Tag: ransomware
-
How Can CISOs Respond to Ransomware Getting More Violent?
Ransomware defense requires focusing on business resilience. This means patching issues promptly, improving user education, and deploying multi-factor authentication. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/how-cisos-respond-ransomware-getting-more-violent
-
FBI Takes Down RAMP Ransomware Forum
The dark web forum administrator confirmed the takedown and said they had “no plans to rebuild” First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fbi-takes-down-ramp-ransomware/
-
Ransomware Victim Numbers Rise, Despite Drop in Active Extortion Groups
Ransomware victims surged in Q4 2025 despite fewer active extortion groups, with data leaks rising 50%, ReliaQuest researchers report First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-numbers-rise-despite/
-
Schlag gegen Ransomware: FBI nimmt Cybergangstern ihr Forum weg
Das FBI hat ein vor allem an Ransomware-Hacker gerichtetes Cybercrime-Forum namens Ramp übernommen. Gründer war wohl ein alter Bekannter aus Russland. First seen on golem.de Jump to article: www.golem.de/news/schlag-gegen-ransomware-fbi-nimmt-cybergangstern-ihr-forum-weg-2601-204764.html
-
IR Trends Q4 2025: Exploitation remains dominant, phishing campaign targets Native American tribal organizations
A drop in exploitation and ransomware, but a spike in phishing and credential abuse, show why timely patching and robust MFA matter more than ever. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/ir-trends-q4-2025/
-
Ene, mene, muh? So wählen Ransomware-Gruppen ihre Opfer
Tags: ransomwareWer glaubt, Ransomware-Gruppen würden ihre Ziele akribisch nach Branchen, Standorten oder strategischer Bedeutung selektieren, liegt meist daneben. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/so-waehlen-ransomware-gruppen-opfer
-
Initial access hackers switch to Tsundere Bot for ransomware attacks
A prolific initial access broker tracked as TA584 has been observed using the Tsundere Bot alongside XWorm remote access trojan to gain network access that could lead to ransomware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/initial-access-hackers-switch-to-tsundere-bot-for-ransomware-attacks/
-
Site catering to online criminals has been seized by the FBI
Tags: ransomwareOne of the last holdouts for ransomware discussions, RAMP is taken down. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/01/site-catering-to-online-criminals-has-been-seized-by-the-fbi/
-
Ransomware crims forced to take off-RAMP as FBI seizes forum
Cybercrime solved. The end First seen on theregister.com Jump to article: www.theregister.com/2026/01/28/fbi_seizes_ramp_forum/
-
Russian Cybercrime Platform RAMP Forum Seized by FBI
US authorities have seized the RAMP cybercrime forum, taking down both its clearnet and dark web domains in a major hit to the ransomware infrastructure. First seen on hackread.com Jump to article: hackread.com/russian-cybercrime-ramp-forum-seized-fbi/
-
FBI seizes RAMP cybercrime forum used by ransomware gangs
The FBI has seized the notorious RAMP cybercrime forum, a platform used to advertise a wide range of malware and hacking services, and one of the few remaining forums that openly allowed the promotion of ransomware operations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-seizes-ramp-cybercrime-forum-used-by-ransomware-gangs/
-
Russian Cybercrime Platform RAMP Forum Seized by Feds
US authorities have seized the RAMP cybercrime forum, taking down both its clearnet and dark web domains in a major hit to the ransomware infrastructure. First seen on hackread.com Jump to article: hackread.com/russian-cybercrime-ramp-forum-seized-feds/
-
Wie Ransomware-Gruppen ihre Opfer auswählen
Die Sophos-X-Ops-Counter-Threat-Unit (CTU) untersucht in einer neuen Studie, wie Ransomware-Akteure ihre Ziele auswählen. Das Ergebnis macht einmal mehr klar, dass die Cyberkriminelle gerne den Weg des geringsten Widerstands gehen: die überwiegende Mehrheit der untersuchten Ransomware-Angriffe erfolgte opportunistisch und nicht gezielt. Die Analyse der CTU-Telemetriedaten belegt, dass Angreifer in den meisten Fällen ihre vorhandenen Zugriffsrechte ausnutzen,…
-
Sophos X-Ops untersucht wie Ransomware-Akteure ihre Ziele auswählen
Werden Organisationen eines bestimmten Sektors Opfer einer spezifischen Gruppe, liegt dies wahrscheinlich daran, dass diese Gruppe eine Schwachstelle in einem in diesem Sektor weit verbreiteten Dienst ausnutzt. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/sophos-x-ops-untersucht-wie-ransomware-akteure-ihre-ziele-auswaehlen/a43490/
-
GoTo Resolve Tool’s Background Activities Compared to Ransomware Tactics
New research from Point Wild’s Lat61 team reveals how the HEURRemoteAdmin.GoToResolve.gen tool allows silent, unattended access to PCs. Learn why this legitimate remote administration software is being flagged as a security risk and its surprising connection to ransomware tactics. First seen on hackread.com Jump to article: hackread.com/goto-resolve-activities-ransomware-tactics/
-
Sicarii ransomware locks your data and throws away the keys
Tags: ai, business, communications, compliance, credentials, data, encryption, extortion, finance, malware, network, ransomware, risk, vulnerabilityUnusual technical profile hints at vibe-coding: One possible explanation for Sicarii’s broken encryption flow is immature or poorly implemented development practices. The ransomware’s failure to retain usable keys is inconsistent with established ransomware design and suggests it may have been assembled without rigorous testing or a clear understanding of operational consequences, or even vibe-coded.”Halcyon assesses…
-
Vibe-Coded ‘Sicarii’ Ransomware Can’t Be Decrypted
A new ransomware strain that entered the scene last year has poorly designed code and an odd Hebrew identity that might be a false flag. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/vibe-coded-sicarii-ransomware-decrypted
-
NDSS 2025 Detecting Ransomware Despite I/O Overhead: A Practical Multi-Staged Approach
Tags: attack, conference, cyber, detection, exploit, Internet, monitoring, network, phishing, ransomware, risk, windows, zero-daySession 10B: Ransomware Authors, Creators & Presenters: Christian van Sloun (RWTH Aachen University), Vincent Woeste (RWTH Aachen University), Konrad Wolsing (RWTH Aachen University & Fraunhofer FKIE), Jan Pennekamp (RWTH Aachen University), Klaus Wehrle (RWTH Aachen University) PAPER Detecting Ransomware Despite I/O Overhead: A Practical Multi-Staged Approach Ransomware attacks have become one of the most widely…
-
Broken decryptor leaves Sicarii ransomware victims adrift
A coding error in an emergent strain of ransomware leaves victims unable to recover their data, even if they cooperate with the hackers’ demands First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366637711/Broken-decryptor-leaves-Sicarii-ransomware-victims-adrift
-
Nike investigates data breach after extortion gang leaks files
Nike is investigating what it described as a “potential cyber security incident” after the World Leaks ransomware gang leaked 1.4 TB of files allegedly stolen from the sportswear giant. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nike-investigates-data-breach-after-extortion-gang-leaks-files/
-
State of Ransomware Survey 2025 von Crowdstrike – Angreifer KI überholt Möglichkeiten von Unternehmen
First seen on security-insider.de Jump to article: www.security-insider.de/deutsche-unternehmen-ki-gestuetzte-cyberangriffe-a-1c68abdc23a2c7852b71a1af9ded458f/
-
From Cipher to Fear: The psychology behind modern ransomware extortion
Modern ransomware has shifted from encryption to psychological extortion that exploits fear, liability, and exposure. Flare shows how today’s ransomware groups weaponize stolen data and pressure tactics to force payment. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/from-cipher-to-fear-the-psychology-behind-modern-ransomware-extortion/
-
World Leaks Ransomware Group Claims 1.4TB Nike Data Breach
Nike is investigating after the World Leaks ransomware group posted a 1.4TB data dump First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/worldleaks-ransomware-14tb-nike/
-
NDSS 2025 all your (data)base are belong to us: Characterizing Database Ransom(ware) Attacks
Tags: attack, authentication, conference, credentials, finance, group, Internet, network, ransom, ransomware, softwareSession 10B: Ransomware Authors, Creators & Presenters: Kevin van Liebergen (IMDEA Software Institute), Gibran Gomez (IMDEA Software Institute), Srdjan Matic (IMDEA Software Institute), Juan Caballero (IMDEA Software Institute) PAPER all your (data)base are belong to us: Characterizing Database Ransom(ware) Attacks We present the first systematic study of database ransom(ware) attacks, a class of attacks where…
-
NDSS 2025 ERW-Radar
Tags: antivirus, china, conference, defense, detection, Internet, malicious, network, ransomware, softwareAuthors, Creators & Presenters: Lingbo Zhao (Institute of Information Engineering, Chinese Academy of Sciences), Yuhui Zhang (Institute of Information Engineering, Chinese Academy of Sciences), Zhilu Wang (Institute of Information Engineering, Chinese Academy of Sciences), Fengkai Yuan (Institute of Information Engineering, CAS), Rui Hou (Institute of Information Engineering, Chinese Academy of Sciences) PAPER ERW-Radar: An Adaptive…
-
über 42.000 Betroffene – Ingram Micro meldet Ransomware-Angriff
First seen on security-insider.de Jump to article: www.security-insider.de/ransomware-angriff-ingram-micro-auswirkungen-reaktionen-a-e734ddc056333f89749a65a1591ba414/
-
CISO’s predictions for 2026
Tags: access, ai, attack, authentication, automation, breach, business, ciso, cloud, control, credentials, cryptography, cyber, cyberattack, cybersecurity, data, data-breach, encryption, endpoint, extortion, finance, governance, government, healthcare, identity, infrastructure, malicious, mobile, mssp, network, password, penetration-testing, ransomware, risk, router, saas, soc, strategy, supply-chain, technology, threat, tool, vulnerability, warfareAI agents to reshape the threat landscape: But those same AI technologies are also changing the threat landscape. Toal points to a recent Anthropic report that documented the first large-scale AI-enabled cyberattack as an early warning sign. “I guarantee attackers will be more focused on using AI agents for what they want than a lot…
-
Security Affairs newsletter Round 560 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Osiris ransomware emerges, leveraging BYOVD technique to kill security tools U.S. CISA adds a flaw in…
-
Osiris ransomware emerges, leveraging BYOVD technique to kill security tools
Researchers identified a new Osiris ransomware used in a November 2025 attack, abusing the POORTRY driver via BYOVD to disable security tools. Symantec and Carbon Black researchers uncovered a new ransomware strain named Osiris, used in a November 2025 attack against a major Southeast Asian food service franchise operator. The attackers deployed a malicious driver,…