Threat Intelligence Report Oct 13 - Oct 19 2026

Worldwide Ransomware Victims

The United States was the most affected country, accounting for 109 ransomware victims (38.25%) worldwide. Brazil and South Korea followed with 14 victims each (4.91%), while Canada, the United Kingdom, and Sweden each recorded 10 victims (3.51%). India reported 9 victims (3.16%), highlighting the continued impact of ransomware across major economies.

Among the other significantly affected countries, Germany and Japan recorded 7 victims each (2.46%). Australia, Spain, and Italy each reported 6 victims (2.11%). Taiwan, Thailand, Indonesia, and Singapore each accounted for 5 victims (1.75%), while Peru recorded 4 victims (1.4%).

Several countries reported smaller but notable numbers of ransomware victims. France and Switzerland each recorded 3 victims (1.05%), as did China, Ecuador, Mexico, Malaysia, and the United Arab Emirates. Egypt, Chile, Argentina, Morocco, Colombia, Saudi Arabia, and Türkiye each reported 2 victims (0.7%).

The remaining countries each recorded 1 ransomware victim (0.35%). These included Turkey, Hong Kong, the Netherlands, Kuwait, Vietnam, Norway, Mongolia, Bangladesh, the Philippines, Greece, Vanuatu, Ireland, Pakistan, Czechia, South Africa, Kazakhstan, Costa Rica, and Poland.

Cinder Ransomware

Group Overview

Red Piranha identifies Cinder as a data-extortion group, not an encrypting ransomware operation. Its leak site ('cinder', tagline 'unresolved mistakes kept here') carried its first listings on 20 August 2026. Trackers index it as iah6477 / Iah647. No encryptor, ransom note, file extension or sample exists; WatchGuard classes it as a data broker. [1][2][5]

Cinder does not appear to be a new actor. Arctic Wolf assesses with moderate confidence that it is a rebrand or continuation of an earlier extortion brand called Pink, because organisations listed on the Cinder leak site overlap with victims of phishing infrastructure attributed to Pink. Arctic Wolf tracks Pink, Cinder and the related brands BlackFile, Redact and Helix together under a single cluster identifier, PREY-0058; Google tracks the same activity as UNC6671. These are vendor tracking labels for one loosely connected group of cloud-extortion crews, not separate malware families. Arete reports that BlackFile renamed itself Redact in May 2026 and that Pink, Helix and Cinder then appeared as offshoots of that operation. Google and Microsoft have both published on this ecosystem, but neither names Cinder directly, and Arctic Wolf cautions that the brand names may represent affiliates or short-lived rebrands rather than one proven actor. Confidence in the lineage is therefore rated MEDIUM. [6][7][8]

No incident response report specific to Cinder has been published, so the intrusion method below is what Arctic Wolf and Microsoft have documented for the wider cluster Cinder belongs to. The operators do not break in with malware; they talk their way in. They telephone executives while posing as the company IT help desk and direct them to a fake Microsoft 365 sign-in page that silently relays the real login, capturing the password, the MFA approval and the resulting session token. That token is then replayed from residential proxy addresses, often in the victim’s own region, so the login looks like the executive working from home. Once inside the tenant, the actors map the Entra ID directory and SharePoint sites, then use scripted Microsoft Graph and HTTP clients to bulk-download SharePoint, OneDrive, Exchange mailboxes and any connected SaaS platforms. No endpoint malware and no lateral movement between hosts have been observed in these cases. The leak archives on Cinder’s site are consistent with this picture: every captured listing is organised as an entra_id\ directory and an m365\ directory, which is what a tenant-level cloud download produces rather than a file-server encryption. [1][6][9]

Extortion timeline: Cinder applies pressure through its leak site rather than through encryption. When a victim is added, the listing is first marked ‘soon’ with a countdown of roughly two to seven days; this is the window in which the victim is expected to pay. If no settlement is reached, the status changes to ‘public’ and the stolen data is packaged into a download bundle that anyone visiting the site can retrieve. The bundle stays available for a fixed hosting period: listings from August 2026 were published for about 30 days, while listings from October 2026 state that they will remain online for 365 days. [2][5][6]
Ransom: no Cinder-specific demand is public. Google reports ecosystem demands of 1 to over 3 million USD and settlements averaging about 750,000 USD. Largest single claimed volume: 4.2 TiB, with sixteen listings totalling about 17.9 TiB. Victims: almost all of the United States, led by manufacturing and food production, then professional services, retail, real estate and finance. [1][2][3][5][8]

Technical Analysis

There is no Cinder malware sample and no public incident-response report on a Cinder intrusion, so there is no binary to analyse, and no first-hand account of how the group operates inside a network. The attack path described below is therefore drawn from what Arctic Wolf, Google and Microsoft have documented for the PREY-0058/UNC6671 cluster that Cinder belongs to. We apply it to Cinder at MEDIUM confidence: the vendor evidence is strong for the cluster, and the layout of Cinder’s own leak archives matches what this method produces, but no vendor has yet traced a specific Cinder victim through the full chain. [6][8][9]

Initial foothold

Social engineering of staff by telephone, impersonating the IT help desk, leading to a credential-harvesting login page that also defeats MFA. No exploit, edge device or malware is involved. [6][8][9]

