SANS Stay Ahead of Ransomware August 2026: Hot Off the Press

On the August 2026 episode of SANS Stay Ahead of Ransomware, we were joined by special guest Sean O’Connor, the author of SANS FOR589: Cybercrime Investigations and host of the SANS Threat Analysis Rundown (STAR). In this episode, Ryan and I each chose some recent ransomware-related articles and reports to break down and discuss with Sean. The first report was the Qilin (Agenda) Ransomware: Cyber Threat Intelligence Report by the Centre for Cybersecurity Belgium. Since 2023, Qilin has consistently ranked among the top five most active ransomware groups, with 2025 showing particularly high numbers of victims. The report identified several high-profile affiliates working with Qilin, including MuddyWater, Scattered Spider, The Gentlemen, and DragonForce. Qilin's initial access methods follow familiar patterns which include spear phishing, exploitation of public-facing services, VPN brute forcing, and MFA bombing. However, the discussion highlighted two particularly concerning trends: abuse of Remote Monitoring and Management (RMM) tools and deployment of EDR Killers. The second article was Michael Clark’s JADEPUFFER: Agentic ransomware for automated database extortion. This was the first documented agentic ransomware attack targeting databases for automated extortion. The attack exploited a critical-severity vulnerability in Langflow (CVE-2025-3248), with the entire operation conducted by an AI agent and no human at the keyboard. We discussed how researchers and responders can determine whether what they are seeing is AI or a human threat actor, with key examples including:

• Extensive code commenting: Unlike human developers who typically skimp on documentation, LLM-generated code features thorough, well-structured comments.
• Emoji usage patterns: AI models often include emojis in output that human programmers wouldn't typically add.
• Syntactic uniformity: AI follows consistent formatting standards (like Python's PEP 8) more than humans do.
• Response speed: The agent pivoted and troubleshot issues in seconds, which is much faster than human reaction time.

Sean connected this to traditional authorship analysis techniques, noting that FOR589 covers stylometry and syntactics for linking personas across underground forums. "What you're describing is just the AI version of authorship analysis," he observed. Despite the novelty, we all agreed that AI-powered attacks don't fundamentally change defensive strategies. "If your exposure management program was working, whether it's agentic or not is irrelevant," Sean noted.

The core recommendations remain the same:

• Patch known vulnerabilities promptly
• Deploy runtime threat detection and EDR
• Harden software configurations
• Avoid exposing administrative interfaces to the internet

The primary difference was that attacks happen faster, compressing the window for detection and response. The third and final article we discussed was The Gentlemen Ransomware Group — Leak Analysis. Ryan highlighted research from Ransom-ISAC examining leaked data from The Gentlemen ransomware group. These leaks, which contained internal communications and operational details, provide invaluable intelligence for defenders. The leaked data revealed tools in the group's arsenal, including:

• NXC: a successor to CrackMapExec
• Velociraptor: a legitimate security tool being repurposed by attackers
• Rclone: used with Mega.nz for data exfiltration
• Tor browser: for anonymized communications

Sean emphasized the importance of extracting actionable intelligence from such leaks, which includes mapping TTPs, identifying victimology patterns, and discovering selectors (passwords, crypto addresses, or personas) that can support technical disruption or law enforcement action. Join us for the next SANS Stay Ahead of Ransomware livestream on the first Tuesday in September at 1:00 PM Eastern / 10:00 AM Pacific. Also, don’t forget to mark your calendars for the SANS DFIR Summit in October 2026, featuring tracks on digital forensics, incident response, threat hunting, and ransomware. The summit will also debut the newly updated FOR528: Ransomware and Cyber Extortion course!