Threats Day: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories

Summary: A ransomware affiliate known as Azazel stole data from two dozen victims across six countries and then betrayed the Gentlemen ransomware-as-a-service operation by publishing the stolen data on his own leak site, Leakned, and keeping the extortion proceeds instead of routing them through the program. Separately, a 28-year-old Russian national alleged to be a core member of the Qilin ransomware group was arrested in Osaka in May and extradited to Germany on October 2, 2026, where he is wanted for hacking a logistics company in September 2024 and extorting more than $160,000 in cryptocurrency.
Why it matters: The affiliate model that lets ransomware operators scale also lets one of them pocket the proceeds and run a parallel leak site, so the gang's own revenue depends on trust it cannot enforce. The Qilin extradition shows that a single arrest can reach a core member years after the intrusion, which is the pressure that makes affiliates consider defecting in the first place.

Read the original at The Hacker News ↗