Tag: ransomware

AI, Apps, Compliance, Exploits, Global Security News, Government & Policy, malware, Network Security

Amazon threat intelligence teams identify Interlock ransomware campaign targeting enterprise firewalls

March 18, 2026

Amazon threat intelligence has identified an active Interlock ransomware campaign exploiting CVE-2026-20131, a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device, which was disclosed by Cisco on March 4, 2026. After Cisco’s disclosure, Amazon threat…

Marquis: Ransomware gang stole data of 672K people in cyberattack

March 18, 2026

Marquis, a Texas-based financial services provider, revealed this week that a ransomware gang stole the data of over 670,000 individuals in an August 2025 cyberattack that also disrupted operations at 74 banks across the United States. […]

Less Lucrative Ransomware Market Forces Attackers to Adapt Their Strategies

March 18, 2026

As ransomware payouts plummet, attackers are shifting tactics, using simpler tools to adapt to the changing cybersecurity landscape.

Less Lucrative Ransomware Market Makes Attackers Alter Methods

March 17, 2026

Ransomware actors are ditching Cobalt Strike in favor of native Windows tools, as payment rates hit record lows and data theft surges.

Ransomware’s Opening Play: Target Identity First

March 17, 2026

For years, ransomware attacks followed a familiar script. Threat actors gained entry through a vulnerable server, a phishing email, or malicious software on an endpoint. Once inside, they moved laterally through the network, then encrypted systems and demanded payment. That playbook has changed. Today’s ransomware operators increasingly target identity infrastructure as their first objective. Active…

Eon Launches Ransomware Protection for Cloud Databases

March 17, 2026

As enterprises move critical workloads to managed cloud databases, a growing ransomware recovery gap is emerging across modern cloud infrastructure. Eon is aiming to close that gap with new ransomware protection designed specifically for managed cloud database environments. The new capability expands Eon’s ransomware protection suite and focuses on detecting corruption and restoring trusted data…

LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

March 17, 2026

The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method. The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen…

LeakNet ransomware uses ClickFix and Deno runtime for stealthy attacks

March 17, 2026

The LeakNet ransomware gang is now using the ClickFix technique for initial access into corporate environments and deploys a malware loader based on the open-source Deno runtime for JavaScript and TypeScript. […]

The ransomware economy is shifting toward straight-up data extortion

March 16, 2026

Ransomware remains a scourge that shows some signs of relenting, but incident responders and threat hunters are busier than ever as more financially-motivated attackers lean exclusively on data theft for extortion. Attacks that only involve data theft for extortion may not be more prevalent than traditional ransomware when attackers encrypt systems, but momentum is moving…

Payload Ransomware claims the hack of Royal Bahrain Hospital

March 15, 2026

The Payload Ransomware group claims to have breached the Royal Bahrain Hospital (RBH), a leading healthcare facility in Bahrain. The Payload Ransomware group claims to have hacked the Royal Bahrain Hospital (RBH) and stolen 110 GB of data. The ransomware gang added the healthcare facility to its Tor data leak site and published the images…

The Unseen Crisis: Cybersecurity Challenges Faced by Nonprofits

March 14, 2026

Nonprofits face escalating cyber threats due to security gaps; discover the urgent need for enhanced protection in this critical landscape.

AiLock Ransomware Claims England Hockey Data Breach

March 13, 2026

England Hockey is investigating a potential cyberattack after a ransomware group claimed to have stolen sensitive data from its systems and threatened to publish it online. The AiLock ransomware gang recently listed the organization on its public data leak site, claiming to have exfiltrated large volumes of internal data as part of the attack. “We…

Interpol’s ‘Operation Synergia III’ Nets 94 Arrests in Major Cybercrime Sweep

March 13, 2026

A new law enforcement operation against phishing and ransomware operators led to the takedown of 45,000 malicious IP addresses

Iran’s MOIS Collaborates with Cybercriminals to Amplify Cyberattacks

March 13, 2026

Discover how Iran’s intelligence agency is teaming up with cybercriminals, escalating global cyber threats and reshaping the landscape of cyberattacks.

