#ransomware
-
Japan's GMO urges customers to shut down their PCs over ransomware threat
An attacker who breached the Onamae Desktop Cloud service threatened to trigger ransomware on customer servers. GMO refused to pay and asked users to disconnect and power down their PCs.
-
AI Agents on the Job: Ransomware Crews Automate Break-Ins With the Phantom Framework
SOCRadar researchers uncovered an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups. At its core is Phantom, where a human merely sets the target and approves each step while commercial language models do the work.
-
The k0t Campaign: Enterprise Firewalls Breached, 70,000+ Credentials Exposed
Researchers at Group-IB and NyxLab have detailed a large-scale campaign against internet-facing Fortinet and Palo Alto Networks edge devices. A threat actor known as k0t compromised organizations worldwide and harvested over 70,000 credentials.
-
CISA: SafePay ransomware has breached 600+ critical infrastructure orgs
The U.S. agency CISA reports that since August 2024 the SafePay gang has breached over 600 critical infrastructure organizations worldwide, becoming one of the most active ransomware operations.
-
UK Legal Aid Agency: Stolen records reach all the way back to 1978
A deeper look into the April 2025 breach of the UK's Legal Aid Agency reveals that attackers made off with records stretching back nearly five decades.
-
FBI Arrests Founder of a Ransomware Negotiation Firm
A Canadian who specialized in negotiating with ransomware crews was arrested in Pennsylvania. He is tied to the investigation into ShinyHunters, the group that stole data on thousands of FBI employees.
-
Germany arrests alleged core member of Qilin ransomware group
A Russian national believed to be a leading figure in the Qilin ransomware group has been extradited from Japan to Germany. He was detained in Osaka after flying in as a tourist.
-
Ransomware attack knocks out Japan's IDCF Cloud
SoftBank subsidiary IDC Frontier says its IDCF Cloud service was hit by ransomware. The outage struck a data center cluster in eastern Japan and affected nearly 500 customers, including government bodies.
-
Ransomware recovery CEO charged over secret ransom payments
The founder of MonsterCloud has been charged with fraud: instead of the proprietary decryption technology he advertised, prosecutors say he quietly paid the attackers themselves — while billing clients many times more.
-
ShinyHunters Leader Nabbed Mid-Extortion of Boeing Spin-off
A teenager from Amman who led the data-theft gang has been detained and, per Reuters, is now cooperating with the FBI. He was caught while his group was extorting a former Boeing unit, Jeppesen ForeFlight.
-
FBI: FortiBleed Harvested 86,644 Fortinet Device Credentials and Is Still Active
The FBI and U.S. Secret Service warned that the FortiBleed credential-harvesting campaign remains an active threat to internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
-
Warlock Keeps Exploiting SharePoint Flaws to Hit Critical Infrastructure
The suspected China-linked Warlock group continues to weaponize Microsoft SharePoint vulnerabilities, disable security tools, and deploy ransomware. Its recent victims span Portuguese- and Spanish-speaking countries.
-
Police take down KillSec ransomware gang allegedly run by a 16-year-old
An international effort codenamed Operation KillSwitch seized the servers and leak site of the KillSec ransomware gang, arrested three suspects, and named a 16-year-old as its alleged lead operator.
-
JADEPUFFER-Linked Attackers Wiped Azure Resources via Compromised Service Principals
Microsoft has detailed a destructive cloud attack that unfolded over 18 hours in an Azure environment using two stolen service principals. The company ties it to the JADEPUFFER threat actor and calls it an evolution of its tradecraft.
-
ShinyHunters breached Clop's leak site via a Grav CMS path traversal flaw
The Clop ransomware crew has moved its leak site to a new Tor address after admitting its old server was hacked and defaced through an unpatched path traversal flaw in Grav CMS.
-
CISA: Ransomware gangs now exploiting critical TeamCity flaw
The U.S. cybersecurity agency CISA warned that a critical JetBrains TeamCity flaw patched in July is now being abused by ransomware gangs.
-
Kaspersky: Three Groups Are Attacking Russian Companies — Backdoors, Ransomware and Wipers
Kaspersky Lab has detailed campaigns by the NightEagle, Hacking Cat and Toy Ghouls clusters against Russian enterprises: from stealthy espionage to destructive attacks.
-
Ransomware Gangs Join Attacks on Critical VMware vCenter RCE Flaw
CISA warns that ransomware operations have joined the exploitation of a critical vCenter vulnerability that Broadcom patched back in July.
-
Conti Ransomware Gang Member Sentenced to Four Years in Prison
Ukrainian national Oleksii Lytvynenko has been sentenced to four years in prison for taking part in Conti ransomware attacks in 2021–2022. He was extradited from Ireland at the request of the United States.
-
Mantax Otax: The Android Malware That Encrypts, Spies On and Intimidates Its Victims
A new Android malware called Mantax Otax combines the functions of ransomware and spyware, and in its second version it has picked up an arsenal for putting psychological pressure on the victim.
- More