Executive Summary
June was the month Bangladesh's credentials went missing. July was the month somebody used them on the largest target in the country.
On 16 July, the ransomware group The Gentlemen listed BRAC on its extortion site. Not a mid-size software vendor this time. BRAC — founded in Dhaka in 1972, working with more than 145 million people across education, healthcare, livelihoods and human rights; by most measures the largest non-governmental organisation in the world. To our knowledge this is one of the most significant Bangladeshi organisations ever to appear on a ransomware leak site.
The actor matters as much as the victim. The Gentlemen spent the first half of 2026 trading the top spot in global ransomware activity with Qilin, each claiming close to 300 victims in Q2 alone, and several trackers recorded The Gentlemen overtaking Qilin outright during June. Bangladesh has not been hit by an opportunist working the edges of the market. It has been hit by the busiest operation in the business, at a moment when that operation is scaling.
And the credential picture underneath it kept moving all month. Across the eight organisations named in our June report, the number of Bangladeshi credentials sitting in infostealer collections grew by 16,972 in four weeks. More pointedly, six organisations recorded fresh workforce compromises during July — four of them banks. The Bangladesh Police counter now stands at 291 compromised employee accounts, and the most recent of those was compromised on 30 July, two days before this report closed.
That is the sentence to sit with. Not a historical pile. Not an accumulated total. An infected machine, belonging to someone with a police.gov.bd login, sending credentials to a stealer operator while this was being written.
July Events
389 Bangladesh-nexus events, averaging 12.5 per day, resolving to 254 unique indicators — a re-detection rate of roughly 35%, which is worth remembering whenever a raw event count is quoted back at you. By severity: 6 critical, 221 high, 162 medium.
Composition: exposure 174 (45%), network anomaly 81 (21%), intel pulse 75 (19%), malware URL 31 (8%), phishing 21 (5%), advisory 6, ransomware victim 1.
Collection is concentrated: LeakIX 174, Cloudflare Radar 81, BD CIRT 78, URLhaus 27, PhishStats 17, ThreatFox 7, OpenPhish 4, ransomware.live 1.
Ransomware — Critical
BRAC appeared on The Gentlemen's leak site on 16 July 2026, with the group threatening to publish data unless a resolution was reached. It is the only ransomware-victim event in our Bangladesh window this month, and the only severity-4 event that is not an exposed database.
What makes it different from June is not the count. June's two victims — Divine IT and Lockers IT — were software and IT-services firms, and we flagged them as a supply-chain concern because compromising a vendor cascades to its clients. That reasoning still holds. But BRAC is not a vendor. It is a delivery organisation operating at national and international scale, and the data it holds is not commercial. It is microfinance records, health programme participation, education enrolment, and beneficiary information belonging to people who are, by the organisation's own mission statement, among the least equipped in the world to absorb the consequences of having it published.
A ransomware listing against a bank is a financial event. A ransomware listing against BRAC is potentially a protection event, and the humanitarian sector's threat model has historically been built around physical risk, not this.
What we can and cannot say. The listing is a claim by the actor. Leak-site listings are extortion instruments and are sometimes exaggerated, sometimes premature, and occasionally withdrawn. We have not independently verified the scope of any exfiltration, and this report does not confirm one.
The wider actor picture. Spirals, a Rust-based family, was documented against a South Asian IT-services company with a dwell time under 24 hours from initial access to network-wide encryption, moving via an IIS web shell, WMI and PsExec. Read against June's two Bangladeshi IT-firm victims, the sector pattern is not subtle: if you are an IT services provider in Dhaka, your detection budget is one working day. INC Ransomware expanded cross-platform to enterprise and mainframe infrastructure across Asia-Pacific — the subject of a BGD e-GOV CIRT advisory on 5 July — and now appears downstream of FortiBleed credentials.
Credential Exposure — Critical
This is where the month's real weight sits. Across the eight organisations named in our June report, the credential counters grew by 16,972 records in four weeks:
- nidw.gov.bd — 110,634 (June: 107,286), +3,348
- railway.gov.bd — 90,844 (June: 87,433), +3,411
- daraz.com.bd — 83,247 (June: 81,514), +1,733
- incometax.gov.bd — 65,636 (June: 63,762), +1,874
- epassport.gov.bd — 63,773 (June: 62,099), +1,674
- teletalk.com.bd — 63,755 (June: 61,588), +2,167
- police.gov.bd — 39,076 (June: 37,677), +1,399
- bkash.com — 30,580 (June: 29,214), +1,366
These are cumulative indexes, so growth reflects records newly surfacing rather than 16,972 fresh July infections. The distinction matters and we make it deliberately.
Workforce exposure — the part that leads to ransomware. A stolen citizen login is an identity-fraud problem. A stolen employee login at the same organisation is how a network gets breached. Ranked by compromised staff accounts:
- akij.net — 314
- police.gov.bd — 291
- waltonbd.com — 258
- banglalink.net — 222
- janatabank-bd.com — 178
- grameenphone.com — 145
- ucb.com.bd — 141
- thecitybank.com — 127
- squaregroup.com — 126
- bankasia-bd.com — 110
- bb.org.bd — 105
- sonalibank.com.bd — 105
Bangladesh Bank appears on that list with 105 compromised staff credentials. Given February 2016, that line needs no elaboration.
Live compromises during July. Six organisations recorded a workforce credential compromised inside the reporting month:
- police.gov.bd — 30 July
- sonalibank.com.bd — 18 July
- teletalk.com.bd — 17 July
- bankasia-bd.com — 15 July
- ucb.com.bd — 10 July
- bkash.com — 10 July
Four of the six are financial institutions. These are not historical artefacts; they are endpoints that were infected and exfiltrating within the last four weeks. The dominant families remain RedLine, Lumma and Raccoon, with generic-stealer variants throughout — and July added PureLogs, staged from everycarebd[.]com on 103[.]112[.]62[.]142, a Bangladeshi asset. June's story was Bangladeshi credentials in foreign logs. July adds Bangladeshi infrastructure to the kill chain.
Exposed Infrastructure — High
174 exposure events, the largest single category. What is exposed: .DS_Store directory leaks 73, CheckMk monitoring 25, Ollama LLM servers 18, SMB 18, Prometheus 16, MQTT 10, open MySQL 4, exposed .git config 4.
Eighteen unauthenticated Ollama instances. These are local large-language-model servers, reachable from the open internet with no authentication, on Bangladeshi networks. Anyone can query them, enumerate the models loaded, consume the GPU, and — depending on deployment — reach whatever the host can reach. Organisations that would never leave a database open are standing up AI infrastructure with the security posture of a 2011 Redis box. We expect this category to grow, and we intend to track it monthly.
The .DS_Store leaks are, in a way, the more embarrassing finding: 73 macOS filesystem artefacts published to web roots, each mapping out directory structure for anyone who asks. Four exposed .git configurations persist from June's finding, which included live GitLab, GitHub and Bitbucket credentials on a government municipal domain.
Four of the six critical-severity events this month were open MySQL instances — and three of those four were the same host, 118[.]179[.]60[.]91:3306, re-detected on 29 July, 30 July and 1 August. Still open at the time of writing.
Phishing and Social Engineering — High
21 phishing events, but the volume understates the shift. The EvilTokens kit sells device-code phishing against Microsoft 365 as a service. Device-code flows are legitimate — they exist so you can sign into a TV or a terminal — and abusing them sidesteps a great deal of what organisations think of as MFA protection. Ghost Phishing wraps its lures in AES-GCM encryption, a direct attempt to defeat automated content inspection. CIRT also flagged a wave of AI-branded social engineering: campaigns dressed in the vocabulary of AI tools because that vocabulary currently converts.
Bangladeshi organisations that have spent two years rolling out MFA have been working toward a finish line that moved. MFA remains necessary. It is no longer sufficient, and phishing-resistant methods — number matching at minimum, FIDO2 where you can get it — are now the target state.
Malware and Payload Delivery
31 malware-URL events across the month. The label to watch is ELF/IoT (MIPS/ARM) — not workstation payloads, but routers, DVRs and cameras being recruited into botnets on Bangladeshi consumer and SME networks. Devices nobody patches, nobody monitors, and nobody thinks of as computers. Their share is the closest thing this dashboard has to a measure of the country's unowned attack surface.
Network and Routing
81 network-anomaly events via Cloudflare Radar — routing instability, BGP anomalies and traffic disruption affecting Bangladeshi networks. Malicious activity by hosting ASN: Wolast Technologies 18, Link3 Technologies 8, Agni Systems 7, Systems Solutions & Development Technologies 7, EXONHOST 7, AmberIT 7, Royal Green Communication 6, Access Telecom BD 6.
Wolast Technologies is new to the top of this table — it did not feature in June's concentration on Link3, AmberIT and Agni Systems — and at 18 events carries more than twice the load of the next operator. Worth a closer look next month.
