---

📋 EXECUTIVE SUMMARY

---

📊 METRICS & INTELLIGENCE

Metric	This Week	What It Means
Total Disclosed Victims	97	Volume steady for a third week; attention shifted to new sectors
Active Threat Actors	27	Fragmentation holding; no single actor dominates
Legal Sector Hits	16 (↑ sharply)	Highest single-sector count of 2026; likely coordinated
US-Based Victims	23 (24%)	Settled between April 6 (8%) and April 13 (32%)
Top Actor Share	12.4% (Qilin)	Far more distributed than last week's 17.5% leader share

Germany (7), UK (6), Brazil (4), and France (4) followed the US.

---

🚨 ACTIVE CAMPAIGNS

What it does: An attacker creates a fake Microsoft 365 tenant, sends a Teams chat posing as IT support, and convinces your employee to launch Quick Assist (Windows' built-in remote-support tool). Once they accept, the attacker has desktop access, pivots through WinRM, a built-in tool for remotely controlling Windows servers, to reach domain controllers, and uses Rclone to exfiltrate data to cloud storage.

Why it matters: Every firewall, endpoint tool, and MFA prompt gets bypassed because the employee cooperates at each step. Any employee who can receive external Teams messages can become an entry point.

Source: Microsoft Security Blog

What it does: Attackers found a way to inject phishing content into Apple's legitimate account-change notifications. The messages genuinely come from [email protected] and pass every email authentication check (SPF, DKIM, DMARC). The embedded links redirect to credential-harvesting pages.

Why it matters: Your email security tools won't flag these, the sender is authentic. User training has to shift from "watch for typos" to "never click links in account alerts; go directly to the service."

Source: BleepingComputer

What it does: France's National Agency for Secure Documents, handler of passports, ID cards, residence permits, and driver's licenses, detected a security incident on April 15. The Interior Ministry confirmed exposure of login IDs, names, email addresses, dates of birth, and unique account identifiers; some records also include postal addresses and phone numbers. A forum seller claims 18–19 million records; that figure is unverified.

Why it matters: If you onboard French customers or employees using government ID, expect an uptick in fraud using legitimate-looking credentials. Consider secondary verification for new French applicants through late 2026.

Source: The Record, Security Affairs

---

✅ JUST DO THIS

Why now: The Teams impersonation campaign only works if outside tenants can message your employees. Restricting external Teams access breaks the attack at step one. Most SMBs have no legitimate party who needs to reach employees through Teams, email and phone suffice.

Platform	Steps
Microsoft 365	Teams Admin Center → Users → External access → Set to "Block all external domains" OR "Allow only specific external domains" → Add trusted partner domains only → Save
Google Workspace	Admin Console → Apps → Google Chat → External chat settings → Restrict to approved domains, or disable external chat entirely
Other	Audit every chat/collaboration tool for external messaging defaults. The rule: deny by default, allow by exception

Verify it worked: Ask someone outside your organization to send one of your employees a Teams message. It should be blocked outright or require admin approval before delivery.

---

🎯 THREAT ACTOR SPOTLIGHT

What happened: Germany's federal police (BKA) publicly identified Daniil Maksimovich Shchukin, 31, as "UNKN"/"UNKNOWN" — leader of GandCrab and REvil from 2019–2021. This is the first time authorities have publicly named the top operator of a major ransomware-as-a-service program.

Why it matters: Shchukin is believed to live in Russia and won't face arrest. The extradition math hasn't changed. What changed is the message to every active operator: your real name has a shelf life.

What to expect from active crews:

• Shorter dwell times. More smash-and-grab attacks; speed to cash over long-term pressure.
• More rebranding. Operators recycle brand names faster to muddy the attribution trail.
• Harder negotiations. Tighter deadlines, less multi-round haggling, faster leaks.

Defensive Priorities:

#	Action	Plain English
1	Offline backup verification	Confirm backups the attacker can't reach, and test restoring this quarter
2	Incident response plan refresh	Faster attacks mean your plan needs to work in hours, document who calls whom first
3	Cyber insurance review	Confirm double-extortion coverage is explicit; check ransom payment exclusions

---

🏭 SECTOR TARGETING

Legal Services — 16 victims 🏪 SMB PRIORITY

Threat actors: The Gentlemen, Leakeddata, Qilin, Payload, Safepay, Pear

Notable incidents: Jones Day (US), Harris Beach Murtha (US), Goulston & Storrs (US), Philip Lee LLP (Ireland), GUEGUEN Avocats (France), Roger D. Mason II P.A. (Florida)

Why the surge: Leakeddata posted 11 law firms in a single April 17 batch. A drop that size typically means either a shared vulnerability in practice-management software or a compromised service provider (document management, e-billing, e-discovery) sitting upstream.

Healthcare — 6 victims 🏪

Threat actors: Blackwater, Qilin, Dragonforce, The Gentlemen, Termite, Kairos

Notable incidents: Minidoka Memorial Hospital (Idaho, under active 7-day Blackwater countdown), Laboratório Santa Luzia (Brazil), Millennium Dental Technologies (US)

Financial Services — 5 victims 🏭

Threat actors: Prinz Eugen, Everest, Qilin

Notable incidents: Standard Bank Group (South Africa), Frost Bank (US), Citizens Bank (US). Attackers claim 1.2TB exfiltrated from Standard Bank; not independently verified.

Real Estate / Property Management — 5 victims 🏪

Threat actors: Lamashtu, Payload, Kairos, INC Ransom

Notable incidents: Jesin Group (Malaysia), Better House (Egypt), Strata Republic (Australia)

---

🏪 SMB REALITY CHECK

If you're under 50 employees with no dedicated security staff, here's what actually matters this week:

The Teams impersonation threat is the one to focus on, and it's manageable once everyone knows one rule: your company will never ask anyone to grant remote access through an unexpected Teams message, email, or phone call. If it happens, hang up and call IT directly. Say it out loud in a team meeting this week.

The Apple phishing emails affect everyone with an Apple ID. One rule: if you get an email about an Apple purchase or account change, open a new tab and go directly to appleid.apple.com. Never click the email link. This week the sender actually is real.

Your Stack, Your Actions:

If You Use...	Do This	Time
Microsoft 365 or Google Workspace	Restrict external chat — trusted partner domains only, or disable	10 min
Any remote support tool	Create a verbal code phrase; share in-person, never email	30 min
Law firm	Call practice-management vendor; verify offline backups	20 min

Safe to ignore this week: The France ANTS breach (unless you onboard French customers), the REvil leadership story, and the ShinyHunters enterprise deadline claims.

---

🔮 LOOKING AHEAD

The Anonymity Arbitrage Is Closing — And Attacks Will Speed Up

Every ransomware crew operates on an assumption: their real identities stay hidden long enough to enjoy the money. The REvil/GandCrab unmasking is a crack in that assumption. The named operator is safe from extradition, but the naming is the message, every active operator has to assume the clock is ticking on their own anonymity.

What to watch: Faster initial-access-to-encryption timelines (hours, not days). Shorter negotiation windows, more "pay in 48 hours or we publish" ultimatums. More rebranding as operators burn through names.

Bottom line: Your incident response plan needs to assume hours, not days. The 2023-era playbook, engage insurer, hire responders, start negotiations, can't keep up. Pre-negotiated retainers now matter more than the dollar limit on your policy.

---