Tag: ransomware
-
Teenage hacker myth primed for a middle-age criminal makeover
Tags: access, breach, business, corporate, crypto, cyber, cybercrime, cybersecurity, data, detection, extortion, finance, group, hacker, hacking, infrastructure, jobs, malware, network, penetration-testing, programming, ransomware, service, skills, software, technology, threat, vulnerabilityCybercrime cartels: Dray Agha, senior security operations manager at managed detection and response services firm Huntress, said the analysis illustrates that the “Hollywood image of a teenage lone wolf hacking for bragging rights” is vastly outdated since the threat landscape is dominated by “highly organised, profit-driven syndicates.””While young people may still engage in digital vandalism…
-
Zero-day exploits hit enterprises faster and harder
Tags: access, apple, attack, backdoor, business, china, cisco, cve, data, detection, endpoint, espionage, exploit, firewall, flaw, fortinet, google, group, hacker, infrastructure, ivanti, least-privilege, mobile, network, oracle, radius, ransomware, risk, router, russia, service, software, technology, threat, update, vpn, vulnerability, zero-dayEnterprise environments under siege: Chinese threat actors continued to display a preference for targets that are difficult to monitor and allow persistent access to strategic networks. Notable examples include the groups that GTIG tracks as UNC5221, which exploited a flaw in Ivanti Connect Secure (CVE-2025-0282) and UNC3886, which exploited a vulnerability in Juniper routers (CVE-2025-21590).Another…
-
Backup strategies are working, and ransomware gangs are responding with data theft
Business email compromise (BEC) and funds transfer fraud combined for 58% of all cyber insurance claims filed in 2025, according to data from Coalition covering more than … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/06/cyber-claims-report-ransomware-gangs-data-theft/
-
Whitelisting im Unternehmen: Wie Allow-Listing Zero-Day-Angriffe stoppt und die Angriffsfläche reduziert
Unternehmen stehen heute vor einer Sicherheitslage, in der klassische Abwehrmechanismen allein nicht mehr ausreichen. Malware, Ransomware, Schatten-IT, komplexe Multi-Cloud-Architekturen und strenge Datenschutzvorgaben treffen auf eine Arbeitswelt, die von Dynamik und Flexibilität geprägt ist. In diesem Spannungsfeld gewinnt ein Sicherheitsprinzip zunehmend an Bedeutung, das zwar traditionell wirkt aber gerade deshalb enorme Stärke entfaltet: konsequentes Whitelisting. First…
-
Whitelisting im Unternehmen: Wie konsequentes Allow-Listing Zero-Day-Angriffe stoppt und die Angriffsfläche dauerhaft reduziert Kontrolle statt reaktiver Abwehr
Unternehmen stehen heute vor einer Sicherheitslage, in der klassische Abwehrmechanismen allein nicht mehr ausreichen. Malware, Ransomware, Schatten-IT, komplexe Multi-Cloud-Architekturen und strenge Datenschutzvorgaben treffen auf eine Arbeitswelt, die von Dynamik und Flexibilität geprägt ist. In diesem Spannungsfeld gewinnt ein Sicherheitsprinzip zunehmend an Bedeutung, das zwar traditionell wirkt aber gerade deshalb enorme Stärke entfaltet: konsequentes Whitelisting. First…
-
Europa im Visier von Cyber-Identitätsdieben
Deutsche Unternehmen müssen sich warm anziehen: Sowohl staatliche als auch ‘private” Akteure haben es auf sie abgesehen.ShutterstockWie die Experten von Darktrace in ihrem aktuellen Threat Report 2026 darstellen, bleiben Cloud- und E-Mail-Konten das Einfallstor Nummer Eins in Europa. Dem Bericht zufolge begannen im vergangenen Jahr in Europa 58 Prozent der Attacken mit kompromittierten Cloud-Accounts oder…
-
Phobos Ransomware admin faces up to 20 years after guilty plea
Russian national Evgenii Ptitsyn (43) pleaded guilty in the U.S. for his role in the Phobos ransomware operation. Russian national Evgenii Ptitsyn pleaded guilty in the US to wire fraud conspiracy for his role in the Phobos ransomware scheme. The man was arrested in South Korea in 2024 and extradited to the United States. He…
-
Phobos ransomware leader facing 20 years in prison after pleading guilty to hacking charges
Ptitsyn and several others began using the Phobos ransomware in November 2020, attacking more than 1,000 organizations around the world. He was arrested in South Korea and extradited in November 2024. First seen on therecord.media Jump to article: therecord.media/phobos-ransomware-leader-facing-20-years
-
Phobos ransomware leader pleads guilty, faces up to 20 years in prison
