#Ransomware
All CosmicBytez Labs articles tagged #Ransomware, across news, security advisories, how-to guides, and projects.
- News
Anne Arundel County, Maryland Confirms August Breach as Rhysida Claims 2.6TB Data Theft
Anne Arundel County confirmed an August 28 intrusion after the Rhysida gang claimed to steal 2.6TB of files and demanded a $2 million ransom.
- News
When Your Ransomware Negotiator Works for the Other Side
Dark Reading's analysis of negotiator Edward Dubrovsky's arrest warns crisis urgency lets compromised IR vendors bypass normal vetting controls.
- News
ThreatsDay Bulletin: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor and 23 More
This week's bulletin covers an Adobe AEM RCE chain, a DNS-based crypto wallet drainer, an NVIDIA container escape, a self-healing WP backdoor, plus 23 more.
- News
Ransomware Gangs Embrace Physical Threats, Family Stalking
A 2026 Semperis survey finds ransomware gangs increasingly threaten violence, stalking, and abduction against victims and their families.
- News
U.K. Sanctions Cryptomus Over $7 Billion in Russia-Linked Money Laundering
The U.K. sanctioned crypto payment platform Cryptomus, accused of laundering over $7 billion for ransomware, fraud, and darknet markets.
- News
No Identity, No Recovery: Why Cyber Resilience Starts With IAM
A Dark Reading analysis argues identity resilience, not just data backups, determines whether enterprises can actually recover from an attack.
- News
Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, 54, a prominent Cypfer-linked ransomware negotiator, was arrested in Pennsylvania and charged with conspiracy to extort money.
- News
Ransomware Recovery CEO Indicted After Allegedly Paying Hackers and Pocketing Millions
MonsterCloud owner Zohar Pinhasi is charged with secretly paying ransoms while billing clients over $19 million for fake decryption tech.
- News
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested in Pennsylvania on extortion charges amid the FBI's ShinyHunters breach probe.
- News
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Former infrastructure engineer Daniel Rhyne, 59, gets 32 months for deleting admin accounts and demanding 20 bitcoin (~$750,000) from his ex-employer.
- News
FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe
Krebs identifies the previously unnamed Pennsylvania arrestee as Cypfer co-founder Edward Dubrovsky, accused of aiding ShinyHunters.
- News
Germany Arrests Alleged Core Qilin Ransomware Member After Extradition
German authorities arrested a 28-year-old Russian national suspected of being a leading Qilin ransomware member following extradition from Japan.
- News
Ransomware Attack Disrupts Japan's IDCF Cloud Used by Government Clients
A ransomware attack on SoftBank-owned IDC Frontier's IDCF Cloud knocked out Japan's East Japan Region 1, disrupting 495 companies and government clients.
- News
ThreatsDay Recap: Ransomware Affiliate Betrayal, WhatsApp RAT & More
Weekly roundup: a ransomware affiliate's betrayal, a new WhatsApp RAT, exposed attacker tools, Qilin's extradition, and more supply-chain abuse.
- News
Advantest Discloses Data Breach Months After Ransomware Attack
Advantest confirmed hackers stole personal data in its February 2026 ransomware attack, eight months after the breach was first disclosed.
- News
Ransomware Has a New Target: Is Your Backup Ready?
Ransomware gangs now destroy backups first to kill recovery options. Kaseya, CISA, and recent Veeam CVEs show why isolated, tested backups matter.
- News
Ransomware Recovery CEO Charged Over Secret Ransom Payments
MonsterCloud's owner allegedly paid hackers for decryption keys, then billed victims up to 18x more while claiming proprietary recovery tech.
- News
Alert: FortiBleed Remains an Active Campaign, Can Lock Out Users or Lead to Ransomware
The FBI and Secret Service warn FortiBleed is still active, now tied to 400,000+ Fortinet devices and causing lockouts that precede ransomware attacks.
- News
Engineer Sentenced for Locking Over 3,000 Devices on Employer Network
Daniel Rhyne, a former infrastructure engineer, got 32 months after locking out servers and workstations and demanding $750,000 in bitcoin.
- News
Osaka Metropolitan University Cancels Classes After Suspected Ransomware Attack
A suspected ransomware attack took down ~500 servers at Osaka Metropolitan University, exposing data on 130,000+ students and staff.
- News
Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity
Senate unanimously passes S. 3315, mandating MFA, pen testing, and HIPAA updates after 730+ breaches hit 270M Americans.
- News
University of Illinois Chicago Hit by Ransomware Attack on Medical School
UIC's College of Medicine confirms a ransomware intrusion; Booba gang claims 344GB stolen, but the claim is unverified and under investigation.
- News
Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
This week: a critical unauthenticated FortiMail 0-day, 13,000+ leaked AI-agent screenshots, a new Spectre v2 variant, and ransomware takedowns.
- News
JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack
JadePuffer (Storm-3168), an agentic AI actor, used exposed credentials to wipe 100+ Azure storage accounts and other resources in minutes.
- News
Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers
Spanish police arrested a 16-year-old Romanian national as KillSec's alleged lead operator; Operation KillSwitch seized 5 servers and 110TB of stolen data.
- News
Alleged KillSec Ransomware Mastermind a 16-Year-Old
Ten-nation Operation KillSwitch dismantled the KillSec RaaS gang, arresting a 16-year-old alleged administrator and seizing 110TB of stolen data.
- News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
China-nexus group Longlegs is still abusing SharePoint ToolShell flaws and a BYOVD EDR killer to deploy Warlock ransomware on critical infrastructure.
- News
'Warlock' Ransomware Hits Critical Infrastructure in Portuguese- and Spanish-Speaking Countries
A China-nexus threat actor is exploiting Microsoft SharePoint flaws, including ToolShell, to deploy Warlock ransomware against critical infrastructure.
- News
Mississippi Mayor Says Ransomware Incident Led City to Shut Down Systems
A ransomware attack forced Vicksburg, Mississippi to shut down city computer systems; Mayor Willis Thompson says the FBI and DHS are investigating.
- News
Warlock Ransomware Breaches Water Utility, Telecom via SharePoint Flaws
New forensic detail reveals a 9-day Warlock ransomware intrusion chain that hit a water utility, telecom operator, government body, and university.
- News
Police Dismantle KillSec Ransomware Gang Allegedly Led by 16-Year-Old
Police seized KillSec's ransomware leak site and arrested three suspects, including an alleged 16-year-old leader, recovering 110TB of stolen data.
- News
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
China-nexus actor Longlegs (Storm-2603) hit a water utility, telecom, government body, and university in Iberia and Latin America via SharePoint flaws.
- News
South Africa Seeks Help After Cyberattack Targets Air Traffic Control
ATNS found ransomware-linked malware on an operational network tied to weather data, and is probing possible exfiltration to China-based IPs.
- News
JadePuffer: Agentic AI Threat Actor Hits Microsoft Azure, Destroys Cloud Resources in Minutes
JadePuffer (Storm-3168) used AI agents and leaked credentials to recon an Azure tenant, then deleted 100+ storage accounts in 7 minutes.
- News
JadePuffer-Linked Storm-3168 Hijacks Azure Identities to Destroy Cloud Resources
Microsoft says Storm-3168, linked to JadePuffer, used two hijacked Azure identities to destroy 100+ storage accounts in a 7-minute burst.
- News
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
Microsoft ties Storm-3168 to JADEPUFFER after two hijacked Azure service principals wiped 100+ storage accounts in a 7-minute burst.
- News
Japan's Keio Confirms Ransomware Attack Disrupted Business Systems
Keio Group confirmed a ransomware attack hit servers on September 26, disrupting hotel, retail, and bus payment systems; trains stayed unaffected.
- News
ShinyHunters Hacked Clop's Leak Site Using a Grav CMS Path Traversal Flaw
ShinyHunters defaced Clop's Tor leak site via an unauthenticated Grav CMS flaw, claims stolen data and onion keys, and is extorting the gang for eight figures.
- News
3 Cyber Threats That Defined the Summer of 2026
DarkReading recaps summer 2026: OpenAI agents breaching Hugging Face, Fairlife's ransomware halt, and Iranian hits on US water utilities.
- News
Ryuk Ransomware Operator Sentenced to 2 Years, Ordered to Pay $1.2 Million in Restitution
Armenian national Karen Vardanyan was sentenced to two years in federal prison and ordered to pay $1.2 million in restitution for Ryuk ransomware attacks.
- News
Ryuk Ransomware Member Sentenced to 24 Months in Prison
Armenian national Karen Vardanyan got 24 months for Ryuk ransomware attacks that netted roughly 1,610 BTC from U.S. victims between 2019-2020.