Feds say another DigitalMint negotiator ran ransomware attacks and extorted $75 million

March 12, 2026

A 41-year-old South Florida man is accused of conducting at least 10 ransomware attacks and extorting a combined $75.25 million in ransom payments while he was working as a ransomware negotiator for DigitalMint. Five of Angelo John Martino III’s alleged victims hired DigitalMint, which assigned Martino to conduct ransomware negotiations on their clients’ behalf —…

INC Ransomware Group Disrupts Healthcare in Oceania

March 11, 2026

The INC ransomware group is wreaking havoc on healthcare systems in Oceania, threatening patient care and demanding ransoms for access restoration.

France: National Cybersecurity Agency Reports Ransomware Attack Drop in 2025

March 11, 2026

French small and medium businesses remained the organizations most targeted by ransomware in 2025

Termite ransomware breaches linked to ClickFix CastleRAT attacks

March 7, 2026

Ransomware threat actors tracked as Velvet Tempest are using the ClickFix technique and legitimate Windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor. […]

Phobos Ransomware admin faces up to 20 years after guilty plea

March 5, 2026

Russian national Evgenii Ptitsyn (43) pleaded guilty in the U.S. for his role in the Phobos ransomware operation. Russian national Evgenii Ptitsyn pleaded guilty in the US to wire fraud conspiracy for his role in the Phobos ransomware scheme. The man was arrested in South Korea in 2024 and extradited to the United States. He…

Phobos ransomware leader pleads guilty, faces up to 20 years in prison

March 5, 2026

Russian national Evgenii Ptitsyn pleaded guilty to running the Phobos ransomware outfit that extorted more than $39 million from more than 1,000 victims globally, the Justice Department said Wednesday. Ptitsyn assumed a leadership role in the Phobos ransomware group in January 2022, yet his criminal activities began by April 2019, according to court records. He…

Ransomware Breach at University of Hawaii Cancer Center Affects 1.2M People

March 4, 2026

The University of Hawaii Cancer Centre has confirmed a massive ransomware attack affecting 1.24 million people. Sensitive data, including Social Security numbers and historical voter records dating back to 1993, was compromised.

Data breach at University of Hawaiʻi Cancer Center impacts 1.2 Million individuals

March 4, 2026

A ransomware attack on the University of Hawaiʻi Cancer Center exposed personal data of 1.2 million people. A 2025 ransomware attack targeting the University of Hawaiʻi Cancer Center compromised the personal information of about 1.2 million individuals. The attack hit the University of Hawaiʻi Cancer Center on August 31, 2025, impacting servers that support research…

UH Cancer Center data breach affects nearly 1.2 million people

March 3, 2026

The University of Hawaii confirmed that a ransomware gang stole the data of nearly 1.2 million individuals in August 2025 after breaching its Cancer Center’s Epidemiology Division. […]

Ransomware Payments Decline 8% as Attacks Surge 50%

March 2, 2026

Chainalysis reveals a big surge in median ransomware payment size in 2025 despite overall drop in criminal revenue

Ransomware groups switch to stealthy attacks and long-term access

February 27, 2026

Ransomware attackers are switching tactics in favor of more stealthy infiltration, as the threat of public exposure of sensitive corporate data is becoming the main mechanism of extortion. Picus Security’s annual red-teaming report shows attackers shifting away from loud disruption toward quiet, long-term access — or from “predatory” smash-and-grab tactics to “parasitic” silent residency. Four…

Ransomware payment rate drops to record low as attacks surge

February 26, 2026

The number of ransomware victims paying threat actors has dropped to 28% last year, an all-time low, despite a significant increase in the number of claimed attacks. […]

Ransomware payment rate drops to record low as attacks surge

February 26, 2026

The number of ransomware victims paying threat actors has dropped to 28% last year, an all-time low, despite a significant increase in the number of claimed attacks. […]

Lazarus APT group deployed Medusa Ransomware against Middle East target

February 25, 2026

North Korea’s Lazarus Group used Medusa ransomware in an attack on an unnamed Middle East organization, researchers report. The North Korea-linked Lazarus APT Group, also known as Diamond Sleet and Pompilus, has been spotted deploying Medusa ransomware against an unnamed organization in the Middle East, according a new report from the Symantec and Carbon Black…

North Korean Lazarus Group Adopts Medusa Ransomware in Global Attacks

February 24, 2026

Lazarus Group is now using Medusa ransomware in attacks on healthcare and social services, signaling a move toward profit-focused cybercrime.