The 43-year-old Russian national ran a ransomware operation that impacted more than 1,000 victims globally. The conspiracy netted more than $39 million in extortion payments. First seen on cyberscoop.com Jump to article: cyberscoop.com/phobos-ransomware-leader-guilty/
-
Phobos ransomware admin pleads guilty to wire fraud conspiracy
A Russian national pleaded guilty to a wire fraud conspiracy charge related to his role in administering the Phobos ransomware operation, which breached hundreds of victims worldwide. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/phobos-ransomware-admin-pleads-guilty-to-wire-fraud-conspiracy/
-
What to Expect from Iran’s Digital Counterstrike
Tags: attack, breach, cloud, communications, cyber, cyberattack, cybersecurity, data, defense, espionage, exploit, extortion, finance, government, group, hacking, infrastructure, intelligence, international, iran, leak, middle-east, military, network, ransomware, risk, risk-assessment, service, tool, update, vulnerability, wormAfter the United States and Israel began a bombing campaign on Iran, leading to the decapitation of its political and military leaders, the Middle East has erupted into waves of kinetic warfare. But what should we expect about cyber? Iran has a formidable offensive cybersecurity capability and is considered one of the four most aggressive…
-
Cancer Center Research Study Hack Affects 1.2M
Health Researchers Often Overlook Security of Historical Datasets. An August 2025 ransomware attack on the University of Hawaii Cancer Center’s epidemiology division has affected 1.2 million individuals, including personal information such as Social Security numbers of certain research study participants dating back more than 30 years. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cancer-center-research-study-hack-affects-12m-a-30912
-
Canadian Manufacturers Confront Rising OT Cyber Risk
ManuSec Canada Speakers From Subaru and Toronto Transit Discuss Cyber Resilience. Canadian manufacturers face rising cyber risk as IT and OT systems converge. Leaders from Subaru Canada and the Toronto Transit Commission outline how ransomware, supply chain exposure and legacy OT vulnerabilities demand stronger resilience, segmentation and incident response readiness. First seen on govinfosecurity.com Jump…
-
Mississippi medical center reopens clinics hit by ransomware attack
The University of Mississippi Medical Center (UMMC) says it has resumed normal operations, nine days after a ransomware attack blocked access to electronic medical records and took down many of its IT systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/mississippi-medical-center-reopens-clinics-hit-by-ransomware-attack/
-
Ransomware Breach at University of Hawaii Cancer Center Affects 1.2M People
The University of Hawaii Cancer Centre has confirmed a massive ransomware attack affecting 1.24 million people. Sensitive data, including Social Security numbers and historical voter records dating back to 1993, was compromised. First seen on hackread.com Jump to article: hackread.com/ransomware-breach-university-of-hawaii-cancer-center/
-
Ransomware Breach at University of Hawaii Cancer Center Affects 1.2M People
The University of Hawaii Cancer Centre has confirmed a massive ransomware attack affecting 1.24 million people. Sensitive data, including Social Security numbers and historical voter records dating back to 1993, was compromised. First seen on hackread.com Jump to article: hackread.com/ransomware-breach-university-of-hawaii-cancer-center/
-
How a Brute Force Attack Unmasked a Ransomware Infrastructure Network
A routine RDP brute-force alert led to unusual credential hunting and a geo-distributed VPN-linked infrastructure. Huntress Labs explains how one compromised login unraveled a suspected ransomware-as-a-service ecosystem tied to initial access brokers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/how-a-brute-force-attack-unmasked-a-ransomware-infrastructure-network/
-
Ransomware auf Speed
Künstliche Intelligenz verändert die Cyberbedrohungslandschaft nicht durch völlig neue Angriffsarten, sondern durch Skalierung, Geschwindigkeit und Präzision. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/ransomware-auf-speed
-
U.S. CISA adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cybersecurity, exploit, flaw, google, infrastructure, kev, microsoft, ransomware, vmware, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: In…
-
AzCopy Utility Misused for Data Exfiltration in Ongoing Ransomware Attacks