- News
Sweden Fines Miljödata $183,000 Over Breach Affecting 2.2 Million
IMY fines HR software vendor Miljödata $183K after a 2025 ransomware breach exposed 2.2 million Swedish residents' sensitive data.
- News
ShinyHunters Hijacks Cl0p's Ransomware Leak Site, Demands Extortion Payment
ShinyHunters seized Cl0p's dark web leak site, defaced it, and is demanding an eight-figure payment plus a public apology.
- News
ShinyHunters Hacks Clop Leak Site, Threatens to Extort Ransomware Gang
ShinyHunters defaced Clop's Tor leak site and claims to have stolen its onion service private keys, threatening to extort the ransomware gang.
- News
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
A ransomware developer gets 13 years, a zero-click Plugin4Shell flaw hits AI coding agents, and a max-severity SAP bug enables pre-auth RCE.
- News
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls — three distinct clusters hitting Russian organizations with backdoors, ransomware, and wipers.
- News
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Ransomware attacks on manufacturers rose nearly 40% in early 2026 as attackers exploit operational shutdowns to pressure ransom payments.
- News
The True Cost of a Ransomware Attack, With and Without BCDR
The ransom is often the smallest line item. Industry data shows downtime, recovery, and legal costs are what really drive ransomware's price tag.
- News
NightEagle and Toy Ghouls Join Hacking Cat in Hitting Russian Firms
Kaspersky tracks three distinct clusters — NightEagle, Hacking Cat, and Toy Ghouls — hitting Russian enterprises with backdoors, ransomware, wipers.
- News
Pro-Ukraine Hacking Cat Group Deploying New Malware Against Russian Targets
Kaspersky says pro-Ukraine hacktivist group Hacking Cat has moved from defacements to a RAT, ransomware, and a data-destroying wiper.
- News
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
This week's recap: OpenAI agents hit RubyGems, a WeChat zero-click worm, active PaperCut exploitation, AI-assisted espionage, and an F5 rootkit.
- News
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Three threat clusters, including a state-sponsored actor, are exploiting two Cisco FMC flaws to steal credentials and deploy Qilin ransomware.
- News
New Android Malware 'Mantax Otax' Encrypts Files, Steals Data, and Harasses Victims
Mantax Otax combines Android ransomware and spyware, adding screen-streaming, OTP theft, and coercive harassment overlays to force extortion payouts.
- News
Ukrainian Hacker Gets Four Years in US Prison Over Conti Ransomware Attacks
Oleksii Lytvynenko was sentenced to four years for his role as a hacker and developer in the Conti ransomware operation, which extorted over $150 million.
- News
Attackers Chain Two New Zero-Days in SonicWall's Besieged SMA 1000
CVE-2026-83548 and CVE-2026-83549 chain into unauthenticated RCE on SonicWall SMA 1000 — the fifth SMA 1000 KEV entry since December.
- News
Ransomware Protection for MSPs: A 6-Point Checklist for Faster Recovery
Acronis lays out a 6-point ransomware resilience framework for MSPs, from reducing exposure to clean, cross-tenant recovery.
- News
Ransomware Gang Claims Nutex Health Data Breach
The Gentlemen ransomware gang claims it stole patient, employee, and financial data from hospital operator Nutex Health, threatening a leak.
- News
Stronger Security Drives Ransomware Groups to Recruit From Within
As MFA and EDR harden perimeters, ransomware crews are increasingly recruiting employees and contractors as inside men to bypass defenses entirely.
- Newsletter
Weekly Digest — Issue #33
ShinyHunters' deadline hits as McKesson confirms a breach, a critical Langflow RCE bleeds AI-agent keys, and PaperCut's patched zero-days pivot to data theft.
- News
Aurora Ransomware Operators Use Cursor AI Against 10 Targets
Aurora ransomware operators used Cursor's agentic AI, running Claude Sonnet, to automate recon, lateral movement, and AD exploitation across 10 victims.
- News
Berlin Confirms Data Theft After Rhysida Ransomware Attack Claims
Rhysida claims 5.79TB stolen from Berlin's state network and demands 30 BTC; the city says it won't pay ahead of its September 20 election.
- News
Berlin Refuses to Pay Rhysida Ransom Over Alleged Senate Data Theft
Rhysida ransomware claims 5.7TB stolen from a Berlin Senate department; city officials say they will not pay the 30 BTC ransom demand.
- News
McKesson Confirms Data Breach as ShinyHunters' Deadline Looms
McKesson confirms unauthorized access to two business units after ShinyHunters claims 284 million records and demands ~$55M by Sept 1.
- News
ATF Breach Hit System Holding Investigation-Target Data, Officials Say
ATF says the Qilin-linked breach hit a standalone system holding data on investigation targets, not gun-owner records, amid a 'major incident' probe.
- News
In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker Sanctions
This week's roundup: a Log4j RCE scare gets debunked, container-security startup Minimus shuts down, and the US sanctions Iranian MOIS hackers.
- News
ATF Confirms 'Major Incident' After Qilin Ransomware Gang Claims Breach
The ATF is investigating a cybersecurity incident on a standalone system after Qilin ransomware listed the agency as a victim on its leak site.
- News
ATF Confirms Breach of System Holding Investigation Targets, Qilin Claims Credit
ATF confirmed a cyberattack on a standalone system with investigation data; Qilin ransomware posted the agency's name to its leak site.
- News
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Two new malware loaders — WordlistLoader and SynkLoader — deliver ransomware-enabling payloads and steal Windows credentials via phishing.
- News
WordlistLoader & SynkLoader: New Malware Families Delivering Infostealers and Phishing Windows Credentials
Two new malware loaders target ransomware access brokering: WordlistLoader drops Amatera Stealer via ClickFix, SynkLoader harvests Windows credentials.
- News
SickKids Hospital Hit by Cybercriminals Again as Employee Data Stolen
Canada's Hospital for Sick Children suffered a second cyber incident with employee data stolen via a compromised third-party app, four years after a 2022...
- News
CISA: Medusa Ransomware Hit Over 500 Critical Infrastructure Orgs
FBI and CISA warn that Medusa ransomware has breached 500+ US critical infrastructure organizations since 2021, demanding ransoms up to $15 million.
- News
Ransom Busters: Ransomware Affiliate Poses as Data Recovery Firm
A ransomware affiliate operating as 'Ransom Busters' contacts breach victims posing as a recovery service, then double-extorts them for $20K–$60K.
- Newsletter
Weekly Digest — Issue #31
3.5M enterprise records stolen via Azure infostealer campaign, China-nexus APT mass-exploits vCenter in 5 days, and CISA adds Microsoft IKE RCE to KEV.
- News
Philips and GE Investigating Clop Ransomware Data Theft Claims
Clop ransomware gang claims data theft from GE Healthcare and Philips via a zero-day in PTC Windchill, exfiltrating engineering blueprints and drawings.
- News
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
China-nexus APT exploits CVE-2026-59310 in VMware vCenter five days post-disclosure, compromising 361 systems in 47 countries with Babuk-derived ransomware.
- News
Shell Investigates 'Potential Incident' After Clop Data Theft Claims
Oil giant Shell is investigating after Clop ransomware gang claimed to have stolen 89GB of data from the company.
- News
Akira Hackers Disable EDR with Safe Mode, Steal Data but Fail to Encrypt
An Akira affiliate rebooted a compromised system into Safe Mode to blind EDR tools, exfiltrated data via s5cmd, then failed to encrypt due to memory errors.
- News
Enterprise Perimeter Defenses Improved — Interior Security Collapsed
Picus Blue Report 2026: edge prevention rose to 69% but interior dropped to 37%. Registry credential theft blocked less than 1% of the time.
- News
DeadLock Ransomware Uses Blockchain to Resist Infrastructure Takedown
DeadLock ransomware stores its C2 configuration in Polygon smart contracts, making law enforcement takedowns ineffective against its 80+ victim operation.
- News
DeadLock Ransomware Uses Polygon Smart Contracts to Harden Extortion Infrastructure
The DeadLock ransomware group is leveraging Polygon blockchain smart contracts and the Session messaging network to build decentralized extortion...
- News
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks
A CISA/FBI joint advisory warns that Gunra ransomware — a Conti-derived RaaS — has claimed 51+ victims by exploiting critical Fortinet FortiOS...
- Newsletter
Weekly Digest — Issue #30
GhostSplice turns AI coding agents against themselves, DeadLock builds blockchain ransomware infra, and hackers shut a Polish turbine via cellular.
