Infrastructure attribution exposes ransomware affiliates across RaaS brands

At a glance

What this is: This is a ransomware threat research roundup showing how infrastructure attribution, not group branding, can track the same affiliate across multiple RaaS operations and surface early warning signals.

Why it matters: It matters because defenders responsible for IAM, PAM, NHI, and SOC operations need to treat external-facing access surfaces, tooling fingerprints, and detection pipelines as a single governance problem, not separate incidents.

By the numbers:

• Silent Push flagged 91.107.247[.]163 as a Cobalt Strike C2 on February 8, 2026, 76 days before Check Point identified it in a The Gentlemen intrusion.
• Silent Push identified two Cobalt Strike watermarks, 1473793097 and 1357776117, tied to a single ransomware affiliate.

Context

Ransomware-as-a-Service makes the brand name less useful than the infrastructure behind it. Affiliates can move between groups, but their tooling, access patterns, and command-and-control choices often leave traces that defenders can follow.

Threat hunting works best when it is aimed at those traces rather than at group labels alone. In this case, the article is really about how attribution of infrastructure can shorten the window between first sighting and blocking.

Key questions

Q: What fails when ransomware affiliates move across multiple RaaS brands but keep the same infrastructure?

A: The failure is treating brand names as the primary investigative unit. Affiliates can switch between ransomware groups while preserving loaders, watermarks, and command-and-control patterns, so attribution built only on naming will miss continuity. Teams need to correlate infrastructure, tooling, and access patterns if they want reliable hunting and containment.

Q: Why do internet-facing VPN and firewall appliances remain such a common ransomware entry point?

A: They remain attractive because they sit at the boundary of remote access and trust. If those devices are exposed, weakly patched, or poorly monitored, attackers can turn them into authenticated footholds without needing to breach every internal control first. That makes them a high-value access surface, not ordinary network plumbing.

Q: How do security teams know if ransomware detections are catching the right stage?

A: Look for detections that fire before mass file encryption, especially on account creation, task scheduling, shadow copy deletion, and boot configuration changes. If alerts only appear after ransom notes or encrypted files, the controls are too late in the chain.

Q: What is the difference between tracking a ransomware group and tracking a ransomware affiliate?

A: A group label describes the operating brand, while an affiliate is the actor or crew using shared tooling and access to run campaigns. In RaaS ecosystems, the brand can change without the operator changing, so affiliate tracking is more useful for defenders who need continuity across campaigns and infrastructure reuse.

Technical breakdown

Why Cobalt Strike watermarks matter in ransomware tracking

Cobalt Strike beacons carry licence-related identifiers that can persist across separate campaigns and even across different RaaS brands when the same affiliate reuses tooling. That makes watermarks a practical attribution signal, because the operator can change infrastructure, malware packaging, or brand affiliation while keeping the underlying beacon lineage intact. In this article, Silent Push used those identifiers to connect activity across Black Basta, LockBit, Qilin, and The Gentlemen. The technical point is not that watermarks prove a full identity by themselves, but that they create a durable correlation layer for detection and enrichment. Practical implication: treat watermark matches as hunt leads that should be joined with domain, IP, and loader telemetry before you block or escalate.

Practical implication: Build hunt logic that correlates beacon fingerprints with infrastructure telemetry before analysts rely on actor labels.

How CountLoader changes the initial access picture

CountLoader is the sort of staging malware that matters because it is a delivery mechanism, not just a payload. The article notes three variants, .NET, PowerShell, and JScript, which suggests the operator wanted flexible execution paths and broader compatibility across environments. In ransomware operations, loaders often sit between the first foothold and the eventual command-and-control channel, giving attackers room to test, redirect, or swap payloads while keeping access alive. Silent Push ties CountLoader to the later Cobalt Strike activity, which is why the loader matters as part of the chain rather than as an isolated sample. Practical implication: hunting for loader families should be tied to process, script, and network artefacts, not signature-only malware checks.

Practical implication: Correlate loader execution with script and network telemetry so you can spot the pivot from foothold to C2.

Why exposed VPN and firewall appliances stay in the entry path

The article says The Gentlemen affiliates favour internet-facing VPN and firewall appliances as entry points. That matters because these systems sit at the boundary between identity, remote access, and network trust, so compromise can turn a perimeter control into an authenticated access path. When those devices are unpatched or unreviewed, they become a standing invitation for initial access even before malware is deployed. This is where identity and network security intersect: the attacker does not need to defeat every control if one externally reachable device still trusts weak or stale access. Practical implication: include edge appliances in the same exposure review cadence as privileged accounts and secrets because they often become the first control failure in the chain.

Practical implication: Treat edge appliances as privileged access surfaces and review them on the same cadence as high-risk credentials.

Threat narrative

Attacker objective: The objective is to maintain flexible, reusable intrusion infrastructure that supports ransomware deployment across multiple brands while delaying defender attribution and blocking.

