#ransomware
-
CISA: WatchGuard Firebox Flaw Now Exploited by Ransomware Gangs Too
The US cybersecurity agency has confirmed that a critical RCE vulnerability in WatchGuard Firebox firewalls is being used in ransomware attacks. Nine months after the patch shipped, thousands of unprotected devices remain online.
-
Criminals Don't Want Elegant Attacks — They Want Repeatable Ones
An analytical breakdown from The Hacker News explains why cybercrime has turned into a generics manufacturing business: attackers don't invent, they replicate what others have already built.
-
Aurora Operators Use the Cursor AI Assistant to Breach Networks
The Russian-speaking ransomware group Aurora had the agentic AI assistant Cursor plan attacks and carry out exploitation. A leak of its infrastructure exposed the toolkit, chat history and ransom negotiations.
-
Berlin Refuses to Pay Ransom for Stolen City Network Data
The government of the state of Berlin has confirmed it was blackmailed following an August breach of its administrative network and declared that it will not give in to the attackers' demands.
-
ATF Confirms “Major Incident” Following Qilin Ransomware Claims
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives has acknowledged a breach of one of its systems after the Qilin gang added the agency to its leak site.
-
SynkLoader: New Malware Strikes Through Microsoft Teams Phishing
Researchers at Expel have discovered a previously unknown piece of malware called SynkLoader that steals corporate passwords through a fake Windows lock screen. The attack begins with a message from a bogus IT support desk in Teams.
-
“Ransom Busters”: A Ransomware Affiliate Posing as Rescuers
Researchers at GuidePoint have found that a “post-attack recovery” firm is, in all likelihood, the author of those very attacks, trying to snatch the ransom out from under its own employers.
-
CISA: Windows Task Host Vulnerability Now in the Ransomware Playbook
The US agency CISA has confirmed that ransomware groups are exploiting a privilege-escalation vulnerability in the Windows Task Host component. The flaw was patched back in November 2025, but the attacks continue.
-
Chinese APT Group Exploits VMware vCenter Flaw and Deploys Babuk-Based Ransomware
German firm QUIRSO has attributed the exploitation of a fresh vulnerability, CVE-2026-59310, with moderate confidence to a Chinese-speaking group that has hit 361 systems across 47 countries.
-
Shell investigates a “possible incident” after Clop claims theft of 89 GB of data
Oil and gas giant Shell has confirmed that it is looking into a potential breach after the ransomware group Clop claimed to have stolen 89 GB of corporate data.
-
CISA: SharePoint Vulnerability Being Used in Ransomware Attacks
The US agency CISA has confirmed that ransomware groups have begun exploiting a serious remote code execution vulnerability in Microsoft SharePoint. Active attacks have been observed since early July.
-
US and South Korea Warn of Gunra Ransomware Attacks on Government Agencies
US federal agencies and South Korea's National Police Agency have urged government organizations and critical infrastructure facilities worldwide to defend themselves against the Gunra ransomware, which is built on leaked Conti code.
-
Storm-1175 Switches to a New Ransomware Strain, StormEncryptor
Microsoft reports that the China-linked group Storm-1175 has abandoned Medusa in favor of a previously undocumented ransomware, StormEncryptor, breaking into networks through a fresh vulnerability in N-able N-central.
-
SonicWall SMA1000 Vulnerabilities Now Weaponized by Ransomware Operators
CISA has confirmed that ransomware gangs have begun exploiting two recently patched vulnerabilities in SonicWall SMA1000 remote access gateways, including a critical SSRF flaw.
-
INC Ransomware Emerges as the Top Exploiter of SonicWall SMA 1000 Vulnerabilities
According to Resecurity, since early August 2026 the INC Ransomware group has been actively exploiting a chain of vulnerabilities in SonicWall VPN appliances to breach corporate networks.
-
DevMan Turned Extortion Into SaaS: A Single Portal for Affiliates
Switzerland's PRODAFT has described the web platform of the DevMan group, where affiliates build malicious payloads, negotiate with victims and collect payouts. A separate thread became the scandal around a Huntress employee who leaked FBI inquiries to the extortionists.
-
OnTrac Notifies Customers of Data Breach After Network Hack
American courier company OnTrac has disclosed that attackers broke into its corporate network and may have gained access to customers' personal data.
-
Clop Hits PTC Windchill and FlexPLM Through Critical Vulnerability
The Clop ransomware gang is exploiting a critical vulnerability in PTC's PLM platforms to steal corporate customers' data and demand ransoms.
-
msaRAT: the backdoor that hides its C2 traffic inside Chrome and Edge
The Chaos group is deploying a new Rust-based backdoor that routes command-and-control traffic through the system's own browser, leaving almost no trace on the network.
-
Swiss train maker Stadler refuses to pay $12.3M ransom
The Everest group demanded roughly 10 million Swiss francs from Stadler Rail after breaching a data-exchange platform the company shared with one of its suppliers. Stadler said it would not pay under any circumstances.
- More