Tag: rdp compromise

2 Attack Reports | 0 Vulnerabilities

Attack reports

The Gentleman Ransomware | Defense Evasion TTPs Uncovered

In April and May 2026, investigations revealed two incidents involving The Gentlemen ransomware-as-a-service operation, which has claimed over 400 victims across 70 countries since mid-2025. Both incidents demonstrated common tactics including Scheduled Tasks, PowerShell commands, and defense evasi…
powershell
ransomware-as-a-service
qilin
defense evasion
scheduled tasks
CVE-2024-55591
socks proxy
the gentlemen
rdp compromise
2026-05-21
event log clearing
microsoft defender tampering
trojan:win32/mptamperbulkexcl.h
Published: May 21, 2026
Linked vulnerabilities : CVE-2024-55591 (CVSS 9.8)
Downloadable IOCs: 3

Q1 2026 malware statistics report for Windows web servers

Analysis of Windows web server attacks during Q1 2026 reveals that Internet Information Services (IIS) and Apache Tomcat servers face persistent threats through web shell exploitation. The Larva-26001 threat actor has been targeting domestic IIS servers for several years, deploying privilege escala…
coinminer
privilege escalation
badpotato
web shell
iis
apache tomcat
juicypotato
2026-04-14
CVE-2019-1458
htran
jsprat
port forwarding
porttranc
printspoofer
rdp compromise
windows web servers
Published: April 14, 2026
Linked vulnerabilities : CVE-2019-1458
Downloadable IOCs: 1
Click here to see more Attack Reports