Topic starter
25/10/2026 11:07 am
TL;DR: Ransomware infrastructure continuity, Silent Push found, linked one affiliate across LockBit, Black Basta, Qilin and The Gentlemen by tracing CountLoader, two Cobalt Strike watermarks and a 76-day lead on a known C2 IP. Hunters need to correlate loaders, watermarks and command-and-control patterns instead of treating each brand as a separate case.
Editorial analysis by NHI Mgmt Group, based on content published by Silent Push: “What Recent Reporting Gets Right About The Gentlemen RaaS and What Silent Push Learned Months Earlier”.
By the numbers:
- Silent Push flagged 91.107.247[.]163 as a Cobalt Strike C2 on February 8, 2026, 76 days before Check Point identified it in a The Gentlemen intrusion.
- Silent Push identified two Cobalt Strike watermarks, 1473793097 and 1357776117, tied to a single ransomware affiliate.
Key questions
Q: Why do internet-facing VPN and firewall appliances remain such a common ransomware entry point?
A: They remain attractive because they sit at the boundary of remote access and trust.
Q: How do security teams know if ransomware detections are catching the right stage?
A: Look for detections that fire before mass file encryption, especially on account creation, task scheduling, shadow copy deletion, and boot configuration changes.
A: The failure is treating brand names as the primary investigative unit.
Practitioner guidance
- Hunt for loader and beacon reuse across campaigns Correlate CountLoader variants, Cobalt Strike watermarks, and repeated C2 infrastructure to identify the same affiliate operating under different RaaS brands.
- Review internet-facing VPN and firewall exposure Prioritise patching and configuration review for edge appliances that provide remote access because the article identifies them as the preferred initial access path.
- Add C2 fingerprints to detection pipelines Push confirmed malicious IPs, domains, and beacon identifiers into firewall, SIEM, and EDR workflows so blocking happens before an intrusion matures.
Bottom line: The article shows that ransomware attribution is increasingly a matter of infrastructure and tooling continuity, not just public group names.
Glossary terms: Infrastructure Attribution, Ransomware-as-a-Service, Command and control infrastructure, Threat Hunting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Infrastructure attribution is the real control surface in RaaS investigations. Brand names change quickly in ransomware ecosystems, but infrastructure choices, loader behaviour, and beacon reuse create a more stable analytic trail. The article shows why defenders need to track the operator's technical footprint rather than waiting for public naming to catch up. Practitioners should treat infrastructure lineage as a first-class hunting object.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between tracking a ransomware group and tracking a ransomware affiliate?
A: A group label describes the operating brand, while an affiliate is the actor or crew using shared tooling and access to run campaigns. In RaaS ecosystems, the brand can change without the operator changing, so affiliate tracking is more useful for defenders who need continuity across campaigns and infrastructure reuse.
👉 Read our full editorial: Infrastructure attribution exposes ransomware affiliates across RaaS brands
This post was modified 7 days ago by NHI Mgmt Group