Article
The Hidden Costs of Cybercrime
Arete Analysis
By Kevin Baker, Director of Cyber Strategy and Defense
This year, the global cost of cybercrime is expected to hit $6 trillion.[i] Up from $3 trillion in 2015, it’s nothing short of a big, flourishing business whose operators are relentless innovators.
Since COVID, the FBI recorded a 300% increase in cybercrime[ii], with pandemic-related scams baiting people to click on malicious links or attachments. Even ransomware attacks have recently soared — in fact, one is said to be occurring every 11 seconds.[iii] And why not? It’s a lucrative business model!
In the past, kidnappers were always caught at the money-transfer point. But digital currency changed all that, facilitating anonymous handoffs. With Bitcoin, for example, organizations can no longer trace ransoms back to individuals and threat actors can sit in Russia, Eastern Europe, China, Brazil, the United States, often where they may be protected from extradition.
The Evolution of Ransomeware
Ransomware began as a game of keep away. The bad guys didn’t have to steal anything; they simply denied companies or individuals access to their data. This tactic worked well until companies caught on and started to move their backups offline, so they could restore their critical systems without having to pay the ransom.
Like legitimate businesses, cybercriminals looked to pivot, innovate, and find new revenue streams. When encryption alone began to fail, they concocted the double extortion scheme, whereby they opted to encrypt and exfiltrate data. First, they demanded payment for decrypting the stolen data. Next, they asked for a second payment to prevent its public release.
Depending on the sensitivity of the data stolen, companies had to weigh the potential reputational damage related to its exposure along with the broken client trust of not protecting it in the first place.
A Case Study in Costs
In a 2019 Radware survey[i], 43% of participants said they’d experienced negative customer trust and reputational loss because of a successful cyberattack.
Let’s examine the SolarWinds attack. Dubbed the Pearl Harbor of American IT, the SolarWinds hack impacted 18,000 government and private networks. That’s a lot of customers to have mad at you.
SolarWinds had been a reputable, long-time provider of IT monitoring services. But immediately after the hack, its stock price tanked, presumably due to the potential for reputational damage, material loss of customers, a slowdown in business performance, and high remediation and legal costs.
It’s easy to think that only big companies are targets — Microsoft was also recently hacked — but cybercriminals are often emboldened by such successful hacks. While advanced persistent threat actors may not hit smaller targets themselves, they have no qualms about selling their proven exploit methods to other players in the threat actor marketplace. Often, the smaller, less sophisticated players are willing to take smaller pay days.
Thus, no matter an organization’s size and scope of activities, it will be targeted, baited, and attacked.
So, Let's Count the Costs
The direct cost of exploitation includes remediation, repair, restoration of data and IT infrastructure, ransom payment, and legal counsel to help navigate through these complex problems. And if a breach notification to customers is required, those costs can quickly skyrocket, especially depending on how much personally identifiable information (PII) may have been lost.
Not to be forgotten is the cost of business downtime. While production ceases, organizations must continue to pay salaries, rent, the electric bill, the telephone bill, all the normal operating expenses. None of these go away while organizations are trying to restore operations.
Next, there are the indirect costs of reputation damage and lost customer trust, which impacts the ability to gain future customers. There’s also the potential for litigation defense costs should customers decide to sue for what they believe was a failure to protect information that a company had pledged to protect. On top of all that, multiple state attorneys general, the Federal Trade Commission, the Security Exchange Commission, and other regulators may fine the “hacked” company.
And lastly, insurance rates go up. It’s a bit different than with car insurance. For cyber carriers, there’s less actuarial science available and thus, increases go up faster than they would in any other form of insurance right now.
In a worst-case scenario, if the sum proves too high, a company could confront the greatest cost of all: going out of business.
