Weekly Threat Advisory: Ransomware Week — 19 Families, Akira Surge, HASH Beats IP (Jul 6 – 12, 2026)

Ransomware week. 19 families active in parallel, 559 catalogued IOCs, and the largest single-cluster footprint year-to-date — Akira at 292 IOCs. HASH beat IP for the first time in this catalogue’s history: 1,209 hashes vs 603 IPs, driven by the ransomware payload-rotation surge. A distinctive APT infrastructure signature emerged (UAT-7810: port trio 2222 / 8088 / 99 shared across three IPs). A novel loader pattern showed up at scale (multi-stage LNK + JavaScript-runtime backdoor, 135 IOCs). And macOS finally got its own ClickFix variant. If your SOC saw a busier alert queue this week, that is why.

Sectioned for the working analyst: cluster catalogue, deep-dives on the high-tempo names, ATT&CK technique mapping per adversary, subnet anchors + port-pattern signatures for cheap perimeter blocking, top 15 IOCs per indicator type, four production-ready Sigma rules, 60-minute operationalisation plan. Vendor-neutral. Operator-grade. Archive of prior advisories.

01 · This week in numbers

Two-and-a-half thousand records this cycle, and 78 percent of them are HIGH severity. The catalogue produced 2,433 unique IOCs across 124 adversary clusters — a busy week by any measure and the most diverse cluster count observed year-to-date. The composition story matters more than the topline: HASH indicators outpaced IP indicators for the first time, driven almost entirely by the ransomware payload-rotation surge (Akira alone contributed 292 hashes, RedWing 111, Multi-Stage LNK backdoor 135).

02 · Five headlines — what defined this week

If you read nothing else, read these five.

Headline 01 · Ransomware week — 19 families active in parallel

Nineteen named ransomware families surfaced with fresh operational indicators this cycle. Combined footprint: 559 IOCs in the Ransomware-as-a-Service category — the largest single-category concentration observed this year. Beyond the top-line names (Akira, BianLian, Anubis, GodDamn, BlackNevas, Beast, Clop, BlackSuit), fifteen additional families surfaced with 5+ IOCs each. The technique overlap is striking: every ransomware cluster this week carries the T1486 → T1490 chain (encrypt-for-impact + inhibit recovery). Detection content that fires on that pair catches every operator regardless of family. If you deploy nothing else this week, deploy the volume-shadow-copy deletion detector.

Headline 02 · Akira surged to 292 IOCs — largest single-cluster footprint YTD

Akira produced 292 unique indicators in seven days — the largest single-cluster footprint recorded in this catalogue year-to-date. The distribution skews entirely toward HASH + OTHERS (leak-site artefacts, victim-list identifiers), reflecting active payload rotation and active data-leak-site publication. The TTP chain: T1078 valid-account access, T1133 external remote services, T1021.001 remote-desktop lateral movement, T1047 WMI execution, T1560 archive collected data, T1041 exfil over C2, then T1486 encryption for impact and T1490 inhibit recovery. Push every hash to endpoint quarantine and every OTHERS artefact (victim-slug patterns) to your data-leak-site monitor.

Headline 03 · HASH beat IP for the first time in catalogue history

For the first time since this catalogue began publishing, HASH indicator volume beat IP indicator volume: 1,209 hashes vs 603 IPs (35 percent vs 22 percent of the catalogue). The inversion is entirely attributable to ransomware payload rotation and the multi-stage-loader family activity. What it tells the SOC: signature-based endpoint detection had a busier week than perimeter-based network detection. If your EDR content pipeline is slower than your firewall content pipeline, the ratio inversion this week is a leading indicator that you should invest more in the endpoint layer.

Headline 04 · UAT-7810 APT signature — port trio 2222 / 8088 / 99 shared across three IPs

The UAT-7810 APT cluster contributed 89 IOCs across HASH + IP + URL with a distinctive infrastructure signature: the three catalogued IPs (194.233.92.26, 217.15.160.247, 217.15.164.147) each expose the same trio of ports — 2222, 8088, 99 — serving what appears to be the same C2 stack across all three anchors. The port trio is the fingerprint. Any host serving that specific combination on those specific ports is candidate operator infrastructure regardless of whether the catalogued IPs are still active. Sigma rule 04 below fires on the port-pattern signature.

Headline 05 · Novel loader + macOS technique surface + supply-chain campaign

Three notable emerging patterns worth flagging:

• Multi-Stage LNK + JavaScript-runtime backdoor — 135 IOCs across DOMAIN + HASH. Novel loader technique using an LNK dropper to spawn a JavaScript-runtime process that pulls and executes second-stage payload. Defenders without instrumentation on the JS-runtime interpreter (node.exe equivalents) miss the execution chain entirely.
• macOS ClickFix — 18 IOCs across DOMAIN + URL. First observation of the ClickFix technique targeting macOS in this catalogue. Users get a fake-instruction lure and paste attacker-controlled shell commands into their terminal.
• Coordinated package-registry supply-chain campaign — 57 IOCs across HASH + URL. Two public package registries hit in coordinated fashion. Install-time command-interpreter execution + obfuscated payload + data-encoded exfil.

03 · Indicator type, severity, and category mix

The composition story of the week. HASH volume tops IP for the first time — 49.7 percent vs 24.8 percent. Ransomware category leads the category mix at 23 percent, followed closely by Malware-Activity (520 IOCs, 21 percent) and Cryptomining (248, 10 percent). APT is at 202 (8 percent) — a heavy APT week too.

By indicator type

By severity

By category

Reading the mix. Ransomware leads the categories with 23 percent share — the highest concentration observed this year. Combined with the HASH-over-IP inversion, this week is a payload-week: your EDR and file-scanning content is doing the heavy lifting, your perimeter blocks are catching relatively less.

04 · Top adversary clusters by indicator footprint

Akira leads at 292 IOCs. RuRAT (cryptomining) at 244. Open-framework infrastructure entries in grey to preserve visual clarity of the campaign-attributed clusters. BianLian ransomware sits at 145 IOCs across all four primary IOC types — the full-pivot signature.

How to read this. Pay disproportionate attention to clusters that span three or more IOC types — that breadth is a full-kill-chain signal. This week’s full-four-type footprints: BianLian (5 types actually with EMAIL+HASH+IP+OTHERS), Vidar, Dcrat, AsyncRAT, ClickFix, EtherRAT. The DPRK cluster spans five IOC types (DOMAIN + EMAIL + HASH + IP + URL) — the broadest single-cluster IOC-type spread this cycle.

05 · Cluster deep-dives — the names to act on

05.1 · Akira — 292 IOCs, largest single-cluster footprint YTD

Every ransomware kill-chain signature is present: valid-account initial access, external remote services, remote-desktop lateral movement, WMI execution, archive-then-exfil, and finally encrypt-for-impact + inhibit-recovery. The 292 catalogued indicators lean heavily toward HASH (payload rotation) and OTHERS (leak-site artefacts, victim identifiers). The operator is actively publishing to their leak site this week — watch the data-leak-site infrastructure indicators alongside the operational indicators.

Defensive actions: Push all catalogued hashes to endpoint scan-and-quarantine. Deploy the volume-shadow-copy deletion detector (vssadmin delete shadows is the canonical signal). Hunt for the kill-chain sequence valid-account login from an unusual source → remote-desktop or WMI execution → large outbound transfer to non-corporate destination. If your organisation is exposed to double-extortion operators, subscribe to the leak-site infrastructure watch.

05.2 · BianLian — full multi-pivot ransomware kill chain

145 IOCs across EMAIL + HASH + IP + OTHERS with two subnet anchors (151.236.16.0/24 and 172.96.137.0/24). The email indicators are victim-contact channels the operator uses for ransom negotiation. The IP indicators concentrate heavily in the 104.168.x, 104.200.x, and 104.225.x ranges — treat those provider blocks as candidates for expanded blocking. TTP profile is one of the broadest in the catalogue: 30+ ATT&CK techniques observed.

Defensive actions: Block both /24 anchors at the perimeter. Push the 145 hashes to endpoint scan. Watch for the credential-dumping-to-encrypt sequence: lsass.exe access → remote-desktop / SMB lateral move → volume-shadow-copy deletion.

05.3 · UAT-7810 APT — port-trio infrastructure fingerprint

The signature of the week. 89 IOCs across HASH + IP + URL. Three catalogued IP anchors — 194.233.92.26, 217.15.160.247, 217.15.164.147 — each serving the same trio of ports: 2222 (typically SSH-alternate), 8088, and 99. The trio is not a coincidence — it is the operator’s deployed C2-stack configuration. Any other host on the internet serving that exact port trio is candidate operator infrastructure regardless of whether it appears in this week’s catalogue.

Defensive actions: Block all three catalogued anchor IPs. Hunt for outbound traffic on the port trio to any destination outside your engineering allowlist — Sigma rule 04 below implements this. If you have JARM or JA4 fingerprinting on your egress, cluster the C2 stack signature and hunt for lookalikes across your telemetry.