- News
China-Linked Storm-1175 Deploys StormEncryptor Ransomware via Critical N-central Flaw
Microsoft tracks Storm-1175 pivoting from Medusa ransomware to a new strain — StormEncryptor — exploiting an N-able N-central authentication bypass that...
- News
China-Linked Storm-1175 Turns N-able N-central Into MSP Ransomware Launchpad
Microsoft warns that the China-linked threat actor Storm-1175 is exploiting a critical zero-day in N-able N-central (CVE-2026-18577) to gain god-mode...
- News
FBI, South Korea Warn of Gunra Ransomware Gang Targeting Critical Infrastructure
The FBI and South Korea's government have jointly warned that the Gunra ransomware gang is breaching critical infrastructure through vulnerabilities in...
- News
New StormEncryptor Ransomware Used by Former Medusa Affiliate
A financially motivated threat actor formerly associated with the Medusa ransomware operation is now deploying a new ransomware strain called...
- News
Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
This week's security roundup covers agentic AI containment failures, a critical Metabase zero-day, malicious MCP plugins targeting AI assistants, and...
- News
N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist
N-able has released a mandatory second hotfix for N-central after attackers exploiting CVE-2026-18556 and CVE-2026-18577 pivoted through Take Control to...
- News
Ransom Cartel Ransomware Creator Sentenced to 16 Years in Prison
Belarusian cybercriminal Maksim Silnikau, the mastermind behind Ransom Cartel ransomware-as-a-service, was sentenced to 16 years in federal prison for...
- News
Prolific Ransomware Group Behind SonicWall Zero-Day Attacks
INC ransomware — responsible for nearly 900 victims across 71 countries — has emerged as the dominant actor exploiting a chained pair of SonicWall SMA...
- News
INC Ransomware Emerges as Dominant Threat Actor Exploiting SonicWall SMA 1000 Flaws
INC Ransomware has emerged as the dominant threat actor accelerating exploitation of recently disclosed SonicWall Secure Mobile Access 1000 series VPN...
- News
River Bank Says Hackers Deleted Data Stolen in Ransomware Attack
River Bank & Trust in Alabama says it obtained representations from the ransomware group that attacked it in June 2026 that the stolen data has been...
- News
SE Asian Cybercriminal Syndicates Become a Global Power
A new UNODC threat assessment reveals that Southeast Asian cyber fraud syndicates generated $88–$114 billion in losses in 2025 alone — and are now...
- News
Semiconductor Chip Titan Analog Devices Reports Data Breach
Analog Devices, the $178 billion semiconductor giant, disclosed a data breach via SEC 8-K filing after unauthorized access was detected in June 2026....
- News
ESET Threat Report: Malicious AI Skills and Adaptable Malware on the Rise
ESET's mid-2026 threat report reveals attackers adapting established techniques to AI platforms — deploying malicious AI skills, AI-assisted malware,...
- News
ESET H1 2026: Malicious AI Skills Surge to 3,000+ as ClickFix and Quishing Break Records
ESET's H1 2026 threat report reveals 3,000+ malicious AI skills in open repositories, a 108% ClickFix surge, record quishing activity, and the first...
- News
Microsoft Teams Vishing Attacks Lead to Chaos Ransomware Deployment
Threat actors are impersonating IT support staff in Microsoft Teams voice calls to gain remote access to corporate devices and deploy Chaos ransomware...
- Newsletter
Weekly Digest — Issue #29
AI models autonomously escape sandboxes via Artifactory zero-days, ShinyHunters claims Ernst & Young, 1.26 million healthcare records exposed, and...
- News
FBI: Breaking Affiliate Trust Was Key to LockBit's Takedown
An FBI agent reveals how Operation Cronos dismantled the world's largest ransomware group by exploiting fractures in LockBit's affiliate trust model —...
- News
PTC Windchill Vulnerability Exploited in Ransomware Campaign
A critical unauthenticated deserialization flaw in PTC's Windchill PLM platform is being actively weaponized by the Cl0p ransomware group, targeting...
- News
Ransomware Attack Puts a Chill on Japanese Frozen-Food Chain
A ransomware attack on a major Japanese food and logistics firm has disrupted frozen food supply chains, affecting thousands of franchise clients...
- News
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Cisco Talos has detailed msaRAT, a Rust-based implant used by the Chaos ransomware group that hides its command-and-control channel inside the victim's...
- News
RansomHouse Freezes Japan's Food Supply: Nichirei Logistics Cyberattack Disrupts KFC and Thousands of Clients
A cyberattack by Russia-linked RansomHouse on Nichirei Logistics Group, Japan's largest cold-chain operator, halted frozen food shipments across 140...
- News
Ransomware Is Accelerating — And It's Not Because of AI
Black Kite's 2026 Ransomware Report reveals 7,551 publicly disclosed victims in a single year — a 24.9% increase — driven not by AI but by ecosystem...
- News
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Threat actors linked to the Cl0p ransomware group are actively exploiting chained pre-authentication vulnerabilities in PTC Windchill and FlexPLM...
- News
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
PRODAFT has published detailed analysis of the DevMan ransomware-as-a-service operation, revealing a professional-grade affiliate portal with payload...
- News
Clop Ransomware Targets PTC Windchill and FlexPLM in Mass Data Theft Campaign
The Clop ransomware gang is exploiting CVE-2026-12569, a critical unauthenticated RCE flaw (CVSS 9.8) in PTC Windchill and FlexPLM, deploying webshells to...
- News
In Other News: Dolphin X AI Malware, Car Anti-Theft Hack, 432 Linux Kernel CVEs
This week's security roundup covers an AI-prioritizing infostealer targeting developer machines, a hardcoded Bluetooth key in 2.2 million car anti-theft...
- News
msaRAT: Chaos Ransomware's New Backdoor Hides C2 Traffic Inside Chrome and Edge
Cisco Talos has uncovered msaRAT, a Rust-based remote access trojan deployed by the Chaos ransomware group that routes all command-and-control traffic...
- News
Swiss Rail Giant Stadler Refuses $12.3M Ransom Demand from Everest Group
Stadler Rail has publicly rejected a CHF 10 million (~$12.3M USD) ransom demand from the Everest extortion group following a breach of a supplier...
- News
How Enterprise GenAI Can Amplify Ransomware Risk — and How to Contain It
Enterprise AI assistants and agents that inherit excessive permissions or compromised identities create new ransomware attack paths. Identity controls,...
- News
Swiss Rail Giant Stadler Rejects $12.3M Ransom Demand After Cyberattack
Swiss rail vehicle manufacturer Stadler Rail has publicly refused to pay a CHF 10 million (~$12.3M USD) ransom demanded by the Everest ransomware group...
- News
Anubis Ransomware Claims Coca-Cola Fairlife Attack, Threatens Data Leak
The Anubis ransomware gang claims responsibility for a cyberattack on Coca-Cola's Fairlife dairy subsidiary, threatening to publish stolen corporate data...
- News
Critical Palo Alto VPN Bug Now Exploited by Qilin Ransomware Gang
The Qilin ransomware gang is actively exploiting a critical PAN-OS GlobalProtect authentication bypass vulnerability to breach enterprise networks,...
- News
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Sysdig researchers link a second Langflow server attack to JADEPUFFER, an AI-agent-driven threat operator now deploying ENCFORGE — a Go-based ransomware...
- Newsletter
Weekly Digest — Issue #28
AI agents go offensive, GitHub weaponized for 14M malware downloads, Qilin exploits critical Palo Alto VPN, and SonicWall zero-days ran for weeks pre-patch.
- News
JadePuffer Agentic Attacks Now Target AI Model Data with Ransomware
The JadePuffer autonomous AI agent threat actor has upgraded its arsenal with EncForge, custom ransomware engineered to encrypt AI assets including...
- News
Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request shouldn't be able to do this much. This week delivered pre-authenticated WordPress RCE, dual SonicWall zero-days exploited since June, a...
- News
ThreatsDay: Game Cheat Spyware, Spirals Ransomware, Chrome Sync Stalking
This week's threat roundup covers NuGet packages poisoned with game-cheat spyware, the Spirals ransomware deploying network-wide in under 24 hours, and...
- News
Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker — Lawyers Say Wrong Man
Armenia has held a Russian tourist named Aleksandr Ermakov in detention since June 28 after a U.S. extradition request for a REvil ransomware suspect...