Ransomware operators are increasingly abusing Microsoft’s trusted Azure data transfer utility, AzCopy, to quietly exfiltrate sensitive data before encryption, turning a routine cloud migration tool into a stealthy theft channel. Instead of relying on obviously malicious tools like Rclone or MegaSync, threat actors are pivoting to native, administrator-approved cloud utilities to blend into normal IT…
-
Data breach at University of Hawaiʻi Cancer Center impacts 1.2 Million individuals
A ransomware attack on the University of HawaiÊ»i Cancer Center exposed personal data of 1.2 million people. A 2025 ransomware attack targeting the University of HawaiÊ»i Cancer Center compromised the personal information of about 1.2 million individuals. The attack hit the University of HawaiÊ»i Cancer Center on August 31, 2025, impacting servers that support research…
-
Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations
Threat hunters have called attention to a new campaign as part of which bad actors masqueraded as fake IT support to deliver the Havoc command-and-control (C2) framework as a precursor to data exfiltration or ransomware attack.The intrusions, identified by Huntress last month across five partner organizations, involved the threat actors using email spam as lures,…
-
Cloudflare Threat Report 2026: Ransomware beginnt mit dem Login
Ein zentrales Motiv des Reports ist die Verschiebung vom klassischen Netzwerkangriff hin zum Identitätsmissbrauch. Infostealer wie LummaC2 stehlen aktive Session-Tokens und umgehen damit selbst Multi-Faktor-Authentifizierung First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cloudflare-threat-report-2026-ransomware-beginnt-mit-dem-login/a43931/
-
One Foothold, 25 Million Victims: The Risk Inside Modern Breaches
In last month’s reporting cycle, we saw one of the largest healthcare data breaches in U.S. history, ransomware groups tied to North Korea targeting hospitals, and firewall vulnerabilities that allowed attackers to create rogue administrative accounts almost instantly. Taken together, these incidents raise a more important question than who was hit. They force us to……
-
Surviving Ransomware: Best practices to safeguard your business
By Robbie Ross, cyber security lead, Converged Communication Solutions It’s not if but when. This is a phrase that has been echoed across the cyber security industry for several years, but when it comes to ransomware the message is still not penetrating widely enough. The 2025 UK Government Cyber Breaches Survey highlighted that just 32%…
-
Ransomware is now less about malware and more about impersonation
Stolen passwords have replaced infectious code as the most common tactic in major breaches, Cloudflare said. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-identity-ai-cloudflare/813319/
-
Hackers Exploit Telegram for Initial Access to Corporate VPN, RDP, and Cloud Systems
Tags: access, cloud, corporate, credentials, cyber, data-breach, exploit, hacker, marketplace, network, ransomware, vpnHackers are increasingly abusing Telegram as an initial access marketplace, turning stealer logs and leaked credentials into direct entry points for corporate VPN, RDP, and cloud environments. The platform now acts as a high-speed bridge between compromised credentials and full network compromise, supporting ransomware operators, Initial Access Brokers (IABs), and hacktivist collectives. Telegram hosts popular…
-
Ransomware auf Speed ist die große Herausforderung für CISOs
Die Geschwindigkeit ist entscheidet. Denn die größte Gefahr ist aktuell nicht die kreative Kraft der künstlichen Intelligenz in Händen der Bedrohungsakteure, sondern die Lücke zwischen Angriffs- und Abwehrgeschwindigkeit. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/ransomware-auf-speed-ist-die-grosse-herausforderung-fuer-cisos/a43922/
-
Epic Fury introduces new layer of enterprise risk
Tags: access, apt, attack, business, cisa, ciso, communications, country, credentials, cyber, cybersecurity, data-breach, disinformation, exploit, group, infrastructure, intelligence, international, Internet, iran, malware, middle-east, network, ransomware, resilience, risk, rust, service, software, technology, tool, ukrainePhysical attacks on US-linked locations through direct action or partner groups. We are already seeing Iranian missile launches into a variety of nations in the region.Cyber operations that include disruptive activity, targeted intrusions, credential and access harvesting, destructive malware deployment, and the use of compromised infrastructure to support broader influence or operational objectives.Proxy networks across…