05.4 · DPRK cluster — broadest 5-type IOC-type spread this week

37 IOCs across DOMAIN + EMAIL + HASH + IP + URL — the broadest indicator-type spread from any single cluster this week. The cluster maintains multi-layered infrastructure: acquired domains for recruitment lures, phishing email addresses, second-stage payload hashes, C2 IPs, and staging URLs. The operational implication: an ecosystem intrusion, not a single-lure campaign.

Defensive actions: All 37 catalogued indicators to blocking / watchlist by tier. Watch for the recruitment-lure phishing pattern (Lazaruscameradriverupdates.compaxos-apply.com-style domain naming) targeting developers, cryptocurrency-exchange staff, and defense-adjacent research organisations. Hunt for outbound to 144.172.110.53 across the last 60 days.

05.5 · PlugX — two subnet anchors, classic APT loader signature

31 IOCs across HASH + IP + URL with two subnet anchors: 172.111.233.0/24 (5 IPs concentrated) and 172.94.9.0/24 (3 IPs). The 172.111.233.0/24 anchor is the week’s largest APT-malware infrastructure concentration. Treat both /24 blocks as suspect — the operator is likely to rotate into unlisted addresses within the same blocks.

Defensive actions: Perimeter-block both /24 subnets. Push all hashes to endpoint scan. Hunt for the classic PlugX loader chain — DLL side-loading with signed binary + malicious sideload DLL + payload file.

05.6 · Multi-Stage LNK + JavaScript-runtime backdoor — novel loader technique

135 IOCs across DOMAIN + HASH. The technique: an LNK shortcut file drops and executes a JavaScript-runtime process (Windows JScript engine, server-side JavaScript runtime, or equivalent) that fetches and executes a second-stage payload from an operator-controlled domain. The technique defeats detection content that only inspects powershell.exe and cmd.exe as the loader — the JS runtime is the executor here.

Defensive actions: Instrument the JavaScript-runtime process as a suspicious loader in your endpoint content. Watch for node.exe, wscript.exe, and cscript.exe spawned from an LNK-file execution context. Hunt for parent-process = explorer.exe + child-process = JS runtime + outbound to any of the 135 catalogued domain / hash indicators.

05.7 · Coordinated package-registry supply-chain campaign

57 IOCs across HASH + URL. Two public package registries hit in coordinated fashion — the coordination itself is the signal, suggesting an operator with development pipeline access or automated typosquat publishing capability. Post-install command-interpreter execution + obfuscated payload + data-encoded exfil.

Defensive actions: Package allow-listing in CI build agents. Outbound-domain monitoring from build runners. Publisher-identity verification on the package registries used. Hunt for install-time process trees where a package installer spawns a shell that pulls from an unfamiliar domain.

05.8 · macOS ClickFix Campaign — first observation of macOS variant

18 IOCs across DOMAIN + URL. The first observation of the ClickFix social-engineering technique adapted for macOS. Users encounter a fake-instruction lure (“your Mac is missing X, run this command to fix it”) and paste attacker-controlled shell commands into their terminal. The technique is a pure social-engineering flow — no exploitation involved. User awareness is the primary defence.

Defensive actions: Update user-awareness content to include macOS-specific ClickFix lures. Block the 18 catalogued endpoints at the DNS resolver. Deploy endpoint content that flags terminal execution of curl-piped-to-shell or bash-piped commands from clipboard sources.

05.9 · RuRAT — 244 IOCs, cryptocurrency-wallet theme campaign

The domain layer shows deliberate theming — every catalogued domain adjacent to cryptocurrency-wallet names (anchorwallet[.]org, aptwallet[.]org, arkwallet[.]org, and similar). The victim-targeting profile is cryptocurrency users. The category tag is Cryptomining but the operational profile combines wallet-drainer and mining components.

Defensive actions: Block the 244 catalogued domains and hashes. Deploy regex-based DNS filtering for the *-wallet.* / *wallet-update.* patterns to catch operator rotation.

06 · ATT&CK mapping per named cluster

Per-cluster technique mapping with operational narrative. Detection content that fires on these techniques catches the cluster even after IOC rotation.

Detection-engineering takeaway. Every ransomware cluster this week carries the T1486 → T1490 chain (encrypt-for-impact + inhibit recovery). A single detector fired on volume-shadow-copy deletion (vssadmin delete shadows, WMI shadow-copy deletion, PowerShell Remove-Cim methods) catches every catalogued ransomware family regardless of variant. If you deploy nothing else this week, deploy that one detector.