The number we would most like to publish is not on this table: how many of these hosts get cleaned up, and how fast. Counting malicious hosts is easy. Counting remediation is what applies pressure, and it is the metric Bangladeshi network operators are least used to seeing published about them. We are building it.
Advisories
Six advisory events, from BD CIRT and BCSI:
- Ghost Phishing — AES-GCM encrypted lures and the EvilTokens device-code PhaaS kit targeting Microsoft 365
- AI-Branded Social Engineering, Phishing and Malware Delivery Campaigns
- FortiBleed — FortiGate devices in Bangladesh exposed with credential compromise
- INC Ransomware — cross-platform expansion across Asia-Pacific (5 July)
Three of the four substantive advisories are credential-centric. That is not a coincidence.
Separately, a pre-authentication RCE chain reached WordPress core on 17 July — CVE-2026-60137 (CVSS 9.1, SQL injection) chained with CVE-2026-63030 (CVSS 7.5, batch-route confusion). No login, no plugins, no unusual configuration. Public proof-of-concept code is circulating and early in-the-wild exploitation has been reported. Given how much of Bangladesh's government, media and SME web presence runs on WordPress, this is the highest-reach single vulnerability we have tracked.
CVEs cited across this period's advisories: CVE-2017-9841, CVE-2026-41940, CVE-2023-20198, CVE-2021-42013. CVE-2017-9841 is a nine-year-old PHPUnit flaw. It is still on the list. That is its own finding.
Recommendations
- Patch WordPress now, and verify it took. Update to 7.0.2 / 6.9.5 / 6.8.6. Forced auto-updates do not mean universal — confirm on every property you own, including the microsite from a campaign three years ago. Then check access logs from 17 July forward.
- Treat every Fortinet SSL VPN credential as compromised and rotate it. Do not stop at the password: invalidate sessions, review admin accounts created or modified since mid-June, hunt for persistence in Active Directory. Rotation does not evict an attacker who already has a foothold.
- Banks: assume workforce compromise and hunt for it. Four financial institutions recorded staff credential compromise during July. If you are on that list, the infected endpoint is more urgent than the password.
- Move to phishing-resistant MFA. Device-code phishing defeats push-approval and OTP flows. Disable device-code authentication where the business does not require it.
- Audit your AI infrastructure like infrastructure. If you run Ollama or any local model server, confirm it is not listening on a public interface. Eighteen in Bangladesh currently are.
- NGOs and development organisations: you are in scope. If your risk register treats cyber as an IT concern rather than a beneficiary-protection concern, revise it. Map where beneficiary data lives, who can reach it, and what you owe the people in it if it is published.
- Close the exposure surface first. Open databases, exposed configs and .DS_Store leaks are pre-exploitation. Everything else in this report is post-.
- IT-services providers: assume a 24-hour window. Validate offline immutable backups and rehearse recovery against that clock, not against a week.
Assessment
ThreatIntel BD assesses with high confidence that Bangladesh moved during this period from credential exposure to credential exploitation, and with moderate-to-high confidence that the country's risk profile has changed structurally rather than incidentally.
The evidence is convergent. A tier-one ransomware operation claimed the largest NGO in the world from a Dhaka headquarters. Six organisations — four of them banks, plus the national police — recorded workforce credential compromise inside a single month, one of them 48 hours before publication. FortiBleed demonstrated a working pipeline from intercepted VPN hashes to ransomware deployment. MFA-bypass kits are being sold as a service. A pre-authentication RCE landed in the country's most common web platform with public exploit code attached. And infostealer staging infrastructure is now hosted on Bangladeshi soil.
The WordPress chain is the near-term risk we rank first on reach. The credential-to-ransomware pipeline is the one we rank first on consequence.
Confidence is tempered by the automated nature of the underlying data, which reflects indicators as observed rather than independently confirmed intrusions; by the cumulative construction of the credential-exposure counters; by a 35% re-detection rate in raw event counts; and, regarding BRAC specifically, by the fact that leak-site listings are actor claims we have not independently verified.
Sourcing: aggregated from Threat Intel BD collection feeds — LeakIX, Cloudflare Radar, BD CIRT and BCSI, URLhaus, PhishStats, ThreatFox, OpenPhish, ransomware.live, and Hudson Rock aggregate infostealer counts — with external corroboration from F5 Labs, Check Point Research and Black Kite. Event figures cover 1–31 July 2026, counted by observation date, filtered to Bangladesh-nexus. Indicators are rendered defanged.