ctipilot.ch

Unsafe

actor · actor:unsafe-ransomware

Ransomware-as-a-service / double-extortion operator; relatively quiet through 2024–2025, re-emerged in 2026 with reported targets in Germany, the United States, Switzerland and France; in July 2026 claimed a Deutsche Bank breach that the bank attributed to a compromise at a German third-party marketing/incentive-platform vendor rather than its own network (Computing UK / Cybernews, 2026-07-07/09).

Coverage timeline
2
first 2026-07-09 → last 2026-07-12
Peak priority
notable
2 notable
Sources cited
8
6 hosts
Sections touched
2
active-threats, weekly-incidents-recap
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
4
pinned v19.2 · see below
2026-07-092 appearances2026-07-12

Hunting pivots

ATT&CK techniques
T1078.004T1190T1199T1567
Tags
data-breach ×2organized-crime ×2supply-chain ×2cloudransomware

ATT&CK techniques

4 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-12/weekly-w28-third-party-cloud-account-exposure · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-12/weekly-w28-third-party-cloud-account-exposure · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-07-12/weekly-w28-third-party-cloud-account-exposure · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-12/weekly-w28-third-party-cloud-account-exposure · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-12/weekly-w28-third-party-cloud-account-exposure · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-12/weekly-w28-third-party-cloud-account-exposure · ATT&CK page ↗

Exfiltration TA0010

T1567Exfiltration Over Web Service×1

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-07-12/weekly-w28-third-party-cloud-account-exposure · ATT&CK page ↗

Story timeline

  1. 2026-07-12This week's disclosures clustered on third-party, cloud-account and vendor exposure — the breach rarely started inside the victim
    weekly-incidents-recapW28 incidents cluster on third-party / cloud-account exposure — Accenture, Deutsche Bank vendor, KDDI, Nayax cloud account, Odido vishing, Nextcloud misconfig
  2. 2026-07-09Deutsche Bank confirms a third-party vendor incident after 'Unsafe' ransomware group posts alleged employee data
    active-threatsDeutsche Bank says its own network is untouched, pointing to a German marketing-platform vendor, after 'Unsafe' claims a breach and leaks employee records

Where this entity is cited

  • active-threats1
  • weekly-incidents-recap1

Source distribution

  • bleepingcomputer.com2 (25%)
  • cybernews.com2 (25%)
  • computing.co.uk1 (12%)
  • cybersecurity-insiders.com1 (12%)
  • politie.nl1 (12%)
  • sec.gov1 (12%)

explore in graph

All cited sources (8)

Entries about Unsafe (2)

2026-07-12 · view entry permalink →

NOTABLENATOB1

This week's disclosures clustered on third-party, cloud-account and vendor exposure — the breach rarely started inside the victim

Read as a set, the week's confirmed incidents point away from the classic perimeter-RCE story and toward exposure that lives in someone else's account, platform or supply chain.

The third-party / vendor strand: Accenture confirmed a data-theft incident after the handle "888" advertised roughly 35 GB of internal source code (BleepingComputer, 2026-07-08); Deutsche Bank disclosed a third-party-vendor incident after the "Unsafe" ransomware group posted claims (Computing, 2026-07-09); and KDDI named a zero-day in third-party email-platform software as the root cause of a breach affecting about 12 million people (BleepingComputer, 2026-07-09). The cloud-account strand: Nayax, a Bank-of-Lithuania-licensed EEA payment institution, disclosed a cloud-account incident (claimed by "The Syndicate") in its own SEC Form 6-K (Nayax, 2026-07-09); ShinyHunters' Odido (Netherlands telecom) breach drew a Dutch-national-involvement assessment from police voice analysis (Politie, 2026-07-08); and Nextcloud GmbH's own hosting infrastructure exposed roughly 367,000 internal records through a misconfigured public Elasticsearch (Cybernews, 2026-07-10).

Why the pattern matters for the constituency: several victims are directly relevant classes — an EEA-licensed payment institution, an EU telecom, a European cloud vendor — and the shared root cause is exactly the exposure a Swiss/EU public-sector or CI organisation inherits through its suppliers and cloud tenancy. The transferable lesson is that a mature internal patch posture does not cover a vendor's zero-day, a supplier's compromised account, or a misconfigured datastore in your own cloud footprint.

Builds on: 2026-07-08/accenture-confirms-data-theft-888-azure-devops-claim · 2026-07-09/deutsche-bank-unsafe-ransomware-third-party-vendor-incident · 2026-07-09/kddi-isp-email-breach-zero-day-root-cause-update · 2026-07-09/nayax-cloud-account-incident-the-syndicate-claim · 2026-07-10/odido-shinyhunters-vishing-dutch-police-attribution · 2026-07-10/nextcloud-gmbh-elasticsearch-exposure-msb-nrw

incident12 Jul 23:34Zmulti-sourceOpen finding ↗
Sources: BleepingComputer · Nayax Ltd. — SEC Form 6-K · Politie (Dutch National Police) · Computing (UK) · Cybernews

2026-07-09 · view entry permalink →

NOTABLENATOB2

Deutsche Bank confirms a third-party vendor incident after 'Unsafe' ransomware group posts alleged employee data

The ransomware/extortion group "Unsafe" listed Deutsche Bank on its dark-web leak site and published screenshots of alleged database exports, terminal commands and employee records — email addresses, password hashes, physical addresses — as proof of a claimed breach of the bank's "internal systems" (Cybernews, 2026-07-07; Cybersecurity Insiders, 2026-07-08). Deutsche Bank's own spokesperson, in a statement carried on 2026-07-08/09, said the incident did not involve the bank's own network but instead affected a third-party company in Germany that runs a marketing and incentive platform for the bank's sales partners, with "no indication that Deutsche Bank's internal systems or networks were or are affected" (Computing UK, 2026-07-09). Researchers assessing the leaked samples said the data appears to relate to bank employees but that they could not determine whether any customer information was included.

Unsafe operates a ransomware-as-a-service, double-extortion model; after a relatively quiet 2024–2025 it re-emerged in 2026 with reported targets in Germany, the United States, Switzerland and France — the same-actor reach into this constituency's home region being the reason the item is in scope rather than the victim's name. The actual initial-access vector into the German vendor has not been disclosed by any party, and generic secondary profiling of Unsafe's tooling should be treated as unverified for this specific intrusion.

"We have been informed of a cybersecurity incident at an external service provider," the spokesperson said, adding that there was "no indication that Deutsche Bank's internal systems or networks were or are affected" and no evidence of unauthorised access to the bank's network.

Computing (UK) 2026-07-09

Based on the available samples, it's not possible to determine whether customer data is included in the alleged breach

Cybernews 2026-07-07
incident09 Jul 12:35Zmulti-sourceOpen finding ↗
Sources: Computing (UK) · Cybernews · Cybersecurity Insiders