What are the types of ransomware attacks?

February 24, 2026

Ransomware isn’t an isolated, potential cyber threat—it’s like a living organism that can shapeshift with multiple strains, tactics, and targets. The cybercriminals behind ransomware attacks run these operations like a business and are motivated to keep up profits at any cost. Their tactics range from quickly locking down an entire network to slowly leaking sensitive…

North Korean Lazarus Group Expands Ransomware Activity With Medusa

February 24, 2026

Ransomware Medusa linked to North Korean hackers targets US healthcare amid ongoing attacks

Everest ransomware hits Vikor Scientific ‘s supplier, data of 140,000 patients stolen

February 24, 2026

Everest ransomware claims an attack on diagnostic firm Vikor Scientific (Vanta Diagnostics), exposing data of nearly 140,000 people. The Everest ransomware group has claimed responsibility for a cyberattack on Vikor Scientific, now operating as Vanta Diagnostics. The healthcare diagnostic firm disclosed a data breach impacting nearly 139,964 individuals, as reported by the US Department of…

Global Chip Supplier Advantest Discloses Cyber Incident

February 23, 2026

Japanese semiconductor equipment company Advantest has confirmed it was hit by a ransomware attack after detecting unusual activity inside its corporate network on February 15. The company says an unauthorized third party may have accessed internal systems and deployed ransomware, potentially affecting sensitive data tied to customers or employees. “Preliminary findings appear to indicate that…

Japanese chip-testing toolmaker Advantest suffers ransomware attack

February 23, 2026

Japanese tech testing company Advantest has suffered a ransomware attack, the company confirmed last Thursday, after detecting unusual activity within its IT environment on February 15, 2026. What happened? Tokyo-based Advantest is a leading manufacturer of automatic test and measurement equipment used in the design and production of semiconductors that used in computers, electronic devices…

University of Mississippi Medical Center Still Offline After Ransomware Attack

February 23, 2026

University of Mississippi Medical Center is still scrambling to respond to a ransomware attack last Thursday

University of Mississippi Medical Center Closes Clinics After Ransomware Attack

February 20, 2026

A ransomware attack has forced the University of Mississippi Medical Center (UMMC) to temporarily close most of its clinics, cancel elective procedures, and shift to manual documentation as IT systems remain offline. The incident, detected in the early hours of Feb. 19, 2026, disrupted UMMC’s network, including its EPIC electronic medical record (EMR) platform. “We…

Barracuda: Firewall Exploits Drive 90% of Ransomware Incidents

February 20, 2026

Ninety percent of ransomware incidents in 2025 reportedly exploited firewalls via unpatched software or a vulnerable account, according to Barracuda Networks’ newly published Barracuda Managed XDR Global Threat Report. Outdated tools and remote access abuse heighten ransomware exposure According to the cybersecurity company, the findings show how attackers exploit legitimate IT tools such as remote…

Japanese tech giant Advantest hit by ransomware attack

February 20, 2026

Advantest Corporation disclosed that its corporate network has been targeted in a ransomware attack that may have affected customer or employee data. […]

The era of the Digital Parasite: Why stealth has replaced ransomware

February 18, 2026

For years, ransomware encryption functioned as the industry’s alarm bell. When systems locked up, defenders knew an attack had occurred. Not anymore. New empirical data show that attackers are actively dismantling that signal. According to Picus Security’s Red Report 2026, adversaries are no longer optimizing for disruption; they’re optimizing for residency. Based on a thorough…

Record Number of Ransomware Victims and Groups in 2025

February 18, 2026

Searchlight Cyber reports a 30% annual increase in ransomware victim numbers in 2025

Japan’s Washington Hotel Reports Ransomware Attack

February 17, 2026

Washington Hotel Corporation has confirmed a ransomware attack that compromised several internal servers, triggering containment measures and an ongoing investigation into potential data exposure. The incident was detected when unauthorized access was identified across multiple systems. “Unauthorized access to various business data stored on our servers has been confirmed. The information leak is currently under…

Polish authorities arrest alleged Phobos ransomware affiliate

February 17, 2026

Polish officials arrested a 47-year-old man accused of participating in ransomware attacks as an affiliate for the Phobos ransomware group, the country’s Central Bureau for Combating Cybercrime said Tuesday. Authorities did not name the man who was arrested during a raid on his apartment in the Małopolskie province, but said he faces up to five…