- News
Abbott Laboratories Probes Two Cyber Incidents Amid Extortion Claims
Abbott Laboratories is investigating two separate cybersecurity incidents: confirmed unauthorized access to legacy Exact Sciences systems in its Cancer...
- News
In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint
This week's security roundup covers Iranian threat actors tracking US military personnel's phones, the newly discovered CrashStealer macOS infostealer, a...
- News
Inc Ransomware Exploits Chained SonicWall SMA Zero-Days for Root Access
The Inc ransomware group is actively exploiting two chained zero-day vulnerabilities in SonicWall Secure Mobile Access appliances. When combined, the...
- News
Coca-Cola Fairlife Ransomware Attack Halts All US Dairy Production
The Coca-Cola Company filed an SEC 8-K disclosure after a ransomware attack on its Fairlife dairy subsidiary temporarily suspended all US production of...
- News
Identity Attacks Overtake Exploits as Top Ransomware Cause
Sophos 2026: 79% of ransomware attacks start with stolen identities. MFA was present in 97% of credential-based cases yet failed to stop every one of them.
- News
New Spirals Ransomware Encrypts Victim Network in Under 24 Hours
A newly identified ransomware group called Spirals has demonstrated alarming operational speed, completing the full attack lifecycle — initial access,...
- News
Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court for their roles in the 2024 cyberattack on...
- News
US Charges Three Russians for Operating Bulletproof Hosting Behind $62M Ransomware Campaign
Federal prosecutors unsealed a 2024 indictment against three Russian nationals who ran Medialand LLC and ML.Cloud LLC — bulletproof hosting services used...
- News
U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support
The U.S. Treasury's OFAC has designated two individuals and a VPN service provider for enabling ransomware actors and other cybercriminals — marking a...
- Newsletter
Weekly Digest #27 — Zero-Days Everywhere, Sanctions Escalate, and Your Browser Extension Just Betrayed You
This week: Progress ShareFile and SonicWall hit with chained zero-days, the US sanctions its first VPN provider, ShinyHunters walks into Salesforce...
- News
US Treasury Sanctions 1VPNS: The VPN Service Favored by Ransomware Groups
The US Treasury's OFAC sanctioned First VPN Service (1VPNS) and its Ukrainian administrator for providing anonymization cover to ransomware groups...
- News
Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, and AI Coding Attacks
This week's biggest threats: Progress Software orders ShareFile shutdown over an undisclosed zero-day-level risk, ransomware groups weaponize Citrix Bleed...
- News
Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks
A 41-year-old former cybersecurity professional has been sentenced to 70 months in federal prison for conspiring with the now-defunct BlackCat ransomware...
- News
Ryuk Operator Pleads Guilty; BlackCat/AlphV Conspirator Gets Nearly 6-Year Sentence
A Ryuk ransomware operator pleaded guilty in Oregon federal court while a BlackCat/AlphV conspirator received a 70-month prison sentence in Florida,...
- News
Third US Security Expert Sentenced to Prison for Helping Ransomware Gang
Angelo Martino, a former ransomware negotiator turned insider threat, was sentenced to 70 months in federal prison for actively assisting the...
- News
Armenian National Pleads Guilty to Ryuk Ransomware Attacks
Karen Vardanyan, an Armenian national, has pleaded guilty to federal charges related to Ryuk ransomware attacks and faces up to 15 years in prison with...
- News
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops
A weekly cybersecurity roundup covering the DHS database breach, Adobe accelerating its patch release schedule, Canada's law enforcement disruption of...
- News
Former DigitalMint Ransomware Negotiator Sentenced to 70 Months for Defrauding Clients
Angelo Martino, a former cyber recovery specialist at DigitalMint, was sentenced to nearly six years in federal prison after secretly feeding confidential...
- News
GodDamn Ransomware Deploys Microsoft-Signed PoisonX Driver to Kill EDR Tools
GodDamn ransomware — a rebrand of Beast/Monster — uses PoisonX, a malicious kernel driver that passed Microsoft's signing process, to terminate 400+...
- News
'GodDamn' Ransomware Uses BYOVD Technique to Kill Security Software at US Companies
A new ransomware strain dubbed 'GodDamn' is leveraging a Microsoft-signed malicious kernel driver through the Bring Your Own Vulnerable Driver technique...
- News
GodDamn Ransomware Uses PoisonX Kernel Driver to Neutralize Endpoint Security
Symantec's Threat Hunter Team has flagged GodDamn, a new ransomware family that deploys the PoisonX kernel driver to disable endpoint detection and...
- News
Latvian State Forests Still Restoring Systems Weeks After Ransomware Attack
Latvia's state-owned forest management company LVM remains in recovery mode weeks after a ransomware attack that went undetected for nearly two weeks,...
- News
Mount Royal University Confirms Breach as Hackers Claim Attack
Mount Royal University in Calgary has confirmed that hackers breached its network, stole data from file storage systems, and subsequently deleted it —...
- News
GigaWiper: New Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
Microsoft has dissected GigaWiper, a destructive Windows backdoor that combines three distinct destructive capabilities — full disk wiping, fake...
- News
County Government Reportedly Paid $1 Million to Cyber Extortion Group
A small Ohio county reportedly paid a cyber extortion group $1 million to prevent the public release of sensitive stolen government data, highlighting the...
- Newsletter
Weekly Digest #26 — AI Ransomware, Mega-Breaches, and the Supply Chain Under Siege
This week: the first fully autonomous LLM-powered ransomware attack, 16 million people caught in two massive breaches, North Korean supply chain...
- News
Canada's Spy Agency Reports Hacking Three Criminal Groups in 2025
Canada's Communications Security Establishment publicly disclosed offensive cyber operations against a ransomware-as-a-service gang, a foreign online...
- News
JadePuffer: The First Fully Autonomous LLM-Driven Ransomware Attack
Security researchers at Sysdig have documented JadePuffer — an agentic threat actor powered entirely by a large language model that independently...
- News
Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware
This week's threat roundup covers residential proxy botnets hiding in streaming boxes, browser-based ransomware campaigns, AI agent abuse techniques, and...
- News
Teen Suspect in Scattered Spider Hacks Is Extradited to US
Peter Stokes, 19, has been extradited from Finland to face federal charges tied to Scattered Spider's hundred-million-dollar cybercrime spree — the latest...
- News
Agentic AI Used to Conduct Ransomware Attack via Langflow Vulnerability
Threat group JadePuffer leveraged an LLM agent to autonomously execute a multi-stage ransomware-style attack through a critical Langflow vulnerability,...
- News
Alleged Scattered Spider Hacker Peter Stokes Extradited to the United States
Peter Stokes, 19, a dual US-Estonian citizen known online as 'Bouquet,' has been extradited from Finland to face federal charges for his alleged role in...
- News
JadePuffer Ransomware Used an AI Agent to Automate the Entire Attack
Security researchers have documented what appears to be the first ransomware operation conducted entirely by a large language model agent — JadePuffer...
- News
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
A leaked negotiation chat and blockchain analysis reveal that a U.S. government entity paid approximately $1 million to the Kairos extortion group to...
- News
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Blackpoint Cyber researchers have uncovered Avalon, an AI-assisted modular malware framework that chains phishing, credential theft, lateral movement, and...
- News
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
Sysdig researchers documented the first fully autonomous AI-driven ransomware campaign, where threat actor JADEPUFFER used an AI agent to chain Langflow...
- News
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Researchers have uncovered a novel malware artifact generated using DeepSeek that weaponizes the Chromium File System Access API to encrypt files entirely...
- News
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs
Threat actors who exploited the FortiBleed vulnerability to gain persistent access to thousands of Fortinet firewalls are now monetizing that access by...
- News
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
SOCRadar uncovered FortiBleed — a large-scale credential-harvesting campaign targeting 11,250 FortiGate portals across 150+ countries, resulting in 110...
- News
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Anubis ransomware affiliates are exploiting CVE-2025-5777 (Citrix Bleed 2) for initial access while pairing BYOVD techniques and stolen supply chain...
- News
Ransomware Thugs Masquerade as Interpol to Entice Small Biz
A ransomware campaign is impersonating Interpol to pressure small and medium-sized businesses into paying extortion demands, using law enforcement...
- News
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
This week's security roundup covers AI compute theft, a newly discovered Apple Mail vulnerability, the emerging BlueHammer ransomware group, and 14...
- News
FortiBleed Credential-Theft Campaign Linked to Lynx Ransomware Group
Researchers have connected the massive FortiBleed credential-theft operation — which harvested credentials from over 86,000 FortiGate firewalls — directly...
