Tag: ransomware
-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most…
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
The group has been linked to a 2025 attack targeting technology firm Ingram Micro. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-cisa-warn-safepay-ransomware-threat-critical-infrastructure/833589/
-
INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages
SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen… First seen on hackread.com Jump to article: hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/
-
Gentlemen Ransomware Hackers Hijack Legitimate Lenovo Drivers to Disable Security Software
The Gentlemen ransomware operation is abusing legitimate Lenovo and Safetica kernel drivers to terminate security software, weakening endpoint defenses before encryption. Acronis Threat Research Unit researchers identified two custom dropper samples during a recent incident, exposing how the group weaponizes vulnerable drivers rather than relying exclusively on conventional process termination commands The technique, known as…
-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks – and both are evolving their tactics in an attempt to outdo one another First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257/
-
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/children-data-stolen-password1/
-
SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/
-
CISA Warns SafePay Ransomware Has Hit 600+ Organizations and Destroyed Backup Systems
Tags: advisory, attack, backup, cisa, cyber, data, encryption, infrastructure, ransomware, theft, usaCISA has warned that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors, combining data theft and encryption with deliberate attacks on backup systems to obstruct recovery. The October 20, 2026, joint advisory describes operations spanning North America, South America, Europe, and Australia since August 2024. Published with the FBI,…
-
INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds
Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. The investigation began in late September 2026 with open directories on 45.227.254[.]43. Configuration files and credentials led researchers to six additional adversary servers, exposing development infrastructure, command infrastructure and ransomware staging systems. The findings describe an active…
-
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks. First seen on therecord.media Jump to article: therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims
-
Ransomware groups expand targeting of Palo Alto Networks vulnerability
Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/
-
Ransomware Gangs Use AI to Find and Steal the Most Sensitive Company Data Quickly
Ransomware operators are using generative AI to sharpen phishing campaigns, speed up reconnaissance, and identify sensitive corporate information to steal. Zscaler ThreatLabz describes a shift toward faster, more selective extortion, where attackers prioritize damaging disclosures rather than relying exclusively on file encryption. That represents a 275.8% annual increase. These figures establish the scale of theft,…
-
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. Detectives have linked the man to the attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/qilin-ransomware-arrested-synnovis-patient-death
-
FBI Uncovers Suspected Links Between Ransomware Negotiators and ShinyHunters Hackers
Federal investigators examining the ShinyHunters group have uncovered potential connections between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity investigation published on October 19. Sources familiar with the inquiry revealed that an executive from an unnamed U.S. consulting company allegedly assisted in operating the group’s victim extortion website. This…
-
States Fine Pediatric Practice, IT Vendor $2.7M Over Hack
Settlements Stem From 2024 Hack Claimed by BianLian Affecting Nearly 900,000. A pediatric practice in New York and Connecticut and one of its former IT services vendors will collectively pay those two states financial penalties of $2.7 million for a 2024 hacking incident that affected nearly 900,000 people. Ransomware gang BianLian claimed responsibility for the…
-
US Ransomware Negotiator Suspected of Helping ShinyHunters Extort Victims
Federal investigators suspect a US ransomware negotiator helped ShinyHunters operate an extortion site used to pressure nearly 100 organisations. First seen on hackread.com Jump to article: hackread.com/us-ransomware-negotiator-shinyhunters-extort-victims/
-
Cyberangriffe auf deutsche Unternehmen steigen um 103 Prozent
Cyberangriffe in Deutschland steigen um 103 Prozent. Check Point warnt vor zunehmenden Bedrohungen durch Ransomware, Phishing und riskante KI-Nutzung. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cyberangriffe-auf-deutsche-unternehmen-steigen-um-103-prozent/a46802/
-
Ransomware pressure now reaches employees’ homes and families
Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/19/semperis-ransomware-employee-safety-report/
-
Krybit ransomware: what you need to know
Tags: ransomwareKrybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. First seen on fortra.com Jump to article: www.fortra.com/blog/krybit-ransomware-what-you-need-know
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 119
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime AI models may be capable of self-replicating without access to a datacenter XWorm Reborn: From infostealer to surveillance platform Hirudo: From Fake Updates…
-
When Your Ransomware Negotiator Works for the Other Side
Tags: ransomwareThe shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/when-your-ransomware-negotiator-works-other-side
-
Baltimore suburb confirms August data breach after ransomware claims
Anne Arundel County, Maryland, said an intruder stole files from government systems, and investigators are working to assess how much data was exposed. First seen on therecord.media Jump to article: therecord.media/anne-arundel-county-maryland-confirms-data-breach
-
Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks
Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity. The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious…
-
Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments
New report warns that threats of violence against employees of organizations hit by ransomware are on the rise as attackers find new ways to guarantee payments First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-threats-physical/
-
Breach Roundup: French Supermarket Hacks a ‘Wake-Up Call’
e=4>This week: French attack fallout, Ahold Delhaize restored deliveries, North Korean IT worker crackdown, seafood logistics ransomware, Aoki infostealer, Hirudo Trojan, Palo Alto patch, a Russian oil refinery targeted, Poland investigated Pegasus and a suspected cybercrime marketplace admin arrested. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-french-supermarket-hacks-wake-up-call-a-33123