August 17, 2026 Emerging Threats Weekly
This week’s briefing covers:
00:00 – Intro
00:41 [RANSOMWARE] Storm-1175 Shifts From Medusa to StormEncryptor Through N-central Exploitation
Storm-1175 has resumed activity after several months and is now deploying a previously undocumented ransomware strain, StormEncryptor, rather than payloads from the KTA321 (Medusa) ransomware operation previously associated with the actor.
02:34 [CAMPAIGN] Lazarus Refreshes Operation Dream Job with SecurityPDF, Troy, and a Windows Zero-day
Check Point reported a new Operation Dream Job wave tied to KTA071 (Lazarus), with current activity concentrating on defence-sector organizations, especially aerospace and aviation, and with observed impact in Europe and India.
05:36 [RANSOMWARE] Gunra Expands its Affiliate Model and Continues Edge-device Exploitation
U.S. and South Korean agencies this week warned that KTA447 (Gunra) has matured from a single ransomware operation into a ransomware-as-a-service model with global victim coverage. The advisory places KTA447 squarely in the current tier of active crews targeting government and critical infrastructure organizations.
07:59 [ESPIONAGE] LightSpy Expands Beyond China and Adds Router-level Visibility
Reporting this week indicates the Chinese-linked LightSpy platform has broadened well beyond its historical focus on mainland China and is now being used against victims in more than a dozen countries, including targets in Europe and the United States.
09:49 [SUPPLY CHAIN] TeamPCP Now Appears Tied to a Multi-year Infrastructure and AI-abuse Ecosystem
New research this week suggests KTA532 (TeamPCP) should not be viewed as a newly emerged actor from late 2025, but as the latest iteration of a longer-running operational threat cluster active since at least 2020.
11:58 [VULNERABILITY] SharePoint CVE-2026-45659 has Moved From Active Exploitation to Ransomware Use
A Microsoft SharePoint Server deserialization flaw tracked as CVE-2026-45659 is now being used in ransomware operations following an update to CISA’s Known Exploited Vulnerabilities catalogue. The issue was patched in late May and added to KEV on 1 July, but the latest update shows exploitation has progressed into monetization.
Dive deeper:
Kroll’s Monthly Threat Intelligence Spotlight Report: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/cti-spotlight-trends-report
Kroll’s Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services
Kroll’s Q4 2024 Cyber Threat Landscape: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/q4-2024-threat-landscape-report-phishing
Kroll’s 2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Era: https://www.kroll.com/Reports/Cyber/Threat-Intelligence-Reports/Threat-Landscape-Report-Lens-on-Crypto
Playlist of Kroll's Weekly Cyber Threat Intelligence Briefings: https://www.youtube.com/playlist
Kroll Cyber Blog: https://www.kroll.com/en/insights/cyber
Kroll Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services
Kroll Threat Intelligence Reports: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports
Kroll Cyber and Data Resilience: https://www.kroll.com/en/services/cyber
#krollcyber #threatintelligence #cyberthreats