Tag: ransomware
-
Flock’s Plans for Rideshare Dashcams and Coaching Police, Revealed
Plus: A judge rules cell tower dumps unconstitutional, water utility hacks spread to a dozen states, a phishing email opens a missile-parts supplier’s inbox, and a ransomware boss gets 16 years. First seen on wired.com Jump to article: www.wired.com/story/flocks-plans-for-rideshare-dashcams-and-coaching-police-revealed/
-
Storm-1175 Launches StormEncryptor Ransomware Attacks Using N-able Security Flaw
Microsoft Threat Intelligence has identified a new ransomware campaign attributed to the financially motivated threat actor Storm-1175 that began deploying a previously undocumented ransomware strain, StormEncryptor, on August 2, 2026. The activity represents Storm-1175’s first observed operation since April 2026 and signals a notable shift in its ransomware tooling. The group was previously associated with…
-
Zscaler’s Brett Stone-Gross on which roles are targeted in ransomware attacks
First seen on scworld.com Jump to article: www.scworld.com/resource/zscalers-brett-stone-gross-on-which-roles-are-targeted-in-ransomware-attacks
-
The Cyber Express Weekly Roundup: Ransomware Surge, Government Data Breaches, Logistics Disruptions, and Third-Party Security Risks
This weekly roundup highlights the growing cybersecurity risks affecting businesses, government agencies, and critical service providers. From the continued dominance of ransomware operations to government database breaches and third-party supply chain incidents, recent events demonstrate how attackers are increasingly targeting trusted systems and external service providers to maximize disruption and data exposure. First seen on thecyberexpress.com Jump…
-
Ransomware Surges in July After Q2 Lull
Finance, technology and healthcare sectors were particularly heavily targeted in July, according to Comparitech First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-surges-july-q2-lull/
-
Ransom Cartel Leader Sentenced to 16 Years in U.S.
A U.S. court sentenced Ransom Cartel founder Maksim Silnikau to 16 years for running a ransomware-as-a-service operation. Maksim Silnikau (aka >>J.P. Morgan,<>lansky,<>xxx,<<) built a ransomware business the way a franchise owner builds a chain: he never had to touch most of the crime scenes himself. This week, a federal judge in Virginia […] First seen…
-
Belarusian cybercriminal behind Ransom Cartel gets 16-year prison sentence
A Belarusian national active in the cybercriminal world for decades was sentenced to 16 years in U.S. prison for running the Ransom Cartel ransomware operation. First seen on therecord.media Jump to article: therecord.media/belarus-hacker-ransomware-sentenced
-
Defending Water OT with AZT PROTECT – ARIA Cybersecurity
<div cla The threat landscape for municipal water systems has never been more perilous, and the regulatory spotlight has never been brighter. A flurry of attacks has taken over the news: in some cases, ransomware-based attacks cripple water production and in other cases controls on individual unprotected PLCs are being suddenly accessed by bad actors…
-
Kill switch fears now rival ransomware as a top security risk for European businesses, Proton study finds
For years, the security team’s job has been to defend against cyberattacks. New research from Proton suggests that job now needs to extend to a very different kind of threat: the risk that a foreign government orders a US technology provider to cut a business off entirely. A study of 1,500 business decision-makers across the…
-
South Korea’s government overtakes telcos as top cyber attack target
Kaspersky researcher Sojun Ryu says ransomware crews have joined nation-state groups in going after South Korean organisations, as traces of LLM output start turning up inside malware First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366647735/South-Koreas-government-overtakes-telcos-as-top-cyber-attack-target
-
Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service
A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021.Between 2021 and 2023, Ransom Cartel conspirators attacked at least 18 companies, including firms in California, New York and Nebraska, and others abroad, according to…
-
Ransom Cartel ransomware creator sentenced to 16 years in prison
Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his role in ransomware attacks against at least 18 companies worldwide. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransom-cartel-ransomware-creator-sentenced-to-16-years-in-prison/
-
Ransomware Hackers Are Hiding Malware Command Servers Inside Ethereum Smart Contracts
Ransomware operators are now abusing Ethereum smart contracts as stealthy command”‘and”‘control resolvers, with a Gentlemen ransomware affiliate using the EtherRAT backdoor to pull rotating C2 domains directly from the blockchain instead of hardcoding them in the malware. The toolkit shows a clear progression: scheduled tasks that bootstrap PowerShell, privileged account creation (“support2” with Supp0rt2@2026!). LSASS…
-
Prolific ransomware group behind SonicWall zero-day attacks
INC ransomware wasn’t the first group to exploit the zero-days, but it’s been the most assertive and effective in chaining both vulnerabilities to steal and encrypt data for extortion. First seen on cyberscoop.com Jump to article: cyberscoop.com/inc-ransomware-sonicwall-zero-day-attacks/
-
INC Ransomware is Calling Victims Pressure Tactics Post SonicWall Zero-Day Exploit
INC Ransomware exploits SonicWall SMA 1000 flaws, using calls and emails to pressure victims during extortion campaigns targeting global organizations. Resecurity disclosed that INC Ransomware has emerged as the dominant threat actor exploiting the recently disclosed SonicWall Secure Mobile Access (SMA) 1000 vulnerabilities. According to the company’s research, the group has accelerated its operations since…