[i] Radware Report Shows That Respondents Claim Average Cost of Cyberattack Now Exceeds $1 Million
[i] Cybercrime to Cost the World $10.5 Trillion Annually By 2025 (cybersecurityventures.com)
[ii] COVID-19 News: FBI Reports 300% Increase in Reported Cybercrimes – IMC Grupo
[iii] Ransomware Attacks Predicted to Occur Every 11 Seconds in 2021 with a Cost of $20 Billion | Robinson+Cole Data Privacy + Security Insider – JDSupra
Back to Blog Posts
Article
Ransomware Trends & Data Insights: October 2026
Although Akira once again emerged as the most active ransomware group in October, overall ransomware and extortion activity was not dominated by any single threat group and instead remained widely distributed among a variety of threat actors, continuing the trend that began around August. Arete identified 31 unique named threat groups in October, the most observed in a single month so far in 2026. In addition to Akira, Settra, and The Gentlemen were among the three most active groups. Several new threat actors also emerged, including BYOD, Kubera Team, QWCrypt, AoQin, Emperador, Osiris Team, and Cinder, with Cinder assessed as possibly part of a threat actor cluster affiliated with the former BlackFile group.
Figure 1. Activity from the top 10 threat groups in October 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
PHP2Shell emerged as one of the most significant threats in October, with increasing exploitation of the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Other notable vulnerabilities included CVE-2026-104286 affecting FortiMail, and CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting SonicWall SMA1000 appliances, highlighting continued threat actor interest in internet-facing enterprise infrastructure.
International law enforcement operations against cybercriminal groups continued to make headlines in October. German authorities announced the arrest of 28-year-old Russian national Vladimir K., suspected of being a senior operator within the Qilin Ransomware-as-a-Service (RaaS) group. Separately, the FBI arrested an individual with suspected links to ShinyHunters, adding to recent law enforcement activity targeting ransomware and extortion groups, including the disruption of KillSec. While Vladimir K.’s arrest has not yet had a notable impact on Qilin’s operational activity, it could provide law enforcement with greater insight into the group’s infrastructure and affiliate network, potentially supporting further disruption efforts.
In early October, “The Luna Moth Files” exposed several files containing alleged internal communications associated with Luna Moth, also known as Silent Ransom Group, revealing insights into the group’s social engineering, data extortion, and victim negotiation operations. However, several claims remain unverified, and the exposure has not notably disrupted the group’s activity thus far, as it was among the top threat actors Arete observed throughout the month.
Sources
Arete Internal
Article
PHP2Shell Exploitation Update
PHP2Shell exploitation activity continues to increase globally, with threat actors targeting the critical PHP remote code execution (RCE) vulnerabilities CVE-2026-109618 and CVE-2026-109619. Researchers recently identified low-volume scanning targeting unpatched or partially mitigated hosts across multiple countries and sectors, and the activity is assessed with moderate confidence as linked to a Korean-speaking operator associated with the Lazarus Group ecosystem. While PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, the separately identified CVE-2026-115560 remains unpatched.
What’s Notable and Unique
PHP2Shell vulnerabilities can cause memory corruption due to improper error handling, potentially allowing threat actors to achieve remote code execution on vulnerable PHP servers.
Observed activity includes mass scanning, PHP environment fingerprinting, exploitation attempts, credential and secret theft attempts, and attempts to deliver second-stage payloads and malware.
Successful in-the-wild exploitation has also been reported against honeypots, resulting in shell command execution and the retrieval of additional payloads, demonstrating the potential for follow-on malicious activity.
Mitigations
Organizations should prioritize upgrading internet-facing PHP deployments to patched versions, migrating unsupported PHP versions, updating embedded and containerized PHP runtimes, and implementing available Web Application Firewall (WAF) protections as a temporary defense-in-depth measure.
Analyst Comments
PHP2Shell poses a significant security concern due to its potential to enable unauthenticated remote code execution on vulnerable PHP servers. The progression from mass scanning and exploitation attempts to reports of successful command execution demonstrates the potential for these vulnerabilities to support initial access and subsequent malicious activity. Arete has been closely monitoring PHP2Shell exploitation activity and regularly reviewing and updating related indicators to support detection and blocking efforts. Given the potential for remote exploitation and follow-on activity, PHP2Shell represents a high-priority initial-access risk, emphasizing the importance of timely patching and remediation of affected PHP environments.