07 · ATT&CK tactic-pressure roll-up

Aggregation of technique tags rolled up to the parent tactic. Impact tactics lead this week (ransomware); Discovery is elevated (ransomware pre-encrypt reconnaissance).

08 · Subnet anchors and port-pattern signatures

Subnet anchors (/24 blocks with 3+ concentrated IPs)

Port-pattern signature — UAT-7810 APT

The asymmetric block. Block the three UAT-7810 anchor IPs at the perimeter now (cost: zero). Deploy the port-trio Sigma rule to catch rotation. Total operator cost to defeat: they must reconfigure their C2 stack to a different port pattern — expensive across three IPs.

09 · Top 15 IOCs per indicator type

Operator-grade extractions. All indicators are defanged (re-fang on import: replace [.] with . and hxxp with http).

Top 15 · IP addresses (High severity)

Top 15 · Domains (High severity)

Top 15 · File hashes (High severity)

Top 15 · URLs (High severity)

10 · Sigma detection rules — four for this week’s standout patterns

Drop into your detection-content pipeline, normalise field names to your SIEM’s schema, tune the false-positive filters, ship.

Sigma 01 · Universal ransomware kill-chain detector (VSS delete)

title: Volume Shadow Copy Deletion — Universal Ransomware Kill-Chain Detector
id: 5c1a8d3f-4b92-4e70-a58c-6f9e7c1b3d40
status: experimental
description: Detects the universal ransomware pre-encrypt behaviour — deletion of
  volume shadow copies. Every catalogued ransomware family this week executes this
  step. A single detector catches Akira, BianLian, Anubis, GodDamn, BlackNevas,
  Beast, Clop, BlackSuit, and 11+ other active families.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  vssadmin_delete:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  wmi_delete:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  powershell_delete:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Remove-CimInstance'
      - 'Win32_ShadowCopy'
  condition: 1 of them
falsepositives:
  - Legitimate backup operations (verify + allowlist known-good scripts)
level: critical

Sigma 02 · BianLian subnet anchors

title: BianLian Ransomware Subnet Anchor Contact
id: 8a4c7d1e-6b93-4f20-a58d-2e9c1b3f4c60
status: experimental
description: Detects outbound connections to catalogued BianLian ransomware subnet
  anchors. Both /24 blocks catalogued this week with concentrated indicators —
  treat any traffic to these blocks as high-fidelity.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.impact
  - attack.t1486
logsource:
  category: network_connection
detection:
  selection:
    DestinationIp|cidr:
      - '151.236.16.0/24'
      - '172.96.137.0/24'
      - '104.168.140.0/23'   # concentrated BianLian IP block
      - '104.200.72.0/22'    # multiple catalogued BianLian addresses in this range
      - '104.225.129.0/24'
  condition: selection
falsepositives:
  - Unlikely — these CIDRs have no documented business use
level: critical

Sigma 03 · Multi-Stage LNK + JS-runtime loader

title: Multi-Stage LNK + JavaScript-Runtime Loader Detection
id: 3f7b9c2e-1d84-4a50-b721-5c8e6d4f2a10
status: experimental
description: Detects an LNK file execution that spawns a JavaScript-runtime process
  which then initiates an outbound connection. Catches the multi-stage LNK loader
  observed with 135 IOCs this cycle.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.005
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  parent_shell:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\Shell.exe'
  js_runtime_child:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\node.exe'
      - '\jscript.exe'
    CommandLine|contains|any:
      - '.lnk'
      - '.js'
      - '.jse'
      - '.vbs'
  condition: parent_shell and js_runtime_child
falsepositives:
  - Legitimate developer / build-agent workflows (allowlist by user + host)
level: high

Sigma 04 · UAT-7810 APT port-trio signature

title: UAT-7810 APT Port-Trio Signature (2222 / 8088 / 99)
id: 7d1a4b8e-5c62-4930-a8f1-3e9c7d5b2a40
status: experimental
description: Detects outbound connections to any destination serving the UAT-7810
  APT port-trio signature (2222, 8088, 99). The port combination is a stable
  operator fingerprint — matches even after IP rotation.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1571
logsource:
  category: network_connection
detection:
  selection_ip:
    DestinationIp:
      - '194.233.92.26'
      - '217.15.160.247'
      - '217.15.164.147'
  selection_port_trio:
    DestinationPort:
      - 2222
      - 8088
      - 99
  # Fire on either the known IPs OR any destination on all three ports within 5 min
  condition: selection_ip or (selection_port_trio | count(DestinationIp) by 5min > 2)
falsepositives:
  - Legitimate SSH-alternate (2222) or internal service (99) use — allowlist by dest
level: high