- News
Blackfield Ransomware Demands $2 Million from Nidec Corporation
The Blackfield ransomware gang is demanding a $2 million ransom from Nidec Corporation after attacking its Taiwanese subsidiary, Nidec Chaun Choung...
- News
BlueHammer Vulnerability Exploited in Ransomware Attacks Before Microsoft Patch
The Microsoft Defender vulnerability CVE-2026-33825 was actively exploited as a zero-day by ransomware groups before Microsoft had the chance to release a...
- News
CISA: Windows BlueHammer Flaw Now Exploited by Ransomware Gangs
CISA has confirmed that ransomware gangs are actively exploiting BlueHammer, a Microsoft Defender privilege escalation vulnerability previously used in...
- News
How Ransomware Syndicates Weaponize Corporate-Style Organization
From outsourced labor to tiered pricing models, today's top ransomware groups operate less like rogue hackers and more like Fortune 500 companies — with...
- Newsletter
June 30 Digest: BlueHammer Zero-Day, Ransomware Goes Corporate, AI Supply Chain Risks & Nation-State ICS Threats
A Microsoft Defender zero-day fuels ransomware before any patch exists; researchers dissect how syndicate groups run HR departments and tiered pricing;...
- News
In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs
Qihoo 360 unveils Tulongfeng — a Chinese rival to Anthropic's Mythos AI vulnerability finder; the World Leaks ransomware group dumps 630 GB from Tata...
- News
Third-Party Breaches Teach Education Sector a Costly Lesson in Vendor Risk
Rising third-party breach incidents are forcing schools and universities to play defense as ransomware gangs and supply chain attackers increasingly...
- News
Europe Evolves Into Ransomware's Favorite Region
New research from Black Kite shows ransomware attacks against European organizations surged 55% in the first four months of 2026 compared to the same...
- News
Malicious Edge Extension "Edgecution" Abuses Native Messaging to Deploy Ransomware Backdoor
Zscaler researchers exposed 'Edgecution', a rogue Microsoft Edge extension that exploits Chrome's Native Messaging protocol to escape the browser sandbox...
- News
Amadey and StealC Malware Operations Disrupted in Operation Endgame Action
Microsoft, Europol, and international law enforcement partners have dismantled infrastructure supporting the Amadey malware loader and StealC infostealer...
- News
Edgecution: Malicious Edge Extension Escapes Browser Sandbox via Native Messaging
A malicious Microsoft Edge extension dubbed 'Edgecution' abused the Native Messaging API to escape the browser sandbox and deliver a Python backdoor used...
- News
Stealthy Mistic Backdoor Linked to Ransomware Access Broker KongTuke
Security researchers have identified a new backdoor malware named Mistic being deployed by KongTuke, a ransomware initial access broker, in financially...
- News
INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific
A new INTERPOL report reveals a dramatic surge in Asia-Pacific cybercrime, with phishing rates nearly double the global average, ransomware attacks...
- News
Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
This week's threat roundup covers the Usbliter8 iPhone boot exploit, NarwhalRAT spread via fake Microsoft alerts, The Gentlemen ransomware's GentleKiller...
- News
New Prinz Eugen Ransomware Prioritizes Recent Files for Encryption
A new Go-based ransomware operation named Prinz Eugen targets recently modified files first, uses ChaCha20-Poly1305 encryption, and communicates with...
- News
Nintendo Confirms Employee Data Stolen in TinyPulse Cyberattack by Shadowbyt3$
Nintendo of America has confirmed that approximately 1GB of employee data — including W-9 forms, bank statements, and HR survey responses — was...
- News
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
The Gentlemen ransomware-as-a-service operation distributes a sophisticated EDR-killing toolkit called GentleKiller to affiliates, capable of terminating...
- News
Australian Sugar Producer Works to Restore Operations After Ransomware Attack
Mackay Sugar, one of Australia's largest sugar producers, is working urgently to restore harvesting and milling operations after The Gentlemen ransomware...
- News
Gentlemen Ransomware Uses Multiple EDR Killers to Disable Defenses
The Gentlemen ransomware-as-a-service operation is actively developing and maintaining a suite of EDR killer tools to help affiliates evade detection and...
- News
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
Cybersecurity researchers have charted the evolution of INC ransomware from a nascent RaaS operation to one of the most prolific cybercrime groups in...
- News
INC Ransomware Thrives by Mastering the Basics
The INC ransomware group has risen to prominence not through exotic exploits but by relentlessly targeting sectors — particularly healthcare — where...
- News
Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack
Security researchers have uncovered a DragonForce ransomware attack deploying a new Go-based backdoor that uses Microsoft Teams relay infrastructure for...
- Newsletter
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
- News
iRhythm Confirms Patient Data Stolen in Ransomware Attack
Digital health company iRhythm has confirmed that attackers stole data in a cyber intrusion discovered on June 8, 2026, with the threat actors demanding a...
- News
'Lorem Ipsum' Malware Pivots to ClickFix Delivery via WordPress
New analysis reveals the 'Lorem Ipsum' malware campaign has adopted ClickFix social engineering as its primary delivery mechanism, leveraging compromised...
- News
DragonForce Ransomware Hides C2 Traffic Inside Microsoft Teams Relays
DragonForce ransomware operators deployed a custom implant called Backdoor.Turn to camouflage command-and-control communications inside legitimate...
- News
Check Point VPN Zero-Day Exploited Since Early May by Qilin Ransomware
A critical zero-day vulnerability in Check Point's VPN products has been under active exploitation since at least early May 2026, with a Qilin ransomware...
- News
Conti Ransomware Member Pleads Guilty, Faces Up to 20 Years in Prison
Oleksii Lytvynenko, a 44-year-old Ukrainian national, has pleaded guilty to participating in the prolific Conti ransomware group after being arrested in...
- News
In Other News: Google Security Layoffs, AudiA6 Takedown, $400M Coupang Fine
This week's security roundup covers Google's controversial security team layoffs, Europol's dismantling of the AudiA6 ransomware crypto laundering...
- News
ShinyHunters Uses Oracle Zero-Day to Rampage Higher Education
The ShinyHunters hacking group exploited a critical Oracle PeopleSoft ERP zero-day (CVE-2026-35273) that disproportionately impacted American...
- News
Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs
Europol has dismantled AudiA6, a cryptocurrency laundering service described as a key financial pipeline for ransomware gangs and cybercriminal networks...
- News
Ukrainian National Pleads Guilty to Role in Conti Ransomware Operation
A Ukrainian national extradited from Ireland to the United States has pleaded guilty to conspiracy charges tied to the Conti ransomware operation, which...
- News
Authorities Dismantle 'AudiA6' Ransomware Crypto-Laundering Service
Law enforcement has dismantled the AudiA6 cryptocurrency laundering service used by ransomware actors and cybercriminals to clean more than $380 million...
- News
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
A new analysis of The Gentlemen ransomware operation reveals the financially motivated group has claimed 478 victims and evolved a worm-like...
- News
Infostealers Turn Millions of Devices Into Credential Theft Machines
Attackers increasingly favor stolen credentials over exploits, and infostealers have become the primary access broker feeding ransomware and cybercrime...
- News
Who Runs the Ransomware Group 'The Gentlemen'?
KrebsOnSecurity investigates the identity and structure behind The Gentlemen, the second most active ransomware gang of 2026, known for offering...
- News
CISA Gives Feds 3 Days to Patch Check Point VPN Bug Exploited as Zero-Day
CISA ordered federal agencies to patch a critical Check Point Remote Access VPN flaw within 3 days after Qilin ransomware affiliates were confirmed...
- News
In Other News: Anthropic Maps AI Threats, Unpatched Comodo Flaw, Palantir Chief Eyed for CISA
This week's cybersecurity roundup covers Anthropic's new AI threat taxonomy, an unpatched Comodo security flaw, Palantir's Alex Karp reportedly under…
- News
The U.S. Sanctions Nobitex Crypto Exchange Used by Ransomware
The U.S. Treasury's OFAC has sanctioned Nobitex, Iran's largest cryptocurrency exchange, for facilitating payments linked to terrorist activities and…
- Newsletter
June 3 Digest: AI Ransomware, Netlogon RCE, Miasma Supply Chain
An AI-generated ransomware toolkit automates EDR evasion; Windows Netlogon RCE is actively exploited on domain controllers; the Miasma campaign hits Red Hat…
- News
AI-Built Ransomware Toolkit Automates EDR Evasion and AD Discovery
A threat actor has deployed an AI-generated ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and…
- HOWTO
Anatomy of a Ransomware Attack on a Canadian Ag Operation
A composite case study of a typical 2026 ransomware incident hitting a Canadian agricultural business — from the first phishing email through full encryption…
- News
Ransomware Actors Show Up In Person to Steal Law Firm Data
FBI warns the Silent Ransom Group is targeting law firms by physically arriving on-site and social-engineering access to sensitive client databases.
- Newsletter
May 26 Digest: SharePoint RCE, Megalodon CI/CD Blitz
Microsoft patches a CVSS 8.8 SharePoint RCE; the Megalodon campaign poisons 5,561 GitHub repos in six hours; 7-Eleven's ShinyHunters breach hits 185,000; and a.
- News
''First VPN'' Cybercrime Service Disrupted, Administrator
The FBI and international partners have disrupted First VPN, a criminal VPN service used by dozens of ransomware groups for network reconnaissance and...
- News
First VPN Dismantled in Global Takedown Over Use by 25
International authorities have disrupted a criminal VPN service called First VPN that was used by more than 25 ransomware groups to conceal network...
- News
Verizon DBIR 2026: Healthcare Fends Off Rising Social
The 2026 Verizon Data Breach Investigations Report highlights how evolving social engineering tactics are making the healthcare sector more vulnerable,...
- News
Europe Dismantles VPN Service Used by Cybercriminals to Hide Ransomware Attacks
European law enforcement has taken down First VPN, a privacy service that had been openly advertised on Russian-language cybercrime forums as a tool for...
- News
Police Seize 'First VPN' Service Used in Ransomware and Data Theft Attacks
International law enforcement has dismantled 'First VPN,' a criminal VPN service marketed on Russian-speaking cybercrime forums and used to facilitate...
- News
Hackers Bypass SonicWall VPN MFA Due to Incomplete Patching
Threat actors brute-forced credentials and bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances to deploy ransomware tools,...
- Newsletter
May 20 Digest: Exchange Zero-Day, Verizon DBIR, GitHub
A Microsoft Exchange zero-day is being exploited with no patch in sight; Verizon DBIR 2026 marks a landmark shift — vulnerability exploitation now...
- News
Cybercrime Service Disrupted for Abusing Microsoft Platform
Microsoft has disrupted a malware-signing-as-a-service operation that exploited the company's Artifact Signing service to produce fraudulent code-signing...
- News
Verizon DBIR 2026: Vulnerability Exploitation Overtakes
Verizon's 2026 Data Breach Investigations Report reveals a landmark shift: vulnerability exploitation has surpassed credential abuse as the leading breach...
- HOWTO
Why Your Accountant is a Ransomware Target
Small accounting firms in rural Alberta have become primary ransomware targets in 2025–2026. The reasons are structural: high-value data, weak security…
- News
Millions Impacted Across Several US Healthcare Data Breaches
Multiple healthcare data breaches impacting hundreds of thousands to millions of individuals have been added to the HHS breach tracker, continuing a...
- News
Foxconn Attack Highlights Manufacturing's Cyber Crisis
A Nitrogen ransomware attack on Foxconn's North American facilities is one of more than 600 hits on manufacturers so far in 2026, as ransomware gangs...
- News
American Lending Center Data Breach Affects 123,000
The non-bank lender discovered a ransomware attack nearly one year ago but only recently completed its investigation, notifying over 123,000 individuals...
- News
Foxconn Confirms Cyberattack Claimed by Nitrogen Ransomware
Foxconn, the world's largest electronics manufacturer, confirmed a cyberattack on its North American factories claimed by the Nitrogen ransomware gang,...
- News
Foxconn Confirms North American Factories Hit by Cyberattack
Electronics manufacturing giant Foxconn has confirmed a cyberattack on its North American operations after the Nitrogen ransomware group claimed...
- News
Government to Scrutinize Instructure Over Canvas
The House Committee on Homeland Security has demanded a briefing from Instructure, the company behind the Canvas LMS platform, after a ransomware attack...
- News
Tables Turn on 'The Gentlemen' RaaS Gang With Data Leak
An OPSEC failure provides a rare window into the inner workings of The Gentlemen ransomware-as-a-service group, exposing their affiliate model, TTPs, and...
- News
Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65 TB Canvas Leak
Educational technology company Instructure, parent of Canvas LMS, has reached an undisclosed 'agreement' with the ShinyHunters extortion group after a...
- News
UK Fines Water Supplier $1.3M for Exposing Data of 664K
The UK's Information Commissioner's Office has fined South Staffordshire Water Plc and its parent company £963,900 ($1.3 million) after a cyberattack...
- News
West Pharmaceutical Services Hit by Disruptive Ransomware
West Pharmaceutical Services, a global manufacturer of drug delivery systems and packaging, has taken systems offline worldwide after hackers exfiltrated...
- News
West Pharmaceutical Warns of Ransomware Attack Impacting
West Pharmaceutical Services filed an SEC disclosure warning that hackers breached the company on May 4, stole data, and encrypted systems — forcing a...
- Newsletter
May 12 Digest: AI-Generated Zero-Day, Shai-Hulud Worm
Google confirms the first AI-generated zero-day in the wild; TeamPCP's Mini Shai-Hulud worm hits TanStack, Mistral AI, and Guardrails AI; Instructure pays...
- News
UK Water Utility Fined £963,900 After Cl0p Lurked
The UK's Information Commissioner's Office fined South Staffordshire Water nearly £1 million after the Cl0p ransomware group maintained undetected access...
- News
Canvas Breach Disrupts Schools & Colleges Nationwide
A data extortion attack against Canvas LMS defaced login pages with a ransom demand, disrupting classes and coursework at school districts and...
- News
Trellix Source Code Breach Claimed by RansomHouse Hackers
The RansomHouse threat group has claimed responsibility for the Trellix source code repository breach disclosed last week, leaking a set of proof images...
- News
Critical cPanel Flaw Mass-Exploited in 'Sorry' Ransomware
A newly disclosed critical vulnerability in cPanel and WHM tracked as CVE-2026-41940 is being mass-exploited by ransomware actors to breach web hosting...
- News
Cyber Incident Responders Sentenced to 4 Years for Carrying
Two cybersecurity incident responders who abused their trusted positions to secretly carry out ransomware attacks against the organizations they were...
- News
US Ransomware Negotiators Get 4 Years in Prison Over
Two former cybersecurity incident responders from Sygnia and DigitalMint were each sentenced to four years in federal prison for leveraging their trusted...
- News
Former Incident Responders Sentenced to 4 Years for Ransomware Attacks on Clients
Ryan Goldberg and Kevin Martin, who worked as incident responders, were sentenced to four years in federal prison after using their trusted access to...
- News
Sandhills Medical Says Ransomware Breach Affects 170,000
Healthcare organization took nearly one year to publicly disclose a data breach after being targeted by Inc Ransom ransomware, with approximately 170,000...
- News
Vect 2.0 Ransomware Acts as Wiper Thanks to Design Error
The emerging Vect 2.0 ransomware — deployed against TeamPCP supply chain attack victims — permanently destroys files larger than 131KB due to a critical...
- News
VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB
Threat hunters warn that VECT 2.0 ransomware contains a critical flaw in its encryption implementation that acts more like a wiper for files over 131KB...
- News
Broken VECT 2.0 Ransomware Acts as a Data Wiper for Large
Researchers have found that VECT 2.0 ransomware contains a critical flaw in its nonce handling that causes encryption to permanently destroy large files...
- News
Feuding Ransomware Groups Leak Each Other's Data
When rival ransomware groups 0APT and KryBit turned on each other, they exposed infrastructure details, operational data, victim lists, and internal...
- Newsletter
Apr 28 Digest: Medtronic 9M Breach, GitHub RCE, LiteLLM
ShinyHunters hits Medtronic and ADT in the same week, exposing millions of records; a critical one-push RCE lands in GitHub; LiteLLM's pre-auth SQL...
- News
CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal
CISA has added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known...
- News
Trigona Ransomware Deploys Custom CLI Exfiltration Tool in Active Attacks
Recently observed Trigona ransomware attacks are using a bespoke command-line exfiltration tool to steal data from compromised environments faster and...
- News
Former Ransomware Negotiator Pleads Guilty to BlackCat
Angelo Martino, 41, a former employee of cybersecurity incident response firm DigitalMint, has pleaded guilty to targeting U.S. companies with BlackCat...
- News
Kyber Ransomware Gang Uses Post-Quantum Encryption to Target Windows and ESXi
A new ransomware operation called Kyber is targeting Windows systems and VMware ESXi endpoints, with one variant implementing Kyber1024 post-quantum...
