Blacktail

Reports per quarter

CVEs named in reports

• CVE-2022-47966 KEV ransomware
• CVE-2022-47986 KEV ransomware
• CVE-2023-27350 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   Threat Signal Report | FortiGuard Labs

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Threat Signal Report | FortiGuard Labs

2. 6 April 2026

   Buhti Ransomware Gang Switches Tactics, Utilizes Leaked LockBit and Babuk Code - RedPacket Security

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Buhti Ransomware Gang Switches Tactics, Utilizes Leaked LockBit and Babuk Code - RedPacket Security

3. 6 April 2026

   Buhti: New Ransomware Operation Relies on Repurposed Payloads

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Buhti: New Ransomware Operation Relies on Repurposed Payloads

4. 6 April 2026

   New Buhti ransomware gang uses leaked Windows, Linux encryptors - RedPacket Security

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor New Buhti ransomware gang uses leaked Windows, Linux encryptors - RedPacket Security

Newest first. Details opens the report in Explore.