1. Entry occurred through internet-facing VPN and firewall appliances that the article identifies as preferred access points for The Gentlemen affiliates.
2. Credentialed or session-backed footholds were then extended with CountLoader variants and Cobalt Strike infrastructure that enabled repeatable operator access.
3. The same tooling fingerprints followed the affiliate across multiple RaaS brands, supporting persistence and lateral reach across campaigns.
4. Impact was the ability to launch ransomware operations under interchangeable group names while defenders faced a delayed attribution picture.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Infrastructure attribution is the real control surface in RaaS investigations. Brand names change quickly in ransomware ecosystems, but infrastructure choices, loader behaviour, and beacon reuse create a more stable analytic trail. The article shows why defenders need to track the operator's technical footprint rather than waiting for public naming to catch up. Practitioners should treat infrastructure lineage as a first-class hunting object.

Standing trust in edge appliances is a recurring failure mode in ransomware access paths. The article's entry point is not a novel exploit story but a familiar governance gap: internet-facing devices are still treated as routine infrastructure instead of high-risk access surfaces. That is an identity problem as much as a network problem, because those devices often mediate authenticated remote access. The control failure is stale exposure management, not just patch lag.

CountLoader illustrates how initial access and payload staging blur together in modern ransomware tradecraft. Once a loader becomes reusable across PowerShell, JScript, and .NET execution paths, defenders need multi-source telemetry to see the handoff from foothold to C2. This is exactly the kind of chain that threat hunting programmes should be designed to expose. Practitioners should align detections to staging behaviour, not only to final ransomware execution.

RaaS makes governance of external access more dynamic than most programmes assume. The affiliate's movement across LockBit, Black Basta, Qilin, and The Gentlemen shows that actor continuity can outlast the service model around it. That should push security teams to re-evaluate how they correlate vendor, affiliate, and infrastructure identities in their telemetry. Practitioners should hunt by behaviour and infrastructure persistence, not by the label attached to the campaign.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Threat Hunting Guide

What this signals

Affiliate continuity is the practical threat here: a ransomware operator can move between brands faster than most security teams can reclassify the case, so defender value comes from correlating loaders, beacons, and access paths rather than waiting on public attribution.

Identity and access governance still matter at the perimeter. When VPNs and firewall appliances become entry points, the boundary between network security and privileged access management disappears. That means external exposure reviews need to include device trust, administrative access, and remote session controls, not just patch status.

28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026. That pattern reinforces a broader point for defenders: the highest-risk access problems increasingly sit in collaboration channels and operational tooling, not only in source control.

For practitioners

• Hunt for loader and beacon reuse across campaigns Correlate CountLoader variants, Cobalt Strike watermarks, and repeated C2 infrastructure to identify the same affiliate operating under different RaaS brands.
• Review internet-facing VPN and firewall exposure Prioritise patching and configuration review for edge appliances that provide remote access because the article identifies them as the preferred initial access path.
• Add C2 fingerprints to detection pipelines Push confirmed malicious IPs, domains, and beacon identifiers into firewall, SIEM, and EDR workflows so blocking happens before an intrusion matures.
• Correlate affiliate activity across RaaS brands Join infrastructure, malware, and access telemetry so an operator moving from LockBit to Qilin does not reset your investigation timeline.

Key takeaways

• The article shows that ransomware attribution is increasingly a matter of infrastructure and tooling continuity, not just public group names.
• Silent Push linked one affiliate across four ransomware brands using CountLoader, two Cobalt Strike watermarks, and early C2 detection.
• Defenders should treat edge appliance exposure, loader reuse, and C2 fingerprints as coordinated hunting signals rather than separate control issues.

Related NHI Mgmt Group resources: Threat Hunting Guide · Threat Intelligence Guide · SIEM Guide · Slack GitHub breach 2022

Key terms

• Ransomware-as-a-Service: A criminal operating model where ransomware developers provide tooling, infrastructure, and support to affiliates who carry out attacks. This model lowers the barrier to entry for attackers and increases scale, making identity-based entry points more attractive and more frequently targeted.
• Command and control infrastructure: The systems an attacker uses to send instructions to compromised hosts and receive data back. In malware operations, C2 is often built to survive takedowns, rotate domains, and hide inside normal network traffic so defenders cannot easily separate malicious from legitimate communication.
• Infrastructure Attribution: Infrastructure attribution is the process of linking domains, IP addresses, and related records to the organization that actually controls them. In passive DNS work, analysts combine historical resolution data with current scanning and context to separate owned assets from shared hosting or borrowed cloud services. It is a core input to third-party risk analysis.
• Threat Hunting: Threat hunting is the proactive search for signs of compromise that bypassed normal detection controls. It combines logs, telemetry, and investigator judgement to find hidden attacker behaviour before it becomes a larger incident or disrupts recovery.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs a stronger bridge between identity governance and operational security decisions.