Significant Rise in Ransomware Attacks Targeting Industrial Operations

February 17, 2026

Dragos annual report warns of a surge in ransomware attacks causing increased operational disruption in industrial environments

Poland arrests suspect linked to Phobos ransomware operation

February 17, 2026

Polish police have detained a 47-year-old man suspected of ties to the Phobos ransomware group and seized computers and mobile phones containing stolen credentials, credit card numbers, and server access data. […]

LockBit 5.0 ransomware expands its reach across Windows, Linux, and ESXi

February 16, 2026

The Acronis Threat Research Unit (TRU) has identified a new and significantly enhanced version of the LockBit ransomware, LockBit 5.0, currently being deployed in active campaigns. The latest variant demonstrates expanded cross-platform capabilities, enabling attackers to target Windows, Linux, and VMware ESXi systems within a single coordinated attack. According to analysis, LockBit 5.0 introduces dedicated…

Why identity recovery is now central to cyber resilience

February 12, 2026

Ransomware has permanently changed how security leaders think about risk. Verizon’s 2025 Data Breach Investigations Report found that ransomware was involved in 44% of all breaches. For small and midsize businesses, the problem is big; ransomware was involved in nearly nine out of 10 breaches, compared to it playing a role in 39% of incidents…

Romania’s oil pipeline operator Conpet confirms data stolen in attack

February 12, 2026

Romania’s national oil pipeline operator, Conpet S.A., confirmed that the Qilin ransomware gang stole company data in an attack last week. […]

0APT ransomware group rises swiftly with bluster, along with genuine threat of attack

February 11, 2026

Most signs suggest the group is running a massive hoax by claiming hundreds of initial victims, but at least some of the threat 0APT poses is grounded in truth backed by proven capabilities.

The post 0APT ransomware group rises swiftly with bluster, along with genuine threat of attack appeared first on CyberScoop.

Crazy ransomware gang abuses employee monitoring tool in attacks

February 11, 2026

A member of the Crazy ransomware gang is abusing legitimate employee monitoring software and the SimpleHelp remote support tool to maintain persistence in corporate networks, evade detection, and prepare for ransomware deployment. […]

Reynolds ransomware uses BYOVD to disable security before encryption

February 11, 2026

Researchers discovered Reynolds ransomware, which uses BYOVD technique to disable security tools and evade detection before encryption. Researchers found a new ransomware, named Reynolds, that implements the Bring Your Own Vulnerable Driver (BYOVD) technique to disable security tools and evade detection before encrypting systems. Broadcom’s cybersecurity researchers initially attributed the attack to Black Basta due…

Emerging Ransomware BQTLock & GREENBLOOD Disrupt Businesses in Minutes

February 11, 2026

How long would it take your team to realize ransomware is already running? The newly identified ransomware families are already causing real business disruption. These threats can disrupt operations fast while also reducing visibility through stealth or cleanup activity, shrinking the time teams have to detect and contain the attack. Here’s what you should know about BQTLock and GREENBLOOD, and how your team can detect and contain them before…

Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools

February 10, 2026

Cybersecurity researchers have disclosed details of an emergent ransomware family dubbed Reynolds that comes embedded with a built-in bring your own vulnerable driver (BYOVD) component for defense evasion purposes within the ransomware payload itself. BYOVD refers to an adversarial technique that abuses legitimate but flawed driver software to escalate privileges and disable Endpoint Detection

From Ransomware to Residency: Inside the Rise of the Digital Parasite

February 10, 2026

Are ransomware and encryption still the defining signals of modern cyberattacks, or has the industry been too fixated on noise while missing a more dangerous shift happening quietly all around them? According to Picus Labs’ new Red Report 2026, which analyzed over 1.1 million malicious files and mapped 15.5 million adversarial actions observed across 2025,…

Senegal shuts National ID office after ransomware attack

February 10, 2026

Senegal closed its national ID card office after a ransomware cyberattack disrupted ID, passport, and biometric services. Senegal confirmed a cyberattack on the Directorate of File Automation, the government office that manages national ID cards, passports, and biometric data. After ransomware claims surfaced, authorities temporarily closed the office to contain the incident. The agency warned…

Warlock Ransomware Breaches SmarterTools Through Unpatched SmarterMail Server

February 10, 2026

SmarterTools confirmed last week that the Warlock (aka Storm-2603) ransomware gang breached its network by exploiting an unpatched SmarterMail instance. The incident took place on January 29, 2026, when a mail server that was not updated to the latest version was compromised, the company’s Chief Commercial Officer, Derek Curtis, said. “Prior to the breach, we…

Warlock Gang Breaches SmarterTools Via SmarterMail Bugs

February 9, 2026

The ransomware group breached SmarterTools through a vulnerability in the company’s own SmarterMail product.

