Byer-Nichols Threat Brief for January 16-31 2026

Ransomware stayed hot in late January, with Cl0p jumping to the top after its huge Cleo linked victim dump, while Qilin, Akira, Sinobi and The Gentlemen kept pressure on manufacturing and mid market orgs. At the same time, exploitation of vCenter, SmarterMail, Zimbra, Ivanti EPMM and Fortinet gear drove a wave of opportunistic intrusions. Threat actors like Sandworm, Konni and ShinyHunters leaned on phishing, credential theft and stealthy C2, with Sandworm remaining the most worrying due to its destructive track record.