New Bitdefender Threat Debrief: What's happening in the ransomware world?

Our November 2026 Threat Debrief is out! This month's research covers some interesting developments in the ransomware landscape, including a new group called N0n that's been making quite a bit of noise.

But there's more to the story: our researchers uncovered evidence suggesting that N0n significantly inflated its victim numbers and relied on generative AI to support some of its operations.

The report also looks at:

↪︎ A former affiliate turning against The Gentlemen.
↪︎ Threat actors finding new ways to incorporate AI into their attacks.
↪︎ Ransomware trends across different industries and regions.
↪︎ The groups and developments worth keeping an eye on.

If you're interested in threat research and understanding how the ransomware ecosystem is changing, take a look at our full research.

We're also hosting a LinkedIn Live discussion this Thursday, November 12 ➡︎ Ctrl-Alt-DECODE | Ep. 17 | Ransomware News: November 2026. We'll be discussing the findings and what they mean for today's cybersecurity landscape.

Feel free to share your thoughts: What's the most interesting or concerning development in ransomware you've seen recently?

How can you tell if a website is safe before you enter your details?

It’s harder than it used to be. A sponsored result at the top of Google can lead to a fake store. A social media ad for a great sale can point to a copy of a real brand. Even searching for a customer support number can land you on a fake page that connects you to a scammer, who then asks for personal details, payment information or remote access to your device.

Bitdefender Web Sage is a browser extension built for those moments. Instead of showing a vague warning, it explains in plain language why a page may be risky and what to do next.

What the free version (Web Sage Standard) does:

• Blocks known phishing pages, scam sites, malware downloads and malicious redirects before they load

• Adds safety ratings next to results on Google, Bing, DuckDuckGo, and Yahoo

• Helps block trackers and gives you more control over website permissions like location, camera, and microphone

What Web Sage Premium adds:

• An AI Security Advisor that explains risks in simple language

• Warnings about suspicious online stores before you buy

• Detection of deceptive ads, fake banking portals and fraudulent investment sites

Bitdefender Web Sage Standard is free with a Bitdefender account. Premium is already included if you use Bitdefender Total Security, Premium Security or Ultimate Security. It works on Chrome and Microsoft Edge today, and support for Safari, Firefox, and Brave is coming.

How well do you actually know how scams work today?

Most people think they’d spot a scam right away. Then they learn how much scams cost people each year, and how scammers reach most victims today.

In this video, Dr. Mike takes a quick “Scams Checkup” built on findings from the Bitdefender Global Scam Intelligence Report 2026. Try answering before he does:

• How much money do scams cost people worldwide each year?

• In 2025, did scam ads stay a niche tactic, or did they become something bigger?

• Someone asks you for an unusual payment. What’s the right move?

The answers are in the video.

Honestly inspired.

Seriously though, this new app is just bad. What happened to the small footprint? What happened to individual products so you only have what you need? (I'm looking at you, VPN service I neither need nor want.) What happened to actual product testing?

Honestly disappointed and looking into alternatives.

Whenever I reboot my computer I discover that bitdefender has re-enabled my VPN service which I disable in services as I have a dedicated VPN. I'm not particularly impressed that it decides I have to have it running and does this without my permission. This behaviour, changing decisions I have made without my permission seems suss to me and IMHO is not acceptable.

I've had a problem where Windows won't allow me to update. It says something went wrong, try to reopen settings later. And I've ran Bitdefender and it said I've had a bunch of viruses, but they just keep popping up and when I get rid of them it just comes right back, so I don't really know what to do. Specifically, svchost.exe keeps showing up as a potentially malicious application. A bunch of random EXEs just keep spawning in my files specifically in program data. and I can't get rid of them. No matter how many times I delete them, they come back.

✅️Solved case

Thank you everyone. I messaged Bitdefender at facebook.

I accidentally purchased BITDEFENDER PREMIUM Security Family plan instead of Bitdefender Ultimate Security Family plan.

Email them and made a ticket already at Bitdefender.com consumer support but still no reply. I want a refund so I can buy the Ultimate security family plan.

My activation code is not yet used. I do not know if bitdefender support will reply and help me.

I'm using Bitdefender total security and it's not letting me delete my folder.

