[CRITICAL] | CVSS v4.0 9.2 | No exploitation observed by Bitdefender | Patch immediately

[CRITICAL] | CVSS 10.0 (CVE-2026-105134, per VulDB) | Active exploitation confirmed, listed in CISA KEV | Patch immediately

CyberLeek positions itself as a financially motivated extortionist group, taking part in the theft of data and intellectual property to intrigue an audience and grow potential revenue streams in the process.

| CVSS 9.8 (out of 10) | Active exploitation confirmed | Patch to 6.9.5 / 7.0.2 immediately

I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.

Here is a ransomware trend that is becoming more frequent in 2026: The same victim organizations are posted twice, under two different flags. This is occurring frequently enough that we stopped treating it as a curiosity and went looking for the why behind this trend. We expected one answer, but we found at least five.Our team discussed this increasing trend during our Ctrl-Alt-DECODE ep. 10 livestream and in our monthly Threat Debrief, which ranks the most active ransomware groups and recent ransomware news. Now, let's take an in-depth look.

Why Are Leading Ransomware Groups Claiming the Same Victims?

I'd like to thank my co-author, Martin Zugec, for his valuable contributions to this report.

KryBit Ransomware Strikes Back, Exposing 0APT

[CRITICAL] | Active extortion campaign | Exposure window closed | Credential rotation and phishing defense required