Tag: ransomware
-
Malware devs abuse Anthropic’s Claude AI to build ransomware
Anthropic’s Claude Code large language model has been abused by threat actors who used it in data extortion campaigns and to develop ransomware packages. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malware-devs-abuse-anthropics-claude-ai-to-build-ransomware/
-
Oh goody, the ‘first known AI-powered ransomware’ has been discovered and it ‘may exfiltrate data, encrypt it, or potentially destroy it’
First seen on thesecurityblogger.com Jump to article: www.thesecurityblogger.com/oh-goody-the-first-known-ai-powered-ransomware-has-been-discovered-and-it-may-exfiltrate-data-encrypt-it-or-potentially-destroy-it/
-
Microsoft warns of ransomware gang shifting to steal cloud data, lock companies out of systems
While ransomware gangs traditionally rely on deploying malware to encrypt files, a threat actor’s recent tactics show they no longer need to do that during attacks. First seen on therecord.media Jump to article: therecord.media/ransomware-gangs-shift-to-stealing-cloud-data
-
Electronics Manufacturer Data I/O Suffers Ransomware Breach
Tags: attack, breach, cyber, cybersecurity, data, incident response, infrastructure, programming, ransomware, threatData I/O Corporation, a well-known electronics firm that specializes in device programming and security provisioning solutions, revealed a ransomware attack that penetrated its internal IT infrastructure in a major cybersecurity event. The incident, detected on August 16, 2025, prompted an immediate activation of the company’s incident response protocols, highlighting the persistent threat of ransomware in…
-
Federal, state officials investigating ransomware attack targeting Nevada
The Sunday attack disrupted key services across the state and led to the theft of some data. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/federal-state-investigating-ransomware-nevada/758863/
-
Angreifer missbrauchen Forensik-Tool für Ransomware-Versuch
Das Counter-Threat-Unit CTU) -Team von Sophos hat einen Cyberangriff vereitelt, bei dem Kriminelle ein eigentlich seriöses Open-Source-Programm für digitale Forensik, Velociraptor, missbrauchten. Statt es wie vorgesehen für Sicherheitsanalysen einzusetzen, nutzten die Täter das Tool, um sich verdeckt Zugang zu einem Unternehmensnetzwerk zu verschaffen und weitere Schadsoftware nachzuladen. Ziel war offenbar ein Ransomware-Angriff. So gingen…
-
MATLAB dev says ransomware gang stole data of 10,000 people
MathWorks, a leading developer of mathematical simulation and computing software, revealed that a ransomware gang stole the data of over 10,000 people after breaching its network in April. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/matlab-dev-says-ransomware-gang-stole-data-of-over-10-000-people/
-
Ransomware crooks knock Swedish municipalities offline for measly sum of $168K
Tags: ransomwareMiljödata meltdown leaves 200 local authorities scrambling over 1.5 BTC First seen on theregister.com Jump to article: www.theregister.com/2025/08/28/sweden_council_ransomware/
-
Nevada Confirms Ransomware Attack, State Data Stolen
Nevada’s CIO confirmed in a press conference that ransomware actors had exfiltrated data from state networks, amid an ongoing incident investigation First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nevada-ransomware-attack-data/
-
First AI-Powered Ransomware “PromptLock” Uses OpenAI gpt-oss-20b for Encryption
PromptLock, a novel ransomware strain discovered by the ESET Research team, marks the first known instance of malware harnessing a local large language model to generate its malicious payload on the victim’s machine. Rather than carrying pre-compiled attack logic, PromptLock ships with hard-coded prompts that instruct a locally hosted OpenAI gpt-oss:20b model”, accessed via the…
-
Microsoft Unveils Storm-0501’s Cloud-Based Ransomware Deployment Tactics
Tags: backup, cloud, cyber, data, encryption, endpoint, exploit, intelligence, malware, microsoft, ransom, ransomware, tactics, threatMicrosoft Threat Intelligence has detailed the evolving tactics of the financially motivated threat actor Storm-0501, which has transitioned from traditional on-premises ransomware deployments to sophisticated cloud-based operations. Unlike conventional ransomware that relies on endpoint encryption malware and subsequent decryption key negotiations, Storm-0501 exploits cloud-native capabilities to exfiltrate massive data volumes, obliterate backups, and enforce ransom…
-
Ransomware Actor Deletes Data and Backups Post-Exfiltration on Azure
Microsoft observed Storm-0501 pivot to the victim’s cloud environment to exfiltrate data rapidly and prevent the victim’s recovery First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-deletes-data-backups/
-
Ransomware setzt Einzelhandel massiv unter Druck: Forderungen steigen, IT-Teams am Limit
Die internationale Sophos-Studie ‘The State of Ransomware in Retail 2025″ zeigt, wie sich Ursachen, Auswirkungen und Strategien im Umgang mit Ransomware verändern und mit welchen Konsequenzen IT- und Cybersicherheitsteams im Einzelhandel zu rechnen haben. Technisch wie organisatorisch: Standardursachen für Cyberangriffe im Einzelhandel Nach den Vorgängerstudien aus den Jahren 2023 und 2024 nannten Einzelhändler ausgenutzte Schwachstellen…
-
Someone Created the First AI-Powered Ransomware Using OpenAI’s gpt-oss:20b Model
Cybersecurity company ESET has disclosed that it discovered an artificial intelligence (AI)-powered ransomware variant codenamed PromptLock.Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-time. The open-weight language model was released by OpenAI earlier this month.”PromptLock First seen on thehackernews.com…
-
Microsoft warnt: Ransomware-Gruppe Storm-0501 greift (Azure) Cloud an, verlangt Zahlungen
Microsoft warnt vor der finanziell motivierten Gruppe Storm-0501, die kontinuierlich mit Angriffen auf Cloud-Instanzen (Azure) zielt. Bei Erfolg werden Daten abgezogen, dann die Originale verschlüsselt und Backups zerstört. Anschließend wird Lösegeld verlangt. Cloud-Bedrohung: Warnung vor Storm 0501 In einem Beitrag Storm-0501’s … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/08/28/microsoft-warnt-ransomware-gruppe-storm-0501-greift-azure-cloud-an-verlangt-zahlungen/
-