-
Russian Access Broker Sells Network Access to Ransomware Gangs While Spying on Ukraine
Tags: access, cyber, data-breach, defense, exploit, intelligence, network, ransomware, russia, ukraineAn exposed server linked to a Russian”‘speaking initial access broker (IAB) has revealed a sprawling operation that simultaneously fuels ransomware intrusions worldwide and supports Russian state-aligned intelligence collection against Ukrainian defense and aerospace targets. The artefacts show a mature, high”‘volume access brokerage pipeline that industrialises exploitation of internet”‘facing appliances, pivots to full Active Directory compromise,…
-
Ransomware nutzt VPNs in Fabriken aus – Fernzugriff in der Fertigung: Secomea mahnt strengere Kontrolle an
First seen on security-insider.de Jump to article: www.security-insider.de/fernzugriff-in-der-fertigung-secomea-mahnt-strengere-kontrolle-an-a-5bd17237b3ff4e1a4a88131854d39c30/
-
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws
The INC Ransomware operation has emerged as the “dominant threat actor” exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances.In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data…
-
River Bank obtained assurances from the attackers that the stolen data in the June attack was deleted
River Bank says hackers deleted data stolen in its June ransomware attack, though the investigation into the incident is still ongoing. River Financial Corporation, the parent company of River Bank & Trust, says hackers deleted data stolen during a ransomware attack that hit parts of its server environment in June. The breach began on June…
-
How the World’s Most Active Ransomware Operation Expanded in H1 2026
The first half of 2026 reinforced a familiar reality in ransomware: a small number of highly capable operators continue to drive a disproportionate share of global attacks. Among them, Qilin ransomware emerged as the most active threat group tracked by Cyble Research and Intelligence Labs (CRIL), demonstrating the scale and reach of today’s ransomware-as-a-service (RaaS) ecosystem. First seen on thecyberexpress.com Jump to article:…
-
From WSProxy to Root: INC ransomware and SonicWall SMA Exploit Chain
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain
-
CRPx0 Ransomware Claims Hyundai Turkey Breach, Steals 1.5GB of Assessment Data
The double-extortion ransomware group CRPx0 has listed Hyundai’s Turkish operations on its dark web leak site, claiming to have exfiltrated 1.5 GB of sensitive personnel and recruitment data from the automaker’s assessment systems. According to CyberWatch, first flagged on its data-leak portal, the target is described as a >>Korean automotive manufacturer (Turkish operations)<< with the…
-
North Korea’s APT Capabilities Are No Longer State-Exclusive
Tags: access, apt, cyber, finance, group, hacker, infrastructure, korea, lazarus, malware, military, north-korea, ransomware, skillsAhnLab Found Shared Malware, SSH Keys and Infrastructure Across Two Campaigns. Shared malware, infrastructure and access methods link Lazarus Group to Gunra ransomware activity, while former North Korean military hackers allegedly used state-trained skills to steal bank funds, exposing cyber capability diffusion and blowback inside the regime. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/north-koreas-apt-capabilities-are-no-longer-state-exclusive-a-32392
-
DentaQuest Data Theft Hack Affects 15M Patients
Number of Victims Is 5 Times Higher Than Claims by ShinyHunters Ransomware Gang. Dental and vision benefits administrator DentaQuest is notifying 15 million patients that their information was compromised in a May hack. The reported victim total is significantly higher than the number claimed by extortion gang ShinyHunters, which took credit for the data theft…
-
eSecurityPlanet Podcast: Semperis Global Field CTO Marty Momdjian
Identity systems sit at the center of enterprise security, but they are also one of the first places attackers look when launching ransomware and other disruptive cyberattacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/video/esecurityplanet-podcast-semperis-global-field-cto-marty-momdjian/
-
ESET tracks rise in malicious AI skills and adaptable malware
Attackers are adapting established techniques to AI platforms, emerging technologies, and changing user behavior. ESET’s new threat report examines the rise of malicious AI skills, AI-assisted malware, ClickFix attacks, record quishing activity, and ransomware tools designed to disable security software. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/eset-tracks-rise-in-malicious-ai-skills-and-adaptable-malware/
-
Ransomware Killers Overwrite Security Process Memory Without Terminating Applications
Ransomware operators are increasingly deploying “ransomware killers” that surgically overwrite the memory of security processes instead of simply terminating them, allowing encryption to proceed. At the same time, endpoint tools appear to run normally but are effectively blind. This evolution marks a shift from crude process-killing to stealthy, in”‘memory tampering that targets EDR/AV telemetry, kernel…
-
Phishing 2026: Warum technische Abwehr nicht mehr reicht
Das größte Einfallstor der Angreifer bleibt Phishing. Der Lagebericht des BSI zur IT-Sicherheit in Deutschland führt seit vielen Jahren Phishing als eines der häufigsten Einfallstore für Ransomware und Datenabfluss an. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/phishing-2026-abwehr
-
Vishing-Kampagne über Microsoft Teams mündet in Chaos-Ransomware
Angreifer geben sich über Microsoft Teams als IT-Support aus, um sich Fernzugriff auf Firmengeräte zu verschaffen. Darauf folgte der Einsatz der Ransomware Chaos. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/microsoft-teams-chaos