Ransomware Operators Keep Business Hours. The Data Proves It
2026-06-01T14:51:53Z•668a5b23dd43c396fb558609cb13e473b113f5e2e5edebfecf2b65515f95c539
CIFSwitchCISA-KEVdata-breachghost-cmsglobalprotectlinux-privilege-escalationpalo-alto-pan-osransomwareransomware-timing-analysisshinyhunterssignal-phishingsupply-chainwordpresswp-maps-pro
What happened
Collection of Security Affairs highlights: a traffic-analysis of 16,699 ransomware leak posts shows operators follow business hours (peaks in European afternoons, October spikes, ~84% drop Monday–Friday), and threat actors continue active leaks. Multiple high-impact vulnerabilities and incidents were reported: CVE-2026-8732 in WP Maps Pro allows unauthenticated creation of WordPress admin accounts (plugin ~15k installs; 2,858 attacks blocked in 24h); CVE-2026-0257 in Palo Alto PAN-OS (CVSS 7.8) is confirmed exploited and added to CISA's KEV; CIFSwitch — a 19‑year Linux logic bug — can escalate
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 668a5b23dd43c396fb558609cb13e473b113f5e2e5edebfecf2b65515f95c539
- Enrichment time
- 2026-06-01T14:51:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.