INTEL-17: The Ecosystem Is Eating Itself

The INTEL  

For the first time in years, the biggest threat to a ransomware crew is another ransomware crew — and defenders should plan to make the most of the turbulence.

Intel 471’s 2026 outlook documents an extortion ecosystem in visible crisis:

• Insider leaks. Black Basta’s internal Matrix team chat logs spilled in mid-February 2025, exposing operator frustration that too few victims were paying — the clearest signal yet that the economic model is straining.
• Hostile takeovers. DragonForce compromised a rival’s leak site in March 2025 and moved on a second major program in April — affiliates are changing jerseys, infrastructure is changing hands.
• Anonymous vigilantism. A mystery actor defaced multiple leak sites with the note: “Don’t do crime. CRIME IS BAD. xoxo from Prague.” We smiled. We also took notes.
• Coordinated pressure from outside. Operation Endgame disrupted Rhadamanthys, VenomRAT, and the Elysium botnet environment in November 2025. Lumma infrastructure was seized earlier in the year. BreachForums — the primary underground marketplace for breached data — closed for good. Initial-access-broker activity dropped ~27% year over year, and 81% of access brokers operating in 2025 were new entrants — the criminal supply chain is rebuilding from scratch, not growing.
• Legislative squeeze. Mandatory ransomware and cyber-extortion payment reporting went live in Australia in May 2025; similar legislation is advancing in the UK. The payment-economics assumption is weakening.

Trust inside the adversary’s supply chain is at its lowest point in years. That is a defender window.

Why It Matters  

Group-name attribution is less reliable when brands rebrand weekly, affiliates switch programs, and programs get seized by rivals. Detection playbooks that lead with named-actor IoCs will age badly in 2026.

More importantly: this is the first strategic soft period the defender community has seen in years. Initial-access inventory is down. Payment pressure is up. Law enforcement is coordinated. Operators are distracted fighting each other.

That doesn’t make anyone safer by default. It means defenders have a narrow window to retest assumptions that haven’t been stressed since the threat was growing.

What To Do — One Key Action  

Retest your extortion response during the window, and lead with TTPs over IoCs.

Schedule a tabletop this quarter that simulates a modern extortion demand — one where the named group is rebranded mid-incident, the stolen data includes regulator-sensitive leverage, and the payment decision is time-boxed under mandatory-reporting rules you didn’t have last year. Score your communications plan, legal coordination, and recovery path — not your ability to identify the attacker by name. Attribution is getting noisier. Behavior-based detection (encryption patterns, credential dumping, anomalous API usage) is the durable investment.

MITRE ATT&CK  

• T1486 — Data Encrypted for Impact: Core extortion technique — detection should be behavioral, not signature-based
• T1657 — Financial Theft: The extortion payment pressure itself, now tracked under mandatory-reporting regimes in AU and (soon) UK
• T1078 — Valid Accounts: Credentials from disrupted info-stealers (Lumma, Rhadamanthys) continue to circulate in post-Endgame markets — assume exposure, detect behavior

Learn More  

• Intel 471 — 2026 Cyber Threat Trends & Outlook Report — Primary source
• FIR Risk Tuesday E88 — The Trust Audit — Full dual-report analysis
• FIR Risk INTEL-13 — Every Wall Has a Door — Structural shifts in the attack model
• FIR Risk INTEL-10 — The Ransomware Swarm — 109 groups, commodity toolkits

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.