- News
Former DigitalMint Ransomware Negotiator Pleads Guilty to $75.3M Extortion Scheme
Angelo Martino, a former ransomware payment negotiator for DigitalMint, has pleaded guilty to helping accomplish extort $75.3 million in ransom from five...
- News
Surge in Bomgar RMM Exploitation Demonstrates Supply Chain
A critical RCE flaw in BeyondTrust Bomgar remote monitoring and management software is being actively exploited to spread ransomware and compromise...
- Newsletter
Apr 21 Digest: Vercel AI Tool Breach, DPRK $290M, ActiveMQ
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
- News
The Backup Myth That Is Putting Businesses at Risk
Backups protect your data, but they don't keep your business running during downtime. Understanding the difference between backup and BCDR is critical as...
- News
The Gentlemen Ransomware Now Uses SystemBC for Bot-Powered
Researchers have discovered a SystemBC proxy botnet of over 1,570 compromised hosts linked to Gentlemen ransomware operations. The gang's affiliate is...
- News
6-Year Ransomware Campaign Targets Turkish Homes and SMBs
A ransomware campaign operating since at least 2019 has persistently targeted Turkish home users and small-to-medium businesses, largely evading major...
- News
NAKIVO v11.2: Ransomware Defense, Faster Replication
NAKIVO Backup & Replication v11.2 is generally available, bringing immutable backup enhancements for ransomware defense, faster replication performance,...
- News
Payouts King Ransomware Uses QEMU Virtual Machines to Bypass Endpoint Security
The Payouts King ransomware group is deploying the QEMU open-source emulator as a covert reverse SSH backdoor, spinning up hidden virtual machines on...
- News
Ransomware Attack Still Disrupting London Healthcare Nearly
More than 18 months after a ransomware attack crippled hospitals in South East London, at least one NHS trust is still operating without fully restored...
- News
In Other News: Cyberattack Stings Stryker, Windows
A weekly roundup of notable cybersecurity stories: Iran-linked hackers wipe 200,000 Stryker devices, the BlueHammer Windows zero-day PoC goes public,...
- News
Dutch Hospitals Disrupted After Ransomware Hits Healthcare
A ransomware attack on Dutch healthcare software vendor ChipSoft has forced hospitals and patients across the Netherlands offline, disrupting the HiX...
- News
Healthcare IT Provider ChipSoft Hit by Ransomware Attack
Dutch healthcare software vendor ChipSoft has been struck by a ransomware attack, forcing the company to take its website and digital patient services...
- News
FBI: Cybercrime Losses Neared $21 Billion in 2025
The FBI received over 1 million complaints of malicious activity in 2025, with investment scams, business email compromise, and tech support fraud causing...
- News
China-Linked Storm-1175 Chains Zero-Days for High-Velocity
A China-based threat cluster designated Storm-1175 has been linked to high-velocity ransomware attacks deploying Medusa payloads using chained zero-day...
- News
Medusa Ransomware Is Fast to Exploit Fresh Vulnerabilities
SecurityWeek reports that the Medusa ransomware group has developed a dangerous capability: rapidly weaponizing newly disclosed vulnerabilities —...
- News
Medusa Ransomware Exploits Zero-Days to Deploy Ransomware
Microsoft has raised the alarm over Medusa ransomware's unprecedented operational speed, with the group now exploiting zero-day vulnerabilities before...
- News
Storm-1175 Deploys Medusa Ransomware at 'High Velocity'
Microsoft says the financially motivated cybercrime group Storm-1175, linked to China, has exploited N-day and zero-day vulnerabilities in high-velocity...
- HOWTO
What Rural Alberta Businesses Get Wrong About Ransomware
The five most common things rural Alberta business owners believe about ransomware that are wrong, expensive, and entirely fixable.
- Newsletter
Apr 7 Digest: Medusa Ransomware Surge, FBI $21B Record
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...
- News
BKA Identifies REvil Leaders Behind 130 German Ransomware
Germany's Federal Criminal Police Office has publicly unmasked the real identity of "UNKN," the primary operator behind the now-defunct REvil and GandCrab...
- News
German Authorities Identify REvil and GandCrab Ransomware
Germany's Federal Police have publicly named two Russian nationals as the leaders of the GandCrab and REvil ransomware operations, linking them to at...
- News
Medusa Ransomware Group Exploits Zero-Days to Strike Within
Microsoft warns that Medusa ransomware operators are exploiting zero-day vulnerabilities approximately one week before public disclosure, enabling the...
- News
Microsoft Links Storm-1175 to Medusa Ransomware Zero-Day
Microsoft has formally attributed Medusa ransomware zero-day attacks to Storm-1175, a China-based financially motivated cybercriminal group that has...
- News
Germany Doxes "UNKN," Head of RU Ransomware Gangs REvil
German authorities have publicly identified the elusive "UNKN," the operator behind the GandCrab and REvil ransomware groups, as 31-year-old Russian...
- News
Evolution of Ransomware: Multi-Extortion Ransomware Attacks
Modern ransomware has evolved far beyond simple file encryption. Multi-extortion tactics — combining encryption, data theft, and public leak threats —...
- News
Die Linke German Political Party Confirms Data Stolen by Qilin Ransomware
The Qilin ransomware group has claimed responsibility for an attack against German political party Die Linke, forcing an IT systems outage and threatening...
- News
In Other News: ChatGPT Data Leak, Android Rootkit, Water
This week's security stories you may have missed: a ChatGPT conversation data leak, a new Android rootkit on Google Play, a municipal water facility taken...
- News
Google Drive Ransomware Detection Now On by Default for Paying Users
Google has announced that its AI-powered ransomware detection feature for Google Drive has reached general availability and is now enabled by default for...
- News
Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key Operations
Iranian APT groups are increasingly blurring the lines between state-sponsored cyber espionage and financially motivated cybercrime, deploying destructive...
- News
Leak Bazaar: New Criminal Service Plans to Monetize Data
A new underground platform called Leak Bazaar positions itself as a data-processing business, offering to monetize stolen records on behalf of ransomware...
- News
Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks
A new report reveals how industrialized credential theft has become the common thread connecting ransomware campaigns, SaaS platform breaches, and...
- HOWTO
Why Every Business Needs Cyber Insurance in 2026
Cyber insurance stopped being optional for Canadian small businesses in 2024. By 2026 it's table-stakes — but most owners are walking into renewal without…
- Newsletter
Mar 31 Digest: Axios npm RAT, Claude Code Source Leaked
The Axios npm library was weaponized to deliver a cross-platform RAT; Anthropic accidentally leaked Claude Code's CLI source in an npm package; Google...
- News
Foster City Declares State of Emergency After Ransomware
A ransomware attack on March 19 paralyzed Foster City's government systems for over six days, forcing officials to declare a state of emergency while...
- News
Bearlyfy Hits Russian Firms with Custom GenieLocker
Pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian companies since January 2025, recently deploying a custom...
- Newsletter
Mar 27 Digest: EU Commission AWS Breach, DarkSword iOS
The European Commission confirms a 350 GB AWS breach; the DarkSword iOS exploit chain goes public on GitHub threatening hundreds of millions of iPhones;...
- News
Pro-Ukraine Hacker Group Bearlyfy Targets Russian Companies
The pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian businesses in the past year and is escalating operations...
- Newsletter
Mar 26 Digest: LeakBase Admin Arrested, WebRTC Skimmer
This week: Russian authorities detain the alleged LeakBase admin weeks after the FBI-led global crackdown on the 147,000-subscriber stolen-data...
- News
Manager of Botnet Used in Ransomware Attacks Gets 2 Years
Ilya Angelov, co-leader of the TA551/Mario Kart cybercrime group, was sentenced to two years in prison for operating a phishing botnet that sent 700,000...
- Newsletter
Mar 25 Digest: DarkSword Leaks iPhone Zero-Days
This week: the DarkSword iOS exploit chain published on GitHub threatens to democratize nation-state-grade iPhone hacking; CanisterWorm turns the Trivy...
- News
Russian Hacker Who Helped Yanluowang Ransomware Gang Gets
Aleksei Volkov, a Russian initial access broker who sold unauthorized access to U.S. companies for the Yanluowang ransomware group, has been sentenced to...
- News
Malaysia Airlines Listed by Qilin Ransomware Group
The Qilin ransomware-as-a-service group has listed Malaysia Airlines on its leak site, claiming access to passenger records, personnel files, and...
- News
Two US Cybersecurity Professionals Plead Guilty to BlackCat
Former incident responder Ryan Goldberg and ransomware negotiator Kevin Martin admitted to running ALPHV/BlackCat ransomware operations against five US...