Access and persistence

Once the attackers hold a valid session, they sign in as the employee, but they do so through residential proxy services, which route their traffic through ordinary home internet connections in the victim’s own country or city. To Microsoft 365, the activity therefore looks like the employee working from home rather than a login from a foreign data centre, and location-based alerts are not triggered. To make sure they are not locked out when the stolen session expires, or the password is reset, the attackers register an additional MFA method of their own, such as a new authenticator app or passkey, on the compromised account. Because no malware is installed on any device, nothing is left for endpoint security tools to find; the only trace of the intrusion is in the account’s sign-in and audit logs. [6][8][9]

Discovery

With a working login in hand, the attackers’ next step is to find out what the tenant contains. They query the Entra ID directory to list users, groups and roles, and browse the SharePoint and OneDrive sites and mailboxes the compromised account can reach, building a picture of where the valuable data sits. Cinder’s own leak archives carry a fingerprint of this stage: every captured listing includes an entra_id\ directory of between 10 and 235 MB, which is the size and shape of an exported copy of the directory itself rather than of user files. [1][6][9]

 
Collection and exfiltration

The attackers then copy the data out in bulk. Rather than opening files one by one, they use scripted clients against Microsoft’s own APIs to pull entire SharePoint sites, OneDrive libraries, Exchange mailboxes and any connected business platforms, so a whole tenant can be drained in hours. Cinder’s leak pages show the scale: the seven in-window listings claim between 130 GiB and 2.6 TiB per victim, with file counts of up to 2.3 million. On every archive, the bulk of this sits in an m365\ directory, and one archive also contains folders named after a construction-management and a contract-management platform, which is what this stage produces when the victim has connected those services to its Microsoft tenant. No Cinder-specific network logs or transfer records have been published, so the volumes remain operator claims. [1][6][9]

Extortion

Extortion follows quickly. Across the cluster, the ransom email reaches the victim’s executives within hours of the theft, and the organisation is added to the Cinder leak site at the same time with a ‘soon’ countdown of two to seven days. Nothing is encrypted, and no systems are taken down; the only lever is the threat of publication. If the countdown expires without payment, the listing changes to ‘public’ and the data is bundled for download; listings from October 2026 state they will stay online for 365 days. [2][5][6]

MITRE ATT&CK Mapping

Only techniques with evidence on Cinder's own leak pages are mapped. The wider vishing and token-theft chain reported for the PREY-0058 / UNC6671 cluster is described in the Technical Analysis but is not attributed to Cinder here, because no Cinder-specific incident report exists. [1][2]

Indicators and Contextual Observables

Only the leak-site onion and its victim paths are specific to Cinder. Infrastructure published for the wider PREY-0058 cluster has not been tied to any named Cinder victim and is therefore not listed. Victim domains are not malicious infrastructure and are not listed. [1][2]

Leak-Site Captures

Public Platform Validation

Only results with a positive record are listed; the onion has no record on AlienVault OTX, ThreatFox, MalwareBazaar, URLhaus, ANY.RUN or Malpedia, and no sample or hash exists to query. [10]

Crystal Eye CE 6.0 Mitigation and Remediation

Cinder reaches victims through cloud identities rather than the network edge, so the Microsoft 365 applications in CE 6.0 carry most of the weight, with the gateway controls closing the phishing and egress paths.

• Enforce identity policy from Crystal Eye - Use M365 Policy Manager (Compliance Controls > Microsoft 365) to push Conditional Access across managed Entra ID tenants: require phishing-resistant MFA and compliant devices for Microsoft 365, block sign-ins from anonymizer, residential-proxy and hosting ranges, and review the policies on every tenant for consistency.
   
• Watch the identity telemetry where the intrusion shows - Use M365 Risk and Compliance: the Entra ID summary and User Audit dashboards for sign-in failures, password resets, MFA and user-property changes; the OneDrive and SharePoint dashboards for File Accessed and File Downloaded volumes per user and for Sharing Set events; the Mail Exchange dashboard for bulk mailbox operations; and the Threat Intelligence dashboard for high-confidence phishing against targeted users.
   
• Hunt Entra ID sign-in anomalies - Use the Microsoft Entra ID application and Azure Threat Hunting in the Threat Hunt Dashboard to review logon errors, sign-in locations and impossible-travel events, and unauthorised changes to users, groups, roles or applications.
   
• Escalate and respond - Forward Entra ID, Microsoft 365 and gateway events through Incident and Event Services (SIEM), use AI and Escalation Reports to escalate IDPS and AV alerts, and keep Incident Response Services configured so escalations reach the Security Operations Team under the agreed SLA.
   

Known Intelligence Gaps

• No victim statement, regulator notice or law-enforcement record confirms any of the seven claims, and no published bundle or file tree was captured to test the stated volumes. Victim names are withheld from this report by policy and are held in the analyst collection record.
   
• No Cinder-specific incident-response report exists; the intrusion chain is inherited from PREY-0058/UNC6671 reporting through a moderate-confidence lineage assessment. [6]
   
• No ransom demand, negotiation transcript, wallet or payment linked to Cinder is public; cluster-level figures from Google (demands of 1 to 3 million USD, average settlement about 750,000 USD) are not Cinder-specific. [8]

Source References