Tag: extortion
-
Qilin Leads in Exploiting Unpatched Fortinet Vulnerabilities
The Qilin group has surged to prominence by aggressively exploiting critical vulnerabilities in Fortinet devices, underscoring a broader trend of sophisticated cyber extortion tactics targeting data-dependent sectors. Global ransomware victims dropped to 463, a 15% decline from May’s 545, yet the intensity of attacks remained high, with Qilin claiming 81 victims through opportunistic intrusions leveraging…
-
Iranian ransomware group offers bigger payouts for attacks on Israel, US
The Iran-linked ransomware-as-a-service group Pay2Key.I2P reportedly told affiliates that they can keep a larger cut of extortion payments if they attack entities within Iran’s adversaries. First seen on therecord.media Jump to article: therecord.media/iran-ransomware-group-pay2keyi2p-israel-us-targets
-
Ransomware Attack Halts Ingram Micro Operations
SafePay Ransomware Blamed for Prolonged System Outage. Global tech distributor and service provider Ingram Micro confirmed days after a widespread IT outage that a ransomware attack disrupted internal systems. The firm disclosed the incident following reports that extortion demands associated with SafePay ransomware appeared on employee devices. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ransomware-attack-halts-ingram-micro-operations-a-28908
-
Hunters International Is Not Shutting Down, It’s Rebranding
Some admins of Hunters International are now part of the encryption-less cyber extortion group World Leaks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-hunters-international/
-
Hunters International shuts ransomware operations, reportedly becomes an extortion-only gang
This story has been updated with comments from the SANS Institute and KnowBe4.Next read this:The most notorious and damaging ransomware of all timeRansomware recovery: 8 steps to successfully restore from backupThe dirty dozen: 12 worst ransomware groups active todayThe state of ransomware: Faster, smarter, and meanerRansomware gangs extort victims 17 hours after intrusion on average>>…
-
Hunters International shuts ransomware operations, reportedly becomes an extortion-only gang called World Leaks
The most notorious and damaging ransomware of all timeRansomware recovery: 8 steps to successfully restore from backupThe dirty dozen: 12 worst ransomware groups active todayThe state of ransomware: Faster, smarter, and meanerRansomware gangs extort victims 17 hours after intrusion on average>> First seen on csoonline.com Jump to article: www.csoonline.com/article/4016974/hunters-international-shuts-ransomware-operations-reportedly-becomes-an-extortion-only-gang-called-world-leaks.html
-
Ein widerstandsfähiges SOC aufbauen
Warum es so wichtig ist zu den Grundlagen zurückzukehren. Oft passiert das Folgende in Unternehmen: Es gibt einen neuen Bedrohungsbericht über einen möglichen Angreifer und das SOC (Security Operation Center) beginnt mit der Suche nach Taktiken, Techniken und Verfahren (TTPs) ohne etwas zu finden. Zwei Monate später erpresst derselbe Angreifer das Unternehmen mit gestohlenen Daten….…
-
Scattered Spider Tactics Include Data Theft, Extortion: CrowdStrike
Threat researchers from CrowdStrike are pointing to Scattered Spider’s focus on more than just traditional ransomware attacks, as experts have separately linked the threat group to a data theft attack against Australian airline Qantas. First seen on crn.com Jump to article: www.crn.com/news/security/2025/scattered-spider-tactics-include-data-theft-extortion-crowdstrike
-
DOJ investigates ex-ransomware negotiator over extortion kickbacks
An ex-ransomware negotiator is under criminal investigation by the Department of Justice for allegedly working with ransomware gangs to profit from extortion payment deals. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/doj-investigates-ex-ransomware-negotiator-over-extortion-kickbacks/
-
Ransomware-Attacke auf Welthungerhilfe
Cyberkriminelle haben die Systeme der Welthungerhilfe gehackt.Die Welthungerhilfe zählt zu den größten gemeinnützigen Organisationen in Deutschland. Die Cyberbande Rhysida hat kürzlich einen Darknet-Post mit mehreren Datenkopien veröffentlicht, die angeblich von der Welthungerhilfe stammen.Eine Sprecherin der Hilfsorganisation bestätigte gegenüber CSO, dass es am 23. Mai 2025 zu einem Cyberangriff kam. Daraufhin seien die betroffenen Systeme sofort…
-
Ein widerstandsfähiges Security-Operations-Center aufbauen
Oft passiert das Folgende in Unternehmen: Es gibt einen neuen Bedrohungsbericht über einen möglichen Angreifer und das SOC (Security-Operations-Center) beginnt mit der Suche nach Taktiken, Techniken und Verfahren (TTPs) ohne etwas zu finden. Zwei Monate später erpresst derselbe Angreifer das Unternehmen mit gestohlenen Daten. An diesem Beispiel sieht man gut, wie das SOC aufgrund zu…
-
Bridewell report indicates rise in lone wolf ransomware actors
Tags: attack, cybersecurity, data, encryption, extortion, ransomware, service, strategy, theft, threatBridewell, a UK-based cybersecurity services company, has released its latest CTI Annual Report a comprehensive deep dive into ransomware trends. It highlighted a significant shift in attack strategies, payment dynamics and threat actor behaviours, revealing that data theft and extortion have overtaken traditional encryption-only ransomware as the most successful approach for attackers. While encryption-based The…
-
Bankers Association’s Attack on Cybersecurity Transparency
Tags: attack, awareness, banking, breach, ciso, control, cybersecurity, data, extortion, finance, group, incident response, infrastructure, insurance, law, malicious, ransomware, riskA coalition of banking industry associations, including SIFA, the American Bankers Association (ABA), Bank Policy Institute (BPI), and several other lobbying groups have made a disgraceful appeal to the SEC to eliminate the rule requiring public disclosure of material cybersecurity incidents within four days of detection. This rule was established to ensure shareholders are properly…