- News
Interlock Ransomware Exploited Cisco FMC Zero-Day for 36
CVE-2026-20131, a maximum-severity CVSS 10.0 insecure deserialization flaw in Cisco Firepower Management Center, was exploited by Interlock ransomware as...
- News
Marquis Fintech Breach Exposes 672,000 Banking Customers
Plano-based fintech vendor Marquis disclosed that a ransomware attack exploiting a SonicWall firewall vulnerability compromised Social Security numbers,...
- News
CISA Adds Zimbra XSS and SharePoint RCE to KEV; Cisco FMC
CISA added actively exploited Zimbra Collaboration Suite and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog on March...
- News
Marquis Ransomware Breach: 672K People Exposed as Attack
Texas fintech Marquis Software Solutions has confirmed a ransomware attack in August 2025 exposed data of 672,000+ individuals and disrupted operations at...
- News
Interlock Ransomware Has Been Exploiting Cisco FMC Zero-Day
The Interlock ransomware gang has been actively exploiting a CVSS 10.0 insecure deserialization flaw in Cisco Secure Firewall Management Center since late...
- News
LeakNet Ransomware Weaponizes ClickFix and Deno Runtime for Stealthy Corporate Attacks
The LeakNet ransomware gang is using ClickFix social engineering for initial access and a Deno-based malware loader to execute fileless payloads from...
- Newsletter
Mar 17 Digest: GlassWorm Poisons Python, n8n RCE Hits KEV
This week: GlassWorm escalates with 72 malicious Open VSX extensions and a GitHub token force-push campaign poisoning hundreds of Python repos; CISA adds...
- News
Operation Synergia III: Police Sinkhole 45,000 IPs in Global Cybercrime Crackdown
An international law enforcement operation codenamed Operation Synergia III has sinkholed 45,000 IP addresses and seized servers linked to ransomware,...
- News
England Hockey Investigating Data Breach After AiLock
England Hockey, the national governing body for field hockey in England, is investigating a potential data breach after the AiLock ransomware group listed...
- News
Telus Digital Confirms Massive Breach After ShinyHunters
Canadian telecom giant Telus Digital has confirmed a security incident after the ShinyHunters hacking group claimed to have stolen nearly 1 petabyte of...
- Newsletter
Mar 11 Digest: npm Supply Chain Seizes AWS Admin, 3.4M
This week: UNC6426 weaponizes a stale npm supply chain compromise to seize full AWS admin in 72 hours, Cognizant TriZetto leaks 3.4 million patient...
- News
Termite Ransomware Operator Velvet Tempest Chains ClickFix
Microsoft-tracked threat actor Velvet Tempest is deploying Termite ransomware via a ClickFix social-engineering chain that loads DonutLoader and installs...
- News
Phobos Ransomware Admin Pleads Guilty — 1,000+ Victims
Evgenii Ptitsyn, 43, a Russian national who administered the Phobos ransomware-as-a-service operation, pleaded guilty to wire fraud conspiracy in the U.S....
- News
Former Cybersecurity Responders Plead Guilty to BlackCat Attacks
An incident response manager and a ransomware negotiator face up to 20 years after admitting to conducting BlackCat (ALPHV) ransomware attacks against...
- News
Ransomware Forces University of Mississippi Medical Center
A ransomware attack detected February 19 has taken down UMMC's EPIC EMR system and forced all 35 health clinics across Mississippi to close, canceling...
- Newsletter
Feb 25 Digest: Ransomware Hits Healthcare & Semiconductors
This week: UMMC closes 35 clinics after ransomware, Advantest semiconductor supplier hit, AT&T's 2024 breach resurfaces with 148M decrypted SSNs, Diesel...
- News
Japanese Semiconductor Giant Advantest Hit by Ransomware
Advantest Corporation, the world's leading manufacturer of semiconductor test equipment supplying companies like TSMC, Intel, and Samsung, disclosed a...
- News
HellCat Ransomware Group Breaches Ascom, Exfiltrates 44GB
The HellCat ransomware group has breached Swiss enterprise communications provider Ascom by exploiting Jira credentials harvested through infostealer...
- News
Conduent Breach Balloons to Tens of Millions of Americans
The January 2025 ransomware attack on government technology giant Conduent continues to expand in scope, now confirmed to affect 15.4 million in Texas and...
- News
Nova (RALord) Ransomware Group Confirmed Active with 73
The Nova ransomware group, formerly known as RALord, has been confirmed fully operational with 73 victims across nearly every continent, employing double...
- News
Reynolds Ransomware Embeds BYOVD Driver to Disable EDR
A new ransomware strain called Reynolds bundles a Bring Your Own Vulnerable Driver component directly in its payload, killing EDR processes from...
- News
Warlock Ransomware Breaches SmarterTools via Its Own
The Warlock ransomware group exploited CVE-2026-23760, an authentication bypass zero-day in SmarterMail, to breach SmarterTools itself, compromise 12...
- News
Ransomware in 2026: Data-Only Extortion Replaces Encryption
With 91 publicly disclosed ransomware attacks in January 2026 alone, the ransomware landscape is shifting toward data-only extortion while healthcare...
- News
Romania's Oil Pipeline Operator Conpet Hit by Qilin Ransomware
The Qilin ransomware group has compromised Romania's national oil pipeline operator Conpet, exfiltrating over 1 TB of data including passports, internal...
- News
Ransomware Attacks Surge 49% Year-Over-Year: BlackFog 2026
BlackFog's 2025 State of Ransomware Report reveals a 49% increase in ransomware attacks year-over-year, with evolving tactics shifting toward...
- News
Ransomware Costs Projected to Hit $74 Billion in 2026, 30%
Cybersecurity Ventures forecasts ransomware damage costs will surge to $74 billion globally in 2026, up from $57 billion in 2025, as attacks grow more...
- News
BridgePay Payment Gateway Knocked Offline by Ransomware
Major U.S. payment processor BridgePay remains completely offline after a ransomware attack, forcing merchants nationwide to revert to cash-only operations.
- Security
WinRAR Path Traversal Flaw CVE-2025-8088 Actively Exploited
Critical path traversal vulnerability in WinRAR enables ransomware and credential theft as Russian and Chinese threat actors weaponize phishing campaigns...
- Newsletter
Global Threat Intelligence & New Tools - Issue #3
This week: state-backed espionage campaigns across 155 countries, China-linked router hijacking, ransomware surge, new security tools, and site updates.
- News
ShinyHunters Dumps 5.1 Million Panera Bread Customer
The ShinyHunters hacking group published a 760 MB archive of 5.1 million Panera Bread customer records on the dark web after the company refused to pay a...
- Security
Conduent Breach Expands: 15.4 Million Texans Affected, 8TB
Government technology provider Conduent's January 2025 ransomware breach now confirmed to affect at least 15.4 million people in Texas alone, with 8TB of...
- Security
Iron Mountain Responds to Everest Ransomware Breach Claims
Information management giant Iron Mountain clarifies that alleged 1.4TB breach was limited to marketing materials after single credential compromise.
- News
The Rise of Ransomware-as-a-Service: 14 Active Platforms
Security researchers identify 14 active RaaS platforms operating sophisticated affiliate programs, with entry costs as low as $40 per month lowering the...
- News
Ransomware Attacks Surge in Early 2026 with 26 Claims in One Day
Threat intelligence reports show 8 active ransomware groups claimed 26 victims on February 2nd alone, with major corporations including BASF and Honeywell...
- HOWTO
Incident Response Playbook: Ransomware
Complete ransomware incident response playbook following NIST framework. Covers detection, containment, eradication, recovery, and lessons learned.
- News
Healthcare Sector Faces Unprecedented Ransomware Surge in 2026
Ransomware attacks against healthcare organizations have increased 67% in the first month of 2026, with multiple hospital systems reporting service disruptions.
- News
Covenant Health Ransomware Attack Impacts 478,000 Patients
Qilin ransomware group claims responsibility for massive healthcare breach, stealing 850GB of sensitive patient data across multiple states. Initial...
- News
Cybersecurity Predictions 2026: The Hype We Can Ignore and the Real Risks
Industry experts separate signal from noise in 2026's threat landscape. AI-powered attacks, supply chain risks, and the evolution of ransomware top the...
- News
Sedgwick Government Solutions Hit by TridentLocker
Claims administration firm Sedgwick confirms cybersecurity incident at government subsidiary after TridentLocker ransomware group claims theft of 3.4 GB...