Tag: ransomware
-
Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
Dark Project, an emerging financially motivated ransomware operation, has claimed 38 victims across eight countries in the supplied threat intelligence snapshot, with manufacturing and healthcare bearing the heaviest exposure. The group combines data theft, system encryption, and public disclosure threats with an affiliate program designed to scale intrusions. The figures represent allegations published through criminal…
-
Queens Public Library says ransomware attack disrupted Wi-Fi, on-site computers
The library system, which has 66 branches serving the borough’s 2.3 million residents, published multiple alerts on Wednesday confirming that the disruption was caused by a ransomware attack. First seen on therecord.media Jump to article: therecord.media/queens-library-ransomware-causes-disruptions
-
Breach Roundup: Hybrid Warfare in Europe Heats Up
Also: Norway Aid Agency Breach, Europe and Germany Target Online Scams. This week: Ukraine hacked back, Norway aid agency cyberattack, Harvard breach, 3AM used hybrid AI tactics. Sageworks went offline. European cops seized scam servers, cPGuard updates hijacked, ‘hello’ chats hid Flowise attacks, a Red Hat flaw, Synology NAS ransomware and Canonical fixed a flaw.…
-
Hackers Develop New HYFLOCK Ransomware That Encrypts Files and Attempts to Block Recovery
HYFLOCK ransomware operators have developed successive Windows encryptors that lock files, access network shares, and attempt to obstruct recovery, while implementation flaws create sharply different outcomes for victims. The investigation distinguishes demonstrated functionality from promotional claims. Although researchers confirmed encryption and scheduled-task registration, they did not establish successful domain-wide propagation or reliable execution after remote…
-
Kriminelle Mensch-Maschine-Teamarbeit bei Ransomware-Attacke auf Schule in Großbritannien
Die Experten für das Eindringen in Netze (Affiliates) der Ransomware-Betreiber von 3AM haben eine britische Schule mit einer hybriden KI-unterstützten Attacke angegriffen. In dem laut Einschätzung der Bitdefender Labs ersten Vorgehen dieser Art in Europa ist die Zusammenarbeit der menschlichen Hacker mit effizient eingesetzter künstlicher Intelligenz sichtbar. So setzten die Affiliates KI-Agenten für repetitive Aufgaben…
-
3AM Ransomware Hackers Use AI-Assisted Attacks to Breach UK Schools and Spread Across Windows Domains
A ransomware affiliate known as 3AM compromised a UK school network using a mix of traditional intrusion techniques and patterns suggesting the involvement of artificial intelligence. According to Bitdefender’s investigation on November 3, this operation appears to follow a suspected hybrid workflow: a human operator selects the targets while a language model may handle repetitive…
-
3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compromise
Bitdefender highlighted a unique human-AI approach during a September attack on a UK school estate, which resulted in financial data being exfiltrated First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/3am-ransomware-hybrid-ai-uk-school/
-
3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack
Bitdefender details a 3AM ransomware attack on a UK school estate that encrypted 37 systems, with command timing suggesting possible AI-assisted troubleshooting. First seen on hackread.com Jump to article: hackread.com/3am-ransomware-uk-school-systems-ai-attack/
-
Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versions
Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately. A security fix released in 2024 is now at the centre of ransomware attacks against Synology NAS devices. The company has found attackers targeting systems that still run outdated versions of DiskStation Manager (DSM), putting files…
-
UK school estate hit by 3AM ransomware in suspected AI-assisted attack
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/uk-school-estate-hit-by-3am-ransomware-in-suspected-ai-assisted-attack/
-
NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure
The UK’s cyber chief has warned that AI-powered malware is highly likely to feature in ransomware attacks targeting British critical infrastructure by 2028 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/
-
NIST Releases New Cybersecurity Guidelines to Protect Small Businesses From Phishing and Ransomware Attacks
Tags: attack, business, cyber, cybersecurity, framework, nist, phishing, ransomware, technology, threatThe National Institute of Standards and Technology (NIST) released new cybersecurity guidance to help solo business owners protect themselves against threats like phishing, ransomware, and account compromise. Published on November 2, 2026, NIST Cybersecurity White Paper 50 simplifies the Cybersecurity Framework 2.0 and offers practical actions for businesses with limited IT infrastructure. The publication, Small…
-
NIST Releases New Cybersecurity Guidelines to Protect Small Businesses From Phishing and Ransomware Attacks