-
Dire Wolf Ransomware Comes Out Snarling, Bites Technology, Manufacturing
The emerging group has already gotten its teeth into 16 victims since May with its double extortion tactics, claiming victims in 11 countries, including the US, Thailand, and Taiwan. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/dire-wolf-ransomware-manufacturing-technology
-
Fewer ransomware attacks encrypting data, report finds
Hackers are increasingly performing extortion-only attacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-extortion-only-encryption-sophos-report/751293/
-
Fewer ransomware attacks encrypting data, new report finds
Hackers are increasingly performing extortion-only attacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-extortion-only-encryption-sophos-report/751293/
-
Successful Military Attacks are Driving Nation States to Cyber Options
Tags: attack, china, communications, computing, cyber, cyberattack, cybersecurity, data, defense, exploit, extortion, finance, fraud, government, healthcare, infrastructure, iran, korea, middle-east, military, north-korea, russia, service, tactics, technology, tool, ukraine, vulnerability, warfareWith daring military attacks, kinetic warfare is shifting the balance of power in regions across the globe, upending the perception of power projection. Powerful nations are reeling from the impacts of bold assaults and seeking additional methods to drive foreign policy”Š”, “Šcyber may look as an appealing asymmetric warfare capability that is worth doubling-down on.…
-
Qilin ransomware strengthens data extortion tactics
First seen on scworld.com Jump to article: www.scworld.com/brief/qilin-ransomware-strengthens-data-extortion-tactics
-
Qilin offers >>Call a lawyer<< button for affiliates attempting to extort ransoms from victims who won't pay
Imagine for one moment that you are a cybercriminal. First seen on tripwire.com Jump to article: www.tripwire.com/state-of-security/qilin-offers-call-lawyer-button-affiliates-attempting-extort-ransoms-victims
-
Qilin Ransomware Rises as Major Threat, Demanding $50M in Ransom
The global cybersecurity landscape is facing a seismic shift as the Qilin ransomware group, also known as Agenda, has surged to the forefront of digital extortion, demanding ransoms as high as $50 million and disrupting critical services worldwide. Once an obscure player, Qilin has rapidly evolved into the most prevalent and technically sophisticated ransomware operation…
-
Anubis Ransomware Adds Wiper Capability, for Unclear Reasons
Move Raises Possibility Group Isn’t Just Marketing Its Malware to Criminals Up-and-coming ransomware group Anubis has tweaked its malware to irrevocably wipe victims’ data – an unusual tactic from hackers whose typical corrupt bargain is restored data in exchange for extortion money. Why would a ransomware attacker seeking leverage in negotiations ever do this? First…
-
Scania confirms insurance claim data breach in extortion attempt
Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its systems and steal insurance claim documents. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/scania-confirms-insurance-claim-data-breach-in-extortion-attempt/
-
Operation 999: Ransomware tabletop tests cyber execs’ response
Tags: access, attack, blueteam, breach, computer, conference, cyber, cyberattack, cybersecurity, data, data-breach, extortion, group, hacker, incident, incident response, infrastructure, leak, military, network, ransom, ransomware, RedTeam, resilience, risk, service, threat, tool, trainingExtortion attempts rebuffed: As the exercise moved on, the blue team refuse to pay a ransom after consulting with the authorities, legal teams, and crisis management experts. Instead of upping the ante by threatening to sabotage the water treatment algorithms or chemical pumps, potentially tainting the supply, the attackers decide to leak customer records online…
-
Ransomware Group Threatens to Dump Paraguayan Citizens’ Data
7.2 Million Individuals’ Personal Data Being Held to Ransom by Threat Actor. A data-leak group extortion is shaking down the government of Paraguay for a ransom payment worth $7.4 million, or $1 for every one of the country’s citizens. The group, calling itself Brigada Cyber PMC, claims the stolen data includes people’s personally identifiable information.…
-
CISA warns of SimpleHelp ransomware compromises after string of retail attacks
Ransomware gangs leveraged a vulnerability to access unpatched versions of SimpleHelp’s remote monitoring and management tool to disrupt services in double extortion compromises. First seen on therecord.media Jump to article: therecord.media/cisa-warns-of-simplehelp-ransomware-compromises
-
Ransomware Gangs Exploit Unpatched SimpleHelp Flaws to Target Victims with Double Extortion
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday disclosed that ransomware actors are targeting unpatched SimpleHelp Remote Monitoring and Management (RMM) instances to compromise customers of an unnamed utility billing software provider.”This incident reflects a broader pattern of ransomware actors targeting organizations through unpatched versions of SimpleHelp First seen on thehackernews.com Jump to…
-
United Natural Foods, distributor for Whole Foods Market, hit by cyberattack
The incident follows a spree of ransomware and extortion attacks targeting multiple U.S.- and U.K.-based retailers, including grocery stores. The logistics company said its operations are impacted. First seen on cyberscoop.com Jump to article: cyberscoop.com/united-natural-foods-whole-foods-distributor-cyberattack/
-
Stolen Ticketmaster data from Snowflake attacks briefly for sale again
The Arkana Security extortion gang briefly listed over the weekend what appeared to be newly stolen Ticketmaster data but is instead the data stolen during the 2024 Snowflake data theft attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/stolen-ticketmaster-data-from-snowflake-attacks-briefly-for-sale-again/