Eastern European Ransomware Groups Expand Use of Mercenary Spyware and Exploit Brokers

Introduction

In early 2026, Eastern European ransomware groups have significantly advanced their cyberattack methodologies by integrating mercenary spyware and exploit brokers into their operations. This strategic evolution has heightened the sophistication and impact of their attacks, presenting a critical threat to global cybersecurity.

Integration of Mercenary Spyware

Mercenary spyware, developed by private entities for surveillance purposes, has been increasingly adopted by cybercriminals. Notably, the Israeli company Cytrox has been implicated in providing such tools. Their spyware, known as Predator, has been used to target high-profile individuals, including politicians and journalists. In 2021, Egyptian exiles were found to have been targeted with Predator spyware, highlighting its use in politically motivated attacks. (itpro.com)

Eastern European ransomware groups have incorporated similar spyware into their arsenals. For instance, the pro-Russian hacktivist collective CyberVolk, which surfaced in May 2024, has been linked to the deployment of sophisticated surveillance tools in their attacks. (en.wikipedia.org)

Utilization of Exploit Brokers

Exploit brokers, or initial access brokers (IABs), play a pivotal role in the cybercriminal ecosystem by providing access to compromised networks. These brokers acquire access through various means, including exploiting zero-day vulnerabilities, and sell it to other cybercriminals or groups. The rise of exploit-as-a-service models has made such access more accessible and affordable for ransomware groups. (en.wikipedia.org)

Eastern European ransomware groups have increasingly relied on IABs to enhance their operational capabilities. By purchasing access to vulnerable networks, these groups can deploy ransomware more effectively, often bypassing traditional security measures. This approach has been observed in various attacks targeting organizations across Europe and the United States. (ics-cert.kaspersky.com)

Emergence of Surveillance-as-a-Service

The concept of surveillance-as-a-service has gained traction, with cybercriminals offering comprehensive surveillance solutions to clients. These services include the deployment of spyware, data exfiltration, and monitoring of targets. The integration of artificial intelligence (AI) into these services has further enhanced their effectiveness. For example, the AI-assisted Android malware SURXRAT V5 combines surveillance capabilities with ransomware functionalities, demonstrating the evolving nature of cyber threats. (securityonline.info)

Implications for Cybersecurity

The convergence of ransomware operations with mercenary spyware and exploit brokers signifies a troubling trend in cybercrime. This integration allows cybercriminals to conduct more targeted and effective attacks, often with political motivations. The use of surveillance-as-a-service models further complicates detection and mitigation efforts. Organizations must adopt a multi-layered security approach, emphasizing proactive threat hunting, regular vulnerability assessments, and comprehensive incident response plans to counter these sophisticated threats.

Conclusion

The early 2026 landscape reveals a critical escalation in cyber threats emanating from Eastern European ransomware groups. Their strategic incorporation of mercenary spyware and exploit brokers into their operations necessitates an urgent and coordinated response from the global cybersecurity community.

Highlights:

• The Week in Breach News: December 17, 2025 | Kaseya, Published on Tuesday, December 16
• Anomali Cyber Watch: GhostPenguin, SharePoint Exploits, Android Spyware, CastleLoader Malware Expansion, and more, Published on Monday, December 15
• Where NSO Group Came From — And Why It’s Just the Tip of the Iceberg | OCCRP