11 · Hunt queries — SIEM-agnostic pseudo-syntax

Hunt 01 · First-seen contact with UAT-7810 APT port-trio

// Pseudo-query
FROM network_flows
WHERE (dest_port IN (2222, 8088, 99))
  AND first_seen_pair(src_ip, dest_ip) WITHIN 60d
| AGGREGATE BY src_ip, dest_ip
  COUNT(DISTINCT dest_port) AS unique_ports_hit
WHERE unique_ports_hit >= 2
| SORT BY unique_ports_hit DESC

Catches the port-trio pattern even against unlisted destinations. Any endpoint contacting 2+ of the three ports on the same destination host is candidate compromise.

Hunt 02 · Ransomware pre-encrypt reconnaissance sequence

// Pseudo-query
FROM process_creates
WHERE process_name IN ('net.exe', 'net1.exe', 'nltest.exe',
                       'systeminfo.exe', 'ipconfig.exe', 'whoami.exe',
                       'quser.exe', 'tasklist.exe')
  AND host IN (
    SELECT host FROM process_creates
    WHERE command_line MATCHES '(?i)(vssadmin.*delete.*shadows|Remove-CimInstance.*ShadowCopy)'
    AND event_time BETWEEN NOW() - 24h AND NOW()
  )
| AGGREGATE BY host, COUNT(DISTINCT process_name) AS distinct_recon
WHERE distinct_recon >= 4
| SORT BY distinct_recon DESC

Ransomware operators run 4+ discovery utilities in quick succession before encrypting. The sequence itself is the signal.

Hunt 03 · LNK + JavaScript-runtime loader chain

// Pseudo-query
FROM process_creates
WHERE parent_process_name IN ('explorer.exe', 'Shell.exe')
  AND process_name IN ('wscript.exe', 'cscript.exe', 'node.exe')
  AND (command_line CONTAINS '.lnk' OR command_line CONTAINS '.js')
| JOIN network_flows AS n
  ON process_creates.host = n.src_host
  AND n.flow_time BETWEEN process_creates.create_time
                     AND process_creates.create_time + 300s
WHERE n.dest_domain NOT IN (allowlisted_domains)
| PROJECT process_creates.host, process_creates.command_line, n.dest_domain
| SORT BY create_time DESC

Catches the LNK-shortcut → JS-runtime → outbound sequence characteristic of the novel loader observed this week.

Hunt 04 · Wallet-drainer domain-registration-velocity pattern (RuRAT)

// Pseudo-query
FROM dns_queries
WHERE query_name MATCHES regex '.*wallet(-update)?\.'
   OR query_name MATCHES regex '.*wallet\.(org|com|top|info)$'
  AND query_name NOT IN (allowlisted_wallet_services)
| AGGREGATE BY src_host, query_name
| SORT BY COUNT DESC

12 · Operationalise in 60 minutes

Minute 00 – 15 · Block + sinkhole

• Block 172.111.233.0/24 (PlugX — largest APT-malware anchor this week).
• Block 91.92.43.0/24 (Tsundere botnet).
• Block 151.236.16.0/24 + 172.96.137.0/24 (BianLian ransomware).
• Block 194.233.92.26, 217.15.160.247, 217.15.164.147 (UAT-7810 APT).
• DNS-deny the RuRAT wallet-drainer domain cluster (regex .*wallet(-update)?.).

Minute 15 – 30 · Detection content

• Deploy Sigma 01 (universal volume-shadow-copy deletion detector).
• Deploy Sigma 04 (UAT-7810 port-trio signature).
• Deploy Sigma 03 (multi-stage LNK + JS-runtime loader).
• Add outbound-deny for ports 2222/8088/99 to any destination outside your engineering allowlist.

Minute 30 – 45 · Retrospective hunt

• Run Hunt 01 (port-trio pattern) across last 60 days.
• Run Hunt 02 (ransomware pre-encrypt reconnaissance) across last 30 days.
• Run Hunt 03 (LNK + JS-runtime chain) across last 30 days.

Minute 45 – 60 · Awareness + policy

• Update macOS user-awareness content on the ClickFix technique.
• Brief developers on the coordinated package-registry supply-chain campaign — package allow-listing not optional.
• Audit backup posture: any ransomware operator this week defeats defence-in-depth if backups are online-accessible. Verify air-gapped or immutable backups.

13 · Frequently asked questions