Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief June 16, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today's brief is about what happens when law enforcement disrupts a major ransomware operation. Two years after taking down Lockbit's infrastructure, the skilled contractors who built the operation are now regrouping and launching their own competing programs. The result is a market consolidating around fewer, more capable threat actors. Here is what happened. Q1 2026 tracked 2,122 new ransomware victims on data leak sites. The second highest first quarter total on record. The market structure has shifted noticeably. The top 10 groups account for 71% of all recorded victims in the quarter, up from a much more fragmented ecosystem just two quarters earlier. Consolidation is the clear trend. Kill in Leeds with 338 victims. Lockbit 5.0 returned to fourth place with 163 victims. But the most significant movement came from two new programs. The Gentleman and High Flock. The Gentleman appeared in May 2026, claiming direct connections to Chilin's leadership. The founder, operating under Hasta La Muerte, originally left Chilin after a payment dispute and built the gentleman into one of the fastest growing programs in the space. In a single quarter, Q4 2025 to Q1-2026, the group grew from 40 victims to 166. That is a 315% increase. It is now the third largest ransomware program globally. The gentleman secured an official Breach Forums partnership in May, gaining direct access to a large community of access brokers and pen testers. The program's main pitch is attractive to affiliates, a 90% revenue share, 10 points above what Lockbit historically offered. The Locker runs without administrator rights, supports Windows, Linux, NAS, BSD, and ESXI. And includes a silent mode built to defeat common file rename detection. Each build auto-generates a ransom note with the affiliate's contact details, putting full negotiation control in their hands. Hiflock emerged at almost the same time, also claiming former LockBit and Chilin connections. The operator HyFLOC 123 positioned the program around fully integrated tooling. The panel bundles initial access purchasing, automated negotiation rooms, AI-based victim data analysis. And a red team available to assist affiliates during intrusions. Both programs advertise faster encryption and lower skill barriers than prior versions. HyFlock claims their encryptor runs roughly twice the speed of Lockbit 3.0, though no independent benchmarking has been performed to verify that. The backdrop is Operation Kronos, the law enforcement action that seized Lockbit's infrastructure in February 2024. That takedown scattered a large pool of skilled affiliates who were essentially independent contractors with nowhere to go. Two years on, those contractors appear to have regrouped and are now building their own operations instead of waiting for the old ones to recover. Here is what you do now. First, focus your ransomware detection efforts on early stage intrusion detection. Both HIFLOC and the gentleman advertised GPO-based spreading. So, group policy modification logs deserve close attention in any enterprise environment. A properly configured Windows Security Event log catching group policy object changes is often the earliest detectable signal in a ransomware attack. Second, isolate your cloud backup credentials from domain admin paths. HyFlock specifically targets active cloud backups as a means to prevent recovery options. Your cloud backup administrators should operate under completely separate credential chains from your domain administrators. Third, monitor for rapid partial write patterns from non elevated processes. The gentleman's silent mode does not change file names or modification dates, so traditional ransomware detection that focuses on extension changes will miss it. Watch for rapid writes to multiple files that are not changing their names or timestamps. Fourth, both programs target ESXI, Linux, and NAS hosts that frequently run without endpoint detection coverage. Ensure those systems receive the same level of threat intelligence and detection investment as your Windows infrastructure. The strategic lesson here is that major law enforcement actions create vacuum conditions, but they do not end the threat. Skilled operators with operational knowledge of encryption, ransom negotiation, and affiliate recruitment simply relocate and launch new programs. Verizon's 2025 data breach investigation report found that 54% of ransomware victims. Had domain credentials already listed in Steeler marketplaces before the ransomware attack began. That means the initial access chain was already compromised before the final encryption step. Credential monitoring, early intrusion detection, and restricting privilege paths remain your highest return defensive investments. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.