Tag: ransomware
-
Cryptohack Roundup: Conviction in Uranium Finance Hack
Also: A US Court Orders $30M Penalty in Fundsz Fraud Case. This week, a conviction in a $54 million exploit, a $30 million Fundsz fraud penalty, Near Intents post-hack, Abstract Blockchain will shutdown, Velocity’s victim reimbursements, two U.S. regulatory proposals withdrawn, a ZachXBT North Korean laundering probe and ransomware-linked wallets identified. First seen on govinfosecurity.com…
-
MonsterCloud Owner Charged With Secretly Paying Ransomware Demands
Tags: ransomwareMonsterCloud owner Zohar Pinhasi allegedly paid ransomware demands behind clients’ backs, then charged them millions for the supposed recovery. Zohar Pinhasi, the owner of Florida-based MonsterCloud, was charged this week with wire fraud. Federal prosecutors say his clients were scammed twice during the same ransomware crisis. Pinhasi (50) also used the names “Zack Silver” and…
-
Global cyber attacks up 48% as ransomware and phishing climb, Check Point finds
Organisations worldwide faced an average of 2,803 cyber attacks per week in September 2026, up 16% on August and 48% on the same month last year, according to new data from Check Point Research. The figures point to sustained growth rather than a one-off spike. Weekly attacks per organisation have climbed 36% in five months,…
-
Angeklagter zahlte heimlich Lösegeld: Ransomware-Entschlüsselungsdienst vor Gericht
Tags: ransomwareVon Ransomware-Angriffen betroffenen Firmen versprach der Angeklagte, über fortschrittliche Entschlüsselungstechniken zu verfügen. First seen on golem.de Jump to article: www.golem.de/news/angeklagter-zahlte-heimlich-loesegeld-ransomware-entschluesselungsdienst-vor-gericht-2610-213874.html
-
No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers
Incident responders rarely get to watch an attack from the beginning. More often, security tooling arrives after the damage is done, either as part of the response or because a rollout was still underway when the attackers struck. That was the position Huntress found itself in this September, when its agent was deployed at an…
-
Ransomware recovery firm boss charged with secretly paying attackers and overcharging victims
The owner of Florida-based ransomware remediation company MonsterCloud has been charged with fraud for allegedly paying ransomware gangs behind his clients’ backs and billing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/monstercloud-owner-ransomware-fraud-charges/
-
MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data
The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data.Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire…
-
Qilin-Hacker nach Deutschland ausgeliefert
Ein mutmaßliches Mitglied der Hackergruppe Qilin ist an Deutschland überstellt worden. Dem Russen wird ein Angriff auf ein deutsches Logistikunternehmen vorgeworfen. First seen on golem.de Jump to article: www.golem.de/news/ransomware-qilin-hacker-nach-deutschland-ausgeliefert-2610-213843.html
-
Medical devices patients rely on most are least prepared for quantum attacks
Threat actors are exploiting IT, IoMT, OT and IoT devices across healthcare delivery organizations (HDOs) to deploy ransomware, demand payments and monetize stolen patient … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/forescout-healthcare-quantum-readiness-report/
-
Smashing Security podcast #487: Clippy’s crypto comeback
Microsoft’s Twitter account, with its 13 million followers, was hijacked by a paperclip. There was no ransomware or data theft, just Clippy, a dodgy crypto coin, and a corporate apology that wasn’t from Microsoft either. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-487/
-
Ransomware recovery CEO charged over secret ransom payments
The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
Ransomware has a new target. Is your backup ready?
Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-has-a-new-target-is-your-backup-ready/
-
Advantest confirms personal information stolen in ransomware attack
Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/advantest-confirms-personal-information-stolen-in-ransomware-attack/
-
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks
The FBI and Secret Service warned Fortinet users that FortiBleed, uncovered this summer, is a continuing threat. First seen on cyberscoop.com Jump to article: cyberscoop.com/fortibleed-fortinet-vpn-ransomware-fbi-warning/
-
Osaka Metropolitan University cancels classes after suspected ransomware attack
Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable. First seen on therecord.media Jump to article: therecord.media/osaka-university-cancels-classes-ransomware
-
Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks
A Russian-speaking Gentlemen ransomware affiliate used the Model Context Protocol (MCP) to execute commands during live intrusions, turning an AI coding assistant’s tool interface into an operational command-and-control channel. CloudSEK identified the activity while investigating exposed infrastructure belonging to an operator calling himself Azazel. Azazel also operated LEAKNED, an independent leak site that allegedly diverted…
-
Engineer sentenced for locking over 3,000 devices on employer network
A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer’s network in a ransomware-style attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/engineer-sentenced-for-locking-thousands-of-devices-on-employer-network/
-
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/affiliate-doublecrosses-raas/
-
University of Illinois Chicago affected by ransomware attack on medical school
A ransomware attack that affected the University of Illinois Chicago (UIC) College of Medicine resulted in the theft of some information from its servers. First seen on therecord.media Jump to article: therecord.media/ransomware-university-illinois-chicago
-
âš¡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook.There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch…
-
Defending against AI-fueled cyberattacks requires focus on identity, data governance, Microsoft says
The company’s latest report previews how AI is changing threat activity, including by automating ransomware attacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ai-cyberattacks-automation-identity-data-microsoft-report/832020/
-
Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide. Warlock ransomware made headlines back in mid-2025 for exploiting a chain of SharePoint zero-days collectively dubbed ToolShell. More than a year later, the same group is still using that door, and it’s still getting in. Symantec tracks the…
-
Ransomware 2026: Wenn gestohlene Daten zum schärfsten Druckmittel werden
Management Summary Daten statt Verschlüsselung: Ransomware-Gruppen erhöhen den Erpressungsdruck zunehmend durch den Abfluss großer Datenmengen; ThreatLabz beziffert das beobachtete Volumen auf 896,2 Terabyte. Führungskräfte werden zum Einfallstor: 62 Prozent der erfassten Opfer bekleideten laut Report mindestens eine Managementposition privilegierter Zugriff und geschäftlicher Einfluss machen sie besonders attraktiv. Vertrauenswürdige Werkzeuge werden missbraucht: Angriffe über Microsoft… First…
-
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Tags: attack, china, exploit, flaw, government, infrastructure, microsoft, ransomware, threat, tool, vulnerabilityThe suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries.The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations.”In the First seen on thehackernews.com Jump…
-
N0n ransomware: what you need to know
N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. First seen on fortra.com Jump to…
-
Warlock ransomware breach SharePoint in water, telecom operator attacks
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks/