Bitdefender
Romanian cybersecurity company making endpoint protection and threat intelligence, founded 2001 in Bucharest.
Bitdefender's June 2026 finding that ransomware affiliates claim victims already posted by rival crews now qualifies every leak-site tally, including September's 815 claims. In May its Draco Team Fed intelligence to Europol's Operation Saffron against First VPN.
Last refreshed: 12 October 2026 · Appears in 1 active topic
What did Bitdefender bring to the police takedown of First VPN?
Timeline for Bitdefender
Mentioned in: Ransomware crews' claims fall to 815
Cybersecurity: Threats and DefencesMentioned in: Police seize KillSec ransomware leak site
Cybersecurity: Threats and DefencesFlagged brand-blurring through cross-claiming affiliates
Cybersecurity: Threats and Defences: One operator ran both ransomware brandsPublished June 2026 threat debrief identifying affiliate cross-claiming and new sector targeting patterns
Cybersecurity: Threats and Defences: Bitdefender: affiliates cross-claim rival victimsBackground
Bitdefender is a Romanian security company founded in Bucharest in 2001 by Florin Talpeș and Mariuca Talpeș. Florin Talpeș remains chief executive. It sells endpoint protection to consumers and businesses and publishes threat research through Bitdefender Labs.
Within those labs, the Draco Team, formed in 2015, works with police forces. In May 2026 it supplied threat intelligence through Europol to Operation Saffron, a French and Dutch-led action that took down First VPN, a service sold to criminals. Draco Team described it as the first VPN takedown in its law-enforcement work.
Bitdefender's research shapes how others read ransomware data. Its monthly debriefs rank the active crews, and its June 2026 report on affiliates cross-claiming victims has become a standard warning attached to leak-site counts, later reinforced when SOCRadar linked one operator to two brands.
Bitdefender's cross-claiming finding clouds leak counts
Bitdefender's threat debrief of June 2026 reported affiliates buying access to one victim from the same broker and each posting the breach on its own leak site. The report tracked 714 victims in May, put construction ahead of manufacturing as the most-hit sector, recorded MedusaLocker returning as Bavacai, and noted the Silent Ransomware Group adding physical break-ins at law and finance firms.
Bitdefender's double-counting point outlived the report. In July SOCRadar found one operator staffing negotiation panels for two ransomware brands, and the September total of 815 claims, down from 1,060 in August, carries Bitdefender's caveat that a monthly count blends new breaches with re-posts.
What did Bitdefender's June 2026 threat debrief find about ransomware?
What is ransomware affiliate cross-claiming and why does it matter?
Is Bitdefender a reliable source for ransomware statistics?
Who is the CEO of Bitdefender?
What role did Bitdefender play in the First VPN takedown?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 12 October 2026. Editorial standards.