Warlock Gang Breaches SmarterTools Via SmarterMail Bugs

February 9, 2026

The ransomware group breached SmarterTools through a vulnerability in the company’s own SmarterMail product.

Hackers Deliver Global Group Ransomware Offline via Phishing Emails

February 9, 2026

Global Group ransomware is delivered through phishing emails and can encrypt files offline without any internet connection.

Hackers Deliver Global Group Ransomware Offline via Phishing Emails

February 9, 2026

Global Group ransomware is delivered through phishing emails and can encrypt files offline without any internet connection.

Hackers Deliver Global Group Ransomware Offline via Phishing Emails

February 9, 2026

Global Group ransomware is delivered through phishing emails and can encrypt files offline without any internet connection.

Black Basta Bundles BYOVD With Ransomware Payload

February 9, 2026

Researchers discovered a newly disclosed vulnerable driver embedded in Black Basta’s ransomware, illustrating the increasing popularity of the defense-evasion technique.

Black Basta Bundles BYOVD With Ransomware Payload

February 9, 2026

Researchers discovered a newly disclosed vulnerable driver embedded in Black Basta’s ransomware, illustrating the increasing popularity of the defense-evasion technique.

Hackers breach SmarterTools network using flaw in its own software

February 9, 2026

SmarterTools confirmed last week that the Warlock ransomware gang breached its network after compromising an email system, but did not impact business applications or account data. […]

Hackers breach SmarterTools network using flaw in its own software

February 9, 2026

SmarterTools confirmed last week that the Warlock ransomware gang breached its network after compromising an email system, but did not impact business applications or account data. […]

BridgePay Ransomware Causes Widespread Payment Outages

February 9, 2026

A ransomware attack on BridgePay Network Solutions on Feb. 6, 2026, caused payment processing disruptions across the U.S., affecting merchants, local governments, and service providers. The outage temporarily forced some businesses to rely on cash-only transactions while payment services were unavailable. “No card data was compromised and any file that may have been accessed was…

BridgePay Ransomware Causes Widespread Payment Outages

February 9, 2026

BridgePay Ransomware Causes Widespread Payment Outages

February 9, 2026

BridgePay Ransomware Causes Widespread Payment Outages

February 9, 2026

BridgePay Ransomware Causes Widespread Payment Outages

February 9, 2026

BridgePay Ransomware Causes Widespread Payment Outages

February 9, 2026

BridgePay Confirms Ransomware Attack, No Card Data Compromised

February 9, 2026

The services of Florida-based payments platform BridgePay are offline due to a ransomware attack

Payments platform BridgePay confirms ransomware attack behind outage

February 7, 2026

A major U.S. payment gateway and solutions provider says a ransomware attack has knocked key systems offline, triggering a widespread outage affecting multiple services. The incident began on Friday and quickly escalated into a nationwide disruption across BridgePay’s platform. […]

Ransomware gang uses ISPsystem VMs for stealthy payload delivery

February 5, 2026

Ransomware operators are hosting and delivering malicious payloads at scale by abusing virtual machines (VMs) provisioned by ISPsystem, a legitimate virtual infrastructure management provider. […]

CISA confirms exploitation of VMware ESXi flaw by ransomware attackers

February 5, 2026

CVE-2025-22225, a VMware ESXi arbitrary write vulnerability, is being used in ransomware campaigns, CISA confirmed on Wednesday by updating the vulnerability’s entry in its Known Exploited Vulnerabilities (KEV) catalog. Researchers linked VMware ESXi zero-day trio to single exploit toolkit Broadcom fixed CVE-2025-22225, CVE-2025-22224 (a heap overflow vulnerability) and CVE-2025-22226 (an information disclosure flaw) in VMware…