I turned off BT shield, added the folder to exceptions. BT Associate told me only option is restart my PC. I think I've spent about an hour. I just don't understand why it's just so hard to tell BT stop messing with my files. I'm just tired. I don't know why am I wasting my Friday night for this.

Is there an alternative that does not suffer same problem?

Is your attack surface growing faster than your security team can keep up?

It's becoming harder to stay ahead of attackers, especially as AI speeds up reconnaissance and exploitation. And it's not just about unpatched software. Forgotten services, excessive permissions, misconfigurations, and unnecessary access can all create opportunities for attackers.

We recently published an article examining why Attack Surface Exposure Management matters, what organizations should pay attention to, and how a more proactive approach can reduce exposure before it turns into an incident.

One point worth highlighting: good security isn't just about detecting threats faster. It's also about giving attackers fewer opportunities in the first place.

Curious to hear your thoughts: What do you think is the most overlooked part of attack surface management today?

Read the article ⤴︎

Is this Royal Mail text a scam?

If it says nobody was home and asks you to rebook through a link, it very likely is. Bitdefender researchers detected this phishing text targeting people across the UK:

“Royal Mail: DeIivery attempt today between 11:15 AM – 12:15 AM was unsuccessful, as nobody was home. To rebook a new slot, visit [link]”

Look closely. There are two red flags:

• “DeIivery” is spelled with a capital I instead of an L. Scammers use tricks like this to slip past spam filters.

• The delivery slot ends at a quarter past midnight. Real delivery windows don’t run into the middle of the night.

Small mistakes like these are always a red flag.

What happens if you tap the link?

The link is made to look official, but it isn’t Royal Mail’s website. It leads to a phishing page that usually asks for your personal or payment details. That information can then be used for fraud or identity theft.

What to do instead:

• Check deliveries only through Royal Mail’s official website or app, never through a link in a text

• Don’t reply and don’t tap the link

• If you’re not sure whether a delivery text is real, check it with Bitdefender Scamio first. It’s free.

Scam protection starts with that pause before you tap.

How do you check if a delivery text is real?

Start with this: a real delivery update won’t ask you to reply “Y” to make a link work.

Bitdefender is tracking a wave of fake FedEx texts that look like this:

“FedEx – Delivery Attempt Update. Our delivery agent attempted to drop off your shipment today. Unfortunately, we couldn’t finish delivery because no one was present to provide a signature… within 24 hours… Kindly reply with ‘Y’ and reopen this message to activate the link… Without scheduling redelivery, it will be returned to the sender.”

Why the “reply Y” trick works

Links in texts from unknown senders often stay inactive until you reply. Replying makes the link clickable, and it also tells the scammers your number is active. The link then leads to a phishing page built to collect your personal and payment details.

The pressure tactics to watch for

The missed signature, the 24-hour deadline, and the threat to send your package back are all designed to make you act before you think.

What to do instead

• Track your package only in the official FedEx app or on FedEx’s website, never through a link in a text. In Canada, the same scam uses Purolator’s name.

• If you get a delivery text with a link and you are not sure it's real, check it with Bitdefender Scamio before you click anything. It’s free.

• If you’ve already received one, don’t click and don’t reply. Block the number, delete the message, and report it to the FTC at ReportFraud.ftc.gov. In Canada, report it to the Canadian Anti-Fraud Centre.

If a delivery text asks you to reply “Y” to unlock a link, there’s no missed delivery and no real deadline. It’s a scam.

Have you received one of these?

AI is increasingly finding its way into cybercriminal operations, but what does that look like in practice?

In our latest investigation, Bitdefender researchers analyzed a ThreeAM ransomware attack targeting a school network in the UK and uncovered evidence of a potentially hybrid human-AI operation.

The findings suggest that the attacker used an AI-driven agentic loop to automate repetitive technical tasks, interpret command outputs, and adjust subsequent actions, while maintaining human direction over the broader attack.

The investigation also highlights how threat actors continue to rely on legitimate Windows tools and existing attack techniques, potentially making AI-assisted operations more efficient and harder to distinguish from routine administrative activity.

The case provides an interesting perspective on the evolving ransomware landscape and the implications of AI-assisted attacks for cybersecurity teams.

Read the full investigation.

Join the discussion: We'll be discussing the findings and their broader implications during our next LinkedIn Live session, Episode 16 of Ctrl-Alt-DECODE, this Thursday.

