Over 7 a month period, a Qilin affiliate exposed 5 C2 servers -> OPSEC L
-> Sliver C2 / SOCKS running on WatchGuard devices
-> Initial access primarily via WG/Fortinet exploitation
-> 3 real victims found via Qilin blog
-> 🇺🇸 & 🇩🇪 targeting
-> 7+ CVEs used
Link to blog below👇
@AWEGroupe Your network has been compromised by a threat actor. Please contact myself or @ctrlaltintel and we will help you get rid of their malware (completely free of charge, of course).
Compromised machine hostname: cineyglpi
Malware process name: [mm_percpu_wq]
Today the FBI released a #PSA warning the public about Kali365—an emerging Phishing-as-a-Service (PhaaS) platform. Kali365, first seen in April 2026, enables cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication (MFA) protocols without intercepting the user’s credentials. The platform allows less-skilled attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.
Learn more about how the scam works and review recommendations on how to protect yourself: https://t.co/Ym8g4zRGNL
A Ctrl-Alt-Intel researcher, based out of HK 🇭🇰, tried to download @signalapp via Chrome.... but noticed something odd
The top 2 sponsored results were advertising likely malicious "Chinese versions" of Signal....
^ Above have been translated
We haven't analyzed the files any further as we are too busy, but wanted to share the suspicious findings with the community regardless!
If anyone has the time to dig into the payloads, we'd love to see what you find 👀
In total, over 3.7k messages were analysed from multiple channels in their Rocket[.Chat
We are not finished, some more interesting tradecraft to discuss. Blog maybe coming soon 😅
A little thread exposing screenshots + comms from the Gentlemen Leaks. These provide super interesting insight into the inside operations of successful RaaS groups.
Everything from aspects of operators personal lives, their TTPs, and victims. All images shared are from the Rocket[.Chat leak
We even discovered in March they attempted to send flowers to a UK-based victim....
On 28th Feb, they recognise they're "top 2" on https://t.co/hpPlgsz0wo + Devman has gone ;)🚓
Translation of zeta88's first message:
"In short, Devman was either taken in, for health reasons, or because of a rebranding—it all disappeared.
And we're top 2 on RansomLive based on statistics, but not based on profit, I think."
We can see a @GangExposed tweet shared by The Gentlemen, alongside the https://t.co/hpPlgsz0wo stats
On the 25th March, "zeta88" attempted to get fraudulent CC info in order to buy a bunch of flowers to send to a victim
This victim was apparently taking time to begin negotiations