin.
- **Credential Access:** Stolen credentials for VPN access.
- **Discovery:** Netflow analysis suggests scanning and reconnaissance from "risknet" hosting providers.
- **Lateral Movement:** Cobalt Strike, AnyDesk, and SSH (Port 22).
- **Exfiltration:** Rclone SFTP nodes, FileZilla, and SOCKS5 proxy chains.
- **Impact:** Data exfiltration followed by system encryption (Double Extortion).
## Impact Assessment
- **Financial:** Significant (Costs associated with ransom demands and DFIR recovery).
- **Data Breach:** High volume; data exfiltrated to be posted on Tor leak sites.
- **Operational:** Business disruption for over 20 SMEs.
- **Reputational:** Public exposure of data via ransomware gang leak sites.
## Indicators of Compromise
*Note: Specific IPs were withheld for privacy, but general infrastructure trends include:*
- **Network Indicators:**
- Traffic originating from AS14061 (Akira/GOST Proxy).
- Traffic originating from AS213250 (Akira/Rclone SFTP).
- Traffic originating from AS42624 (Cobalt Strike).
- **Behavioral Indicators:**
- Unexpected outbound RDP (Port 3389) or SSH (Port 22) traffic to VPS hosting.
- Presence of `kali` in X.509 certificates associated with SonicWall traffic.
- SimpleHelp server banners on suspicious infrastructure (LockBit3).
## Response Actions
- **Containment:** Identification and tagging of malicious IP addresses in netflow data.
- **Eradication:** Manual forensic cleanup by DFIR partners on a per-incident basis.
- **Recovery:** Development of NetFlow "Scout" queries to identify and block future infrastructure matches.
## Lessons Learned
- **Tool Convergence:** Ransomware gangs are increasingly using the same set of legitimate tools (AnyDesk, Rclone), making signature-based detection difficult.
- **Infrastructure Overlap:** Multiple gangs utilize "Risknet" hosting providers, suggesting a shared preference for providers with lax oversight.
- **Proactive Tracking:** Combining host-based forensics with global netflow data allows for the identification of attacker infrastructure before the final encryption phase.
## Recommendations
- **Edge Security:** Patch all SonicWall and Fortinet devices immediately; disable RDP on internet-facing systems.
- **Access Control:** Enforce Multi-Factor Authentication (MFA) on all VPN and remote access points.
- **Monitoring:** Implement alerting for unauthorized use of Rclone, FileZilla, or AnyDesk within the enterprise environment.
- **Traffic Analysis:** Monitor outbound traffic to known SOCKS proxies, Tor exit nodes, and VPS providers associated with "Risknet" tags.