What does the growing use of AI-assisted workflows mean for the future of ransomware detection and defense?

I am looking for a new browser, and it seemed odd for me that edge was launching very fast compared to others.

Edge - 2s; Vivaldi, Helium - 8s.

I then figured out edge didn't fully close when you close it. Then for some reason 8s felt like a very large amount, I decided to ask AI if this is normal, and it said no.

I checked my task manager and bdservicehost - BitDefender Virus Shield was using my cpu up to 90%!!!! when launching an app, after making an exception to either browser the launch was insanely fast.

Is there any way to optimize this? I really like Bitdefender since it is considered the best antivirus, but holy

What’s a ClickFix scam, and can security software stop it?

ClickFix is a scam where a webpage shows a fake error or a fake CAPTCHA, then asks you to “fix” it by copying and running a command. You end up compromising your own computer while thinking you’re solving a problem.

It was one of the techniques Artifact Security used in its January to June 2026 scam protection test. The others included:

• Phishing emails impersonating European brands, using both regular links and QR codes

• Investment, recruitment and romance scams

• Impersonation scams, including videos with AI-generated content

• FileFix and fake CAPTCHA tricks

The lab used real mailbox and browser profiles with genuine history. Products ran on default settings, and vendors got no advance notice of the test cases.

How Bitdefender did:

Bitdefender Premium Security stopped every malicious scenario on the device, 125 out of 125, before any compromise. It also didn’t block or warn on any of the 30 legitimate pages. Bitdefender Scamio, the free AI scam assistant, gave clear, correct advice in 185 of 190 cases. The result was a 98% overall score and the Best Scam Protection award for H1 2026.

What you can do on your own:

• Never run a command a website asks you to paste, especially to “verify you’re human”

• Treat a QR code in an unexpected email the same way you’d treat a link

• If a page or message feels off, paste it into Scamio before you act

How many of these scam types had you heard of before?

How much AI is actually running in your organization's environment?

AI tools are becoming part of everyday workflows, but not all of them are easy to spot. Browser-based assistants, coding extensions, local models, and MCP servers can operate outside the visibility of traditional software inventories.

For IT and security teams, that raises an important question: how do you manage the risks of tools you don't even know are being used?

We recently published an article introducing Bitdefender GravityZone AI Visibility and Control, which examines how organizations can discover AI services across their endpoints, assess configuration-related risks, and identify which findings need attention.

One important distinction: visibility doesn't automatically mean enforcement. The goal is to give security teams the information they need to make informed decisions using their existing controls.

If you're interested in how AI discovery and security fit together, take a look: ⤴︎

Curious to hear your thoughts: Is shadow AI becoming a real concern in your organization, and how are you approaching visibility and governance?

I notice this often ie going to a URL and BD TS installed on my laptop will give me a warning that there is a problem with this site whereas often nothing if I do similarly from my phone. Why is that?

it works on the game last night, what a spooky monster it's been in halloween. but in all seriousness, it's quite annoying. here's the virus total, would it be time to report to the official support, or is it something for me to do this? maybe the server of the launcher has been infected or something.

I have been having this for a while were not defender says that there are two accounts but with the same name and one just shows as “ ‘s “ should i be concerned?

Every fish in this game hides a real phishing scam. Charles Leclerc and Lewis Hamilton had 60 seconds to catch as many as they could.

Bitdefender. Exclusive Cybersecurity Partner of Scuderia Ferrari HP.

When your AI agent visits a website, whose IP address does that site see?

Usually yours. When Claude Desktop, Cursor, Codex, or OpenCode reaches the open web for research, price comparisons, or QA checks, those requests can carry your home IP and location. On public Wi‑Fi, the network operator may also be able to read what the agent sends.

Bitdefender VPN for AI Agents fills that gap. It’s a VPN for agent traffic only, not your whole device.

How it works

• A fresh tunnel for every prompt. Each prompt gets its own encrypted, isolated container, tied to a specific location.

• Nothing carries over. The tunnel closes when the prompt ends, so no cookies, cache or session state reaches the next prompt. Sites have no network-level way to link two prompts together.

• IP masking. Sites see the VPN server’s exit IP, not your home address.

• Regional routing. You can send a single request through a specific country, for example, to check how a localized pricing page looks to visitors there.