Sources
PHP shares mitigation for new RCE vulnerability with no patch
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Article
LiteLLM Supply-Chain Compromise
A software supply-chain attack compromised the release pipeline of LiteLLM, a widely used open-source Python SDK and AI gateway. Attackers leveraged the compromised pipeline on October 21st to publish a malicious LiteLLM version through PyPI and associated Docker registries. The affected release, LiteLLM 1.107.0, contained malware designed to steal credentials, sensitive configuration data, private keys, browser information, and other secrets from compromised systems.
What’s Notable and Unique
The incident is particularly significant because LiteLLM provides a common API for applications to interact with AI models from multiple providers. It is reported that the project had approximately 61,800 GitHub stars and 92 million monthly PyPI downloads.
Rather than modifying the core LiteLLM application source code, the threat actors reportedly tampered with the installation package itself. The malware was designed for broad credential and information theft and encrypted the collected data before uploading it to the attacker's endpoint.
The compromise went beyond one-time credential theft. A malicious Python component launched a detached loader that checked a GitHub-hosted pointer every hour and could download Python code from an external server for execution on the compromised machine. This provided threat actors with a mechanism for subsequent remote code execution.
Analyst Comments
Although the malicious packages were subsequently removed, simply uninstalling or deleting the affected LiteLLM package may not be sufficient, because malicious Python startup files or the detached loader could remain on the host. All exposed information should be rotated immediately, and infected systems should be isolated and rebuilt from clean backups. The most recent clean release prior to the attack, LiteLLM 1.106.2, is currently the suggested recovery version.
Sources
LiteLLM release pipeline hacked to distribute info-stealer malware
LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials
The Collector Reaches Beyond Provider API Keys
Article
French Supermarket Cyberattack Highlights Risks in Exposed Refrigeration Controllers
Hundreds of French supermarkets were reportedly affected by a cyberattack in which threat actors compromised internet-connected refrigeration controllers and manipulated temperature and defrost settings, which caused refrigeration units to overheat, resulting in widespread food spoilage and significant financial loss. Impacted refrigeration systems were associated with Danfoss, Copeland, and Dixell, and demonstrated how vulnerabilities in industrial control systems (ICS) can disrupt physical operations without relying on conventional data theft or encryption. The attack also raised concerns about the wider exposure of similar devices, as thousands of refrigeration management interfaces remain accessible from the public internet. The incident highlights the growing risk posed by insecure operational technology (OT), particularly where legacy equipment and remote-management interfaces lack adequate security controls.
What’s Notable and Unique
Researchers identified approximately 2,765 internet-accessible Danfoss AK-SM 800A interfaces during assessment. This figure reflects the scope of that research and should not be interpreted as a current count of exposed devices. Publicly accessible management interfaces increase the opportunity for unauthorized access to industrial equipment.
Research also identified several security flaws in the Danfoss AK-SM 800A platform, including an authentication bypass command injection that could enable remote code execution and a weakness involving web-server configuration changes. Danfoss addressed these findings through firmware updates.
Authorities reported compromised Danfoss AK-SM and AK-SC systems, alongside Copeland XWEB and Dixell XWEB monitoring platforms.
Analyst Comments
The incident demonstrates the business consequences of insufficiently secured industrial infrastructure and reinforces the need to integrate OT security into enterprise risk management. Organizations operating connected facility systems should establish clear ownership of industrial assets, enforce secure remote-access policies, and prioritize remediation based on exposure and operational criticality. The findings also highlight the importance of coordinating security teams with facilities and engineering personnel to ensure that protective measures do not compromise essential operations. A risk-based approach to OT security can help organizations reduce exposure while maintaining the availability and reliability of critical equipment.
Sources
France Supermarket Hacks Expose Risks of Internet-Facing Refrigeration Systems
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers