Cl0p exploits an Oracle E-Business Suite zero-day, with infrastructure links to Scattered LAPSUS$ Hunters. XWorm adds a ransomware module and 35+ plugins. TamperedChef steals credentials via a fake PDF editor. Yurei ransomware adds anti-forensic wiping.