Article
Fundamentals of Ransomware: What to Do Before and After Ransomware Strikes
Arete Analysis
By Raj Sivaraju
Amid the pandemic and as more people began working from home via unsecure networks, India saw a 31 percent rise in ransomware attacks.[i] What’s more, according to the Sophos “State of Ransomware 2020” study, of 300 Indian companies surveyed, 82 percent said they’d been hit by ransomware, with average ransom payments of approximately ₹80M.[ii]
Those numbers don’t bode well, especially as success is known to breed success. And don’t ransomware operators know it. There’s no reason for them to quit while they’re ahead — unless you give them one.
For now, the best way to combat this upward trend is to understand what you need to do before and after a ransomware attacks happens.
How to prepare: Get ready for ransomware before it strikes
Before a ransom note arrives and you see your business suddenly grind to a halt, there are actions you can take to limit your risk.
Get cyber insurance. Make sure you have cyber insurance. Ransomware attacks can get expensive fast — and for many, cyber insurance can be a business saver. Not only is there the extortion element to consider, but also the indirect costs of business disruption, reputational damage, data loss, data recovery, and potentially, diminished customer trust. Most regular insurance policies will not cover cyber risk exposure. So, speak to the experts and find out what your policy needs to keep you as safe and covered as possible.
Assess cybersecurity. If you aren’t already, start conducting annual audits and assessments of your environment so that you are aware of your company’s cybersecurity maturity and resilience levels, including potential security gaps.
Harden security posture. Consider deploying endpoint protection to all endpoints across your organization that could be potential gateways for malware attacks — there are some powerful endpoint detection and response (EDR) tools available on the market. Additionally, consider the latest technologies with behavioral artificial intelligence (AI) and fileless identification as well as containment tools.
Write an incident response plan and enlist assistance. Make sure to engage with a specialized third-party incident response vendor who not only will be on standby if an attack occurs but can also provide incident response preparedness training and design and guide you through tabletop exercises. Much like you would run fire drills in physical office spaces, it’s important to conduct simulation activities for incident response.
Dos and don’ts when ransomware hits
Now, let’s say you’ve been hit by ransomware. Here’s a checklist of what you should do — and of equal importance, what you should not do.
The dos:
Call your insurance carrier and third-party incident response vendor.
Remove infected systems from the network, take them offline.
Follow the instructions in the ransom note related to powering off systems.
Preserve all data from systems, firewalls, VPNs, proxy logs for forensic analysis.
Deploy advanced endpoint protection to all systems.
Dependent on organizational size, plan for a full return to normal operations to take up to two weeks.
The don’ts:
Do not panic. If you’ve done the pre-work and already set up your response teams, you can rest assured that they will react fast to triage, mitigate, negotiate, restore, all the things they’ve been trained to handle.
Do not shut down, power cycle, or reboot any infected systems.
Do not contact the threat actor yourself or try to negotiate. Leave this to your incident response vendor.
Do not wipe or re-image any systems as the forensic experts will need these for their investigation.
Do not rely on antivirus solutions, which failed to stop the ransomware.
Do not assume that once a decryptor is purchased that it’s all downhill from there.
Overview of Arete incident response
Arete has worked thousands of ransomware cases. When engaged, our incident response team focuses on getting your business back up and running as quickly as possible.
Step one is a scoping call to collect as many details as possible about the incident and begin collaborating with your insurance carrier to establish next steps for the investigation. Often, our incident response team will also be quick to deploy SentinelOne, an industry-leading EDR solution to clean and protect your environment — and help ensure that the threat actors do not re-encrypt systems after restoration.
If at any point you and your insurance carrier determine that paying a ransom is the most effective way to resolve the issue and return to normal business operations, our team will communicate with the bad actor on your behalf to negotiate a settlement.
With access regained, the team will assist in attack analysis and critical system restoration, bringing varied skill sets to deliver:
Data-driven security architecture review and recommendations.
Decryption and data recovery assistance.
IT infrastructure restoration and rebuilds.
Collection and preservation of forensic evidence.
Security improvements to limit or eliminate unauthorized access to networks, endpoints, and data.
Combined, these services can help you regain and maintain control of systems and assets, improve your cybersecurity going forward, and gather insights to prevent future incidents.
India’s unique opportunity: The time to get ahead of ransomware attacks is now
It’s time to be proactive. India is undergoing a digital transformation, which presents an opportunity to get ahead of this trend by educating employees, assessing security gaps, putting the right protections in place from the start, and having a clear and well-rehearsed incident response plan in place.
[i] Ransomware attacks rose by 31% amid pandemic: Report- The New Indian Express
Back to Blog Posts
Article
Anubis Utilizing Custom Backdoor and BYOVD Tools in Attacks
In October, researchers observed the Anubis ransomware group using a new custom backdoor named Lindnor, which masqueraded as a Chrome component and VMware file and sent the process ID, operating system version, file path, computer name, username, domain, and logon server to a command-and-control (C2) server. Threat actors dropped multiple executables to help terminate security services, along with five publicly known vulnerable drivers. They also installed the legitimate remote access tool AnyDesk and a separate tool to run it in Safe Mode, likely to maintain access when security software was not fully running.
Arete recently observed Anubis using similar tools and tactics, in particular Bring Your Own Vulnerable Driver (BYOVD) techniques and AnyDesk for remote access, alongside PowerShell-based loaders to support defense evasion, privilege escalation, and malicious payload execution.
Analyst Comments
The observed activity reflects an evolving, multi-stage intrusion approach focused on establishing persistent access, evading security controls, and enabling follow-on malicious activity. Notably, the deployment of custom backdoors such as Lindnor indicates a shift toward more tailored tooling designed to maintain covert access. BYOVD techniques and PowerShell-based loaders have also been observed facilitating defense evasion and ultimately executing malicious binary payloads. Collectively, these activities demonstrate increasingly sophisticated tradecraft focused on persistent access and circumventing endpoint security controls.
Sources
New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org
Article
Ransomware Trends & Data Insights: October 2026
Although Akira once again emerged as the most active ransomware group in October, overall ransomware and extortion activity was not dominated by any single threat group and instead remained widely distributed among a variety of threat actors, continuing the trend that began around August. Arete identified 31 unique named threat groups in October, the most observed in a single month so far in 2026. In addition to Akira, Settra, and The Gentlemen were among the three most active groups. Several new threat actors also emerged, including BYOD, Kubera Team, QWCrypt, AoQin, Emperador, Osiris Team, and Cinder, with Cinder assessed as possibly part of a threat actor cluster affiliated with the former BlackFile group.
Figure 1. Activity from the top 10 threat groups in October 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
PHP2Shell emerged as one of the most significant threats in October, with increasing exploitation of the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Other notable vulnerabilities included CVE-2026-104286 affecting FortiMail, and CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting SonicWall SMA1000 appliances, highlighting continued threat actor interest in internet-facing enterprise infrastructure.
International law enforcement operations against cybercriminal groups continued to make headlines in October. German authorities announced the arrest of 28-year-old Russian national Vladimir K., suspected of being a senior operator within the Qilin Ransomware-as-a-Service (RaaS) group. Separately, the FBI arrested an individual with suspected links to ShinyHunters, adding to recent law enforcement activity targeting ransomware and extortion groups, including the disruption of KillSec. While Vladimir K.’s arrest has not yet had a notable impact on Qilin’s operational activity, it could provide law enforcement with greater insight into the group’s infrastructure and affiliate network, potentially supporting further disruption efforts.
In early October, “The Luna Moth Files” exposed several files containing alleged internal communications associated with Luna Moth, also known as Silent Ransom Group, revealing insights into the group’s social engineering, data extortion, and victim negotiation operations. However, several claims remain unverified, and the exposure has not notably disrupted the group’s activity thus far, as it was among the top threat actors Arete observed throughout the month.
Sources
Arete Internal
Article
PHP2Shell Exploitation Update
PHP2Shell exploitation activity continues to increase globally, with threat actors targeting the critical PHP remote code execution (RCE) vulnerabilities CVE-2026-109618 and CVE-2026-109619. Researchers recently identified low-volume scanning targeting unpatched or partially mitigated hosts across multiple countries and sectors, and the activity is assessed with moderate confidence as linked to a Korean-speaking operator associated with the Lazarus Group ecosystem. While PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, the separately identified CVE-2026-115560 remains unpatched.
What’s Notable and Unique
PHP2Shell vulnerabilities can cause memory corruption due to improper error handling, potentially allowing threat actors to achieve remote code execution on vulnerable PHP servers.
Observed activity includes mass scanning, PHP environment fingerprinting, exploitation attempts, credential and secret theft attempts, and attempts to deliver second-stage payloads and malware.
Successful in-the-wild exploitation has also been reported against honeypots, resulting in shell command execution and the retrieval of additional payloads, demonstrating the potential for follow-on malicious activity.
Mitigations
Organizations should prioritize upgrading internet-facing PHP deployments to patched versions, migrating unsupported PHP versions, updating embedded and containerized PHP runtimes, and implementing available Web Application Firewall (WAF) protections as a temporary defense-in-depth measure.
Analyst Comments
PHP2Shell poses a significant security concern due to its potential to enable unauthenticated remote code execution on vulnerable PHP servers. The progression from mass scanning and exploitation attempts to reports of successful command execution demonstrates the potential for these vulnerabilities to support initial access and subsequent malicious activity. Arete has been closely monitoring PHP2Shell exploitation activity and regularly reviewing and updating related indicators to support detection and blocking efforts. Given the potential for remote exploitation and follow-on activity, PHP2Shell represents a high-priority initial-access risk, emphasizing the importance of timely patching and remediation of affected PHP environments.
Sources
PHP shares mitigation for new RCE vulnerability with no patch
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Article
LiteLLM Supply-Chain Compromise
A software supply-chain attack compromised the release pipeline of LiteLLM, a widely used open-source Python SDK and AI gateway. Attackers leveraged the compromised pipeline on October 21st to publish a malicious LiteLLM version through PyPI and associated Docker registries. The affected release, LiteLLM 1.107.0, contained malware designed to steal credentials, sensitive configuration data, private keys, browser information, and other secrets from compromised systems.
What’s Notable and Unique
The incident is particularly significant because LiteLLM provides a common API for applications to interact with AI models from multiple providers. It is reported that the project had approximately 61,800 GitHub stars and 92 million monthly PyPI downloads.
Rather than modifying the core LiteLLM application source code, the threat actors reportedly tampered with the installation package itself. The malware was designed for broad credential and information theft and encrypted the collected data before uploading it to the attacker's endpoint.
The compromise went beyond one-time credential theft. A malicious Python component launched a detached loader that checked a GitHub-hosted pointer every hour and could download Python code from an external server for execution on the compromised machine. This provided threat actors with a mechanism for subsequent remote code execution.
Analyst Comments
Although the malicious packages were subsequently removed, simply uninstalling or deleting the affected LiteLLM package may not be sufficient, because malicious Python startup files or the detached loader could remain on the host. All exposed information should be rotated immediately, and infected systems should be isolated and rebuilt from clean backups. The most recent clean release prior to the attack, LiteLLM 1.106.2, is currently the suggested recovery version.
Sources
LiteLLM release pipeline hacked to distribute info-stealer malware
LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials
The Collector Reaches Beyond Provider API Keys