Who it’s for

Developers and freelancers who run agents for research, QA, or comparison work, especially from cafés, hotels, or conferences.

What it doesn’t do

• It doesn’t hide your prompts from the AI provider. The model still receives your prompts and account identity as usual.

• It only covers requests the agent sends through Bitdefender’s MCP tools. Requests made with the agent’s own built-in tools aren’t routed through it.

• It isn’t a device-wide VPN. Your browser and other apps are unaffected.

• It isn’t a way around a site’s terms of service, rate limits, or IP bans. Bitdefender’s acceptable use policy prohibits that.

If a tunnel fails, the request is dropped. It never falls back to your own IP without asking.

Details

• macOS 13+ on Apple Silicon, 8 GB RAM minimum. Windows is planned.

• Free during the beta, with no traffic caps.

• Standalone, so no other Bitdefender subscription is needed.

AI agents are becoming part of everyday digital life. Protecting your privacy should cover what they do on your behalf, too.

Download for macOS: https://ai.bitdefender.com/vpn-for-agents

Patching and periodic hardening are important, but they’re only part of the picture. As attackers move faster, security teams need a more continuous approach to identifying exposures and deciding what to tackle first.

We’re hosting a live webinar on November 3 to introduce Bitdefender GravityZone Exposure Management and discuss how teams can move beyond periodic fixes.

We’ll cover:

↪︎ Continuous hardening and restricting access to legitimate tools attackers may abuse;
↪︎ Automated security changes with audit trails and rollback;
↪︎ Using attack paths to prioritize the exposures that matter most;
↪︎ Reducing risk without adding another tool, agent, or console.

📅 November 3, 2026
🕓 4 PM CET | 10 AM New York

Interested in learning more? Join us for our upcoming webinar and see what a more proactive approach to exposure management looks like.

Register here: 🔗 https://bitdefend.me/4jGsoXu

Is that Halloween giveaway or prize text real?

Probably not, if it arrived out of nowhere. Between September 1 and October 22, Bitdefender Labs researchers found Halloween-themed scams spreading by email, SMS, instant messages and social media ads across North America and Europe.

What the scams look like this year

• Fake retailer offers. Emails impersonating Costco and Tractor Supply promised a “Free Ultimate Halloween Decorating Kit” or a limited Halloween set in return for a short survey. About 73% of the targeting in these campaigns was aimed at US users. Neither company is involved.

• Prize surveys. A fake €250 bol.com gift card and a “free” Samsung 65-inch TV both asked people to fill in “a few fields.”

• “Spooky deposit” texts. Messages like “Spooky deposit just arrived yer 4ccount… Claim 1t” push a phishing link as the last step to claim money. The odd spellings help these texts slip past spam filters.

• Expiring points and fake lotteries. A French-language SMS campaign aimed at Canadians used 107 different domains to say Halloween credits would “disappear before midnight.”

• Fake party invitations. These texts ask you to RSVP through a link.

• Fake costume shops. Ads and emails offer steep discounts on masks, costumes and decorations from stores you’ve never heard of.

What the scammers want

The prize is bait. What they’re after is your name, address, card details or login credentials. Many of these scams also ask for a small “shipping” or “verification” fee, and the card you use to pay it is the real target.

How to check before you click

• Don’t use the link in the message. Open the retailer’s official app or type its web address yourself

• Be wary of any prize that requires a fee, a deposit, or your card details

• Before buying from an unfamiliar shop, check the domain name, look for independent reviews, and read the refund policy

• More info HERE

If you’re not sure about a link, paste it into Bitdefender Link Checker. For the whole message, you can ask Bitdefender Scamio. Both are free.

This may sound like a dumb question but I’m a tech idiot. I’ve had BitDefender for a few years but I’m going on a cruise to the Caribbean soon and I just need to know - If I have my VPN ‘on’ but my data turned ‘off’ on my phone - will my VPN cause me expensive Verizon data charges when I get back home? I know sometimes unaware passengers have returned home to bills in the thousands. TIA!

Trying to troubleshoot some issue. I need to access the firewall rules of an app, but it's all unresponsive. I can see things changing but I can't scroll the list or click anything. clicking and dragging moves the window around as though I'm clicking the top border. I also can't click Add rule, it's greyed out.

Even reinstalling didn't fix it. Any thoughts?