Tag: ransomware
-
Strengthening Identity Security: Real-World Credential Attack Detection with Seceon aiSIEM
Executive Overview Identity has become the primary attack surface in modern enterprise environments. Threat actors increasingly bypass traditional malware-based techniques and instead exploit compromised credentials to access cloud platforms, email systems, and business-critical applications. Credential abuse now drives ransomware campaigns, business email compromise, data exfiltration, and lateral movement within hybrid environments. Organizations must therefore detect…
-
Ransomware payments cratered in 2025, but attacks surged to record highs
Smaller crews piled in as old names splintered and rebranded First seen on theregister.com Jump to article: www.theregister.com/2026/02/27/ransomware_chainalysis/
-
Europol goes after The Com’s ransomware and extortion networks
Law enforcement agencies across 28 countries have spent the past year building cases against a loosely organized collective known as The Com, a decentralized network of mostly … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/
-
‘Project Compass’ Cracks Down on ‘The Com’: 30 Members of Notorious Cybercrime Gang Arrested
International law enforcement operation led by Europol targets network of teenagers and young adults involved in ransomware attacks, extortion and other crimes First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/project-compass-com-arrests/
-
Ransomware activity peaks outside business hours
Intrusions continue to center on credential access and timed execution outside standard business hours. The Sophos Active Adversary Report 2026 analyzes 661 incident response … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/27/sophos-identity-driven-breaches-report/
-
Ransomware groups switch to stealthy attacks and long-term access
Tags: access, application-security, attack, ciso, control, crime, cyber, cybercrime, cybersecurity, data, detection, encryption, endpoint, exploit, extortion, group, identity, intelligence, monitoring, organized, ransomware, service, software, strategy, supply-chain, switch, theft, threat, tool, vulnerability38% drop in encryption over the past 12 months as more cybercriminals turn to silently exfiltrating data for extortion as their main stock in trade.Picus’ suggestion that the volume of ransomware attacks is dropping is disputed by other experts.Tony Anscombe, chief security evangelist at endpoint security vendor Eset, offered a contrasting perspective.”In the recent Eset…
-
Your Drug Formulas, Clinical Trials, and Manufacturing Lines Are Under Attack. Here’s How to Fight Back.
Detect pharmaceutical IP theft, ransomware campaigns, and supply chain breaches in real time with Morpheus AI SOC. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/your-drug-formulas-clinical-trials-and-manufacturing-lines-are-under-attack-heres-how-to-fight-back/
-
Breach Roundup: Finnish Hacker Sentenced to Nearly 7 Years
Also, More ShinyHunters Breaches, North Korea Laptop Farm Operator Sentenced. This week, Finland’s Aleksanteri Kivimäki sentenced. ShinyHunters breaches. Laptop farm rancher sentenced. Oregon state agency hacker sentenced. African scammers arrested. MuddyWater AI-assisted hacks. Advantest ransomware incident, SolarWinds and Microsoft patches. FileZen flaw. QualDerm breach. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-finnish-hacker-sentenced-to-nearly-7-years-a-30863
-
Emulating the Systematic LokiLocker Ransomware
AttackIQ has released a new attack graph that emulates the behaviors of LokiLocker ransomware, a .NET based strain active since at least mid-August 2021. The malware combines defense evasion and impact techniques, including disabling Task Manager and Windows Firewall, as well as deleting Volume Shadow Copies to hinder detection and prevent restoration. First seen on…
-
Qilin crew continues to dominate ransomware ecosystem
The Qilin ransomware gang remained ‘top dog’ in January 2026 with over 100 observed cyber attacks to its name, amid a rapidly evolving, and fragmenting, cyber criminal ecosystem. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366639339/Qilin-crew-continues-to-dominate-ransomware-ecosystem
-
The “Analog Panic Button”: What The Pitt Gets Right (and Wrong) About Hospital Cyber Resilience
When ransomware hits a hospital, shutting everything down isn’t resilience. Learn how healthcare CISOs prevent hospital-wide outages with identity security, network segmentation validation, and CTEM. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/the-analog-panic-button-what-the-pitt-gets-right-and-wrong-about-hospital-cyber-resilience/
-
Analysis: Root Cause of Most Security Incidents Traced to Unpatched Firewalls
Tags: access, cybercrime, exploit, firewall, network, ransomware, security-incident, software, vulnerabilityAn analysis of more than two trillion IT events collected during 2025 by Barracuda Networks finds 90% of ransomware incidents exploited firewalls via unpatched software or a vulnerable account that enables cybercriminals to gain access to an IT environment. Merium Khalid, director of offensive security for the security operations center (SOC) at Barracuda Networks, said..…
-
Analysis: Root Cause of Most Security Incidents Traced to Unpatched Firewalls
Tags: access, cybercrime, exploit, firewall, network, ransomware, security-incident, software, vulnerabilityAn analysis of more than two trillion IT events collected during 2025 by Barracuda Networks finds 90% of ransomware incidents exploited firewalls via unpatched software or a vulnerable account that enables cybercriminals to gain access to an IT environment. Merium Khalid, director of offensive security for the security operations center (SOC) at Barracuda Networks, said..…
-
Analysis: Root Cause of Most Security Incidents Traced to Unpatched Firewalls
Tags: access, cybercrime, exploit, firewall, network, ransomware, security-incident, software, vulnerabilityAn analysis of more than two trillion IT events collected during 2025 by Barracuda Networks finds 90% of ransomware incidents exploited firewalls via unpatched software or a vulnerable account that enables cybercriminals to gain access to an IT environment. Merium Khalid, director of offensive security for the security operations center (SOC) at Barracuda Networks, said..…
-
Ransomware payments dropped in 2025 as attack numbers reached record levels: Chainalysis
The rate at which ransomware victims paid cybercriminals fell last year while the overall number of attacks ballooned, Chainalysis found. First seen on therecord.media Jump to article: therecord.media/ransomware-payments-chainalysis-cybercrime
-
Notorious ransomware gang allegedly blackmailed by fake FSB officer
There is a certain poetic justice in a cybersecurity-related story that has emerged from Moscow this week: A man has been accused of trying to extort money… from a notorious Russian ransomware gang. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/ransomware-gang-blackmailed-fake-fsb-officer
-
Ransomware payment rate drops to record low as attacks surge
The number of ransomware victims paying threat actors has dropped to 28% last year, an all-time low, despite a significant increase in the number of claimed attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-payment-rate-drops-to-record-low-despite-attack-surge/
-
Marquis Takes Legal Action Against SonicWall Over Ransomware Attack from Backup Breach
Tags: attack, backup, breach, cloud, cyber, cybersecurity, firewall, ransomware, service, software, vulnerabilityMarquis Software Solutions has filed a lawsuit against cybersecurity firm SonicWall, claiming a vulnerability in SonicWall’s cloud backup service led directly to a ransomware attack on its network. Filed in a Texas federal court, the complaint highlights a massive failure in securing sensitive firewall configuration files.”‹ On August 14, 2025, Marquis experienced a devastating ransomware…
-
Expert Recommends: Prepare for PQC Right Now
Introduction: Steal It Today, Break It in a DecadeDigital evolution is unstoppable, and though the pace may vary, things tend to fall into place sooner rather than later. That, of course, applies to adversaries as well. The rise of ransomware and cyber extortion generated funding for a complex and highly professional criminal ecosystem. The era…
-
Steaelite RAT combines data theft and ransomware management capability in one tool
Tags: access, android, attack, authentication, awareness, business, corporate, credentials, crypto, cybercrime, data, ddos, defense, encryption, endpoint, extortion, infection, infosec, malware, mobile, monitoring, password, phishing, ransomware, rat, remote-code-execution, theft, threat, tool, training, windowsCSO that this isn’t the most sophisticated RAT he’s seen. “The novel aspect here,” he said, “is the convergence. Steaelite bundles remote access, credential harvesting, data exfiltration, and ransomware (currently in development) in a single package.” Traditionally, he explained, these capabilities have occupied different parts of the cybercrime toolchain, but Steaelite unifies the functions, giving…
-
Marquis Sues SonicWall Over 2025 Firewall Data Breach
Tags: attack, authentication, backup, breach, cloud, credentials, data, data-breach, firewall, flaw, ransomware, softwareLawsuit Claims SonicWall Cloud Backup Flaw Led to Ransomware Attack Against Marquis. Marquis Software Solutions has sued SonicWall alleging a cloud backup data breach exposed firewall configuration files, including credentials and multifactor authentication scratch codes. The firm says the breach enabled an August 2025 ransomware attack and triggered dozens of class action lawsuits. First seen…
-
Ransomware hammers manufacturing sector
Ransomware attacks on manufacturers are skyrocketing. For cybercriminals, the sector sits at a sweet spot on the risk-reward continuum. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366639452/Ransomware-hammers-manufacturing-sector
-
RAMP Forum Seizure Fractures Ransomware Ecosystem
Researchers suggest defenders monitor how these malicious groups re-form and leverage the useful threat intel to guide their next moves. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/ramp-forum-seizure-fractures-ransomware-ecosystem
-
Emulating the Mutative BlackByte Ransomware
AttackIQ has released a new attack graph that emulates the behaviors exhibited by BlackByte ransomware, a strain operated under the Ransomware-as-a-Service (RaaS) model that emerged in July 2021. Since its emergence, BlackByte has targeted organizations worldwide, including entities within U.S. critical infrastructure sectors such as Government, Financial Services, Manufacturing, and Energy. First seen on securityboulevard.com…
-
Marquis sues SonicWall over backup breach that led to ransomware attack
Marquis Software Solutions has filed a lawsuit against SonicWall, accusing the cybersecurity company of gross negligence and misrepresentation that allegedly led to a ransomware attack disrupting operations at 74 U.S. banks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/marquis-sues-sonicwall-over-backup-breach-that-led-to-ransomware-attack/
-
Moscow man accused of posing as FSB officer to extort Conti ransomware gang
A Moscow resident has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service, according to local media reports. First seen on therecord.media Jump to article: therecord.media/moscow-man-accused-of-extorting-conti-gang
-
Marquis Accuses SonicWall of Security Lapses; Ties it to Ransomware Attack
A legal dispute is intensifying in Texas as fintech firm Marquis sues its firewall provider, SonicWall, alleging that security failures within the company’s cloud backup service directly contributed to a far-reaching ransomware attack. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/marquis-sues-sonicwall-ransomware/
-
Lazarus APT group deployed Medusa Ransomware against Middle East target
North Korea’s Lazarus Group used Medusa ransomware in an attack on an unnamed Middle East organization, researchers report. The North Korea-linked Lazarus APT Group, also known as Diamond Sleet and Pompilus, has been spotted deploying Medusa ransomware against an unnamed organization in the Middle East, according a new report from the Symantec and Carbon Black…
-
Threat Actors Exploit Apache ActiveMQ Vulnerability to Gain RDP Access, Deploy LockBit Ransomware
Threat actors recently abused a critical Apache ActiveMQ vulnerability to gain deep access to a Windows environment, eventually deploying LockBit ransomware over RDP. The attack shows how failing to patch CVE-2023-46604 can give adversaries repeat access and time to turn an initial foothold into full-domain impact. The exploit loaded a malicious Java Spring bean configuration XML file,…