Tags: attack, business, cyber, cybersecurity, framework, nist, phishing, ransomware, technology, threatThe National Institute of Standards and Technology (NIST) released new cybersecurity guidance to help solo business owners protect themselves against threats like phishing, ransomware, and account compromise. Published on November 2, 2026, NIST Cybersecurity White Paper 50 simplifies the Cybersecurity Framework 2.0 and offers practical actions for businesses with limited IT infrastructure. The publication, Small…
-
Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.”These attacks aim to encrypt data and extort ransom,” it said in a…
-
Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.”These attacks aim to encrypt data and extort ransom,” it said in a…
-
Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.”These attacks aim to encrypt data and extort ransom,” it said in a…
-
Michigan State cyber incident claimed by ransomware gang behind recent hospital attack
A recent post by the BYOD gang appears to line up with a security incident that prompted campus-wide action at Michigan State University. BYOD drew attention in October for an attack on the University of New Mexico. First seen on therecord.media Jump to article: therecord.media/michigan-state-university-byod-gang-cyber-incident
-
Synology warns of C3RB3R ransomware attacks targeting NAS devices
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/
-
Ransomware gang talked AI agents into doing much of its dirty work
The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/
-
Hospital Cyberattacks Bring Disruptions, Legal Fallout
New Mexico, Ohio Ransomware Attacks Raise Concerns as Feds Settle Pennsylvania Case. Cyber incidents at university health systems in New Mexico and Ohio disrupted patient care and sparked data theft concerns and litigation. Meanwhile, a Pennsylvania health system faces an $800,000 HIPAA settlement over a 2023 ransomware attack that exposed sensitive cancer patient photos. First…
-
New Framework Puts Ransomware Resilience for AI Systems in Focus
RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/framework-ransomware-resilience-ai/
-
Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations
Tags: access, ai, attack, credentials, cyber, cybercrime, exploit, group, hacker, ransomware, sophos, threatThe GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora). Sophos researchers say the agents moved from credential access to domain administrator with little human involvement. Aur0ra ransomware AI attacks In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation…
-
The Cyber Express Weekly Roundup: Binance Hit by $6.3 Billion Security Incident, South Korea Busts AI-Powered Hacking Ring and More
This weekly roundup covers a $6.3 billion security incident at Binance, the arrest of a South Korean hacking ring that used generative AI to breach about 90 companies, Columbia University’s $16.1 million settlement over its 2025 data breach, a 70-month prison sentence for a Ukrainian ransomware affiliate tied to Nefilim and Hive, and Discord’s decision…
-
12 Digital Forensics Incident Response (DFIR) Companies: The 2026 Buyer’s Verdict Guide
You retain a DFIR firm for the breach you’ll actually have nation-state intrusions want attribution benches, ransomware wants negotiation-density operators, insurance-routed incidents want panel firms and 2026’s roster carries one acquisition flag buyers must know: Coveware now operates under Veeam. This verdict guide matches twelve companies to breach lanes, with telemetry advantages, panel realities, and…
-
Breach Roundup: Apparently Chinese Hackers Deploy PHP2Shell
Tags: ai, breach, cctv, china, cybercrime, defense, exploit, flaw, hacker, north-korea, oracle, ransomware, spy, ukraineAlso, Hackers Scan for Newly Patched Oracle Flaw and Chinese Cameras Spy Ukraine. This week: PHP2Shell exploits, a bulletproof host shot and an Oracle flaw. Ukrainian man imprisoned for ransomware, AfD breach, Ukraine warned about Dahua cameras, a defense contractor aided North Korean IT workers, Magecart hijack, African cybercrime and Aokigahara stealer targeted AI credentials.…
-
BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center
Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico’s Health Sciences Center (HSC) this week. First seen on fortra.com Jump to article: www.fortra.com/blog/byod-cyberattack-diverts-ambulances-and-cancels-classes-university-new-mexico-health-center
-
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/ir-trends-q3-2026/
-
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/ir-trends-q3-2026/
-
Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months
Artem Stryzhak gets 70 months for Nefilim and Hive ransomware attacks targeting hospitals, government agencies and businesses in the US and overseas. First seen on hackread.com Jump to article: hackread.com/ukrainian-nefilim-hive-affiliate-artem-stryzhak-jailed/
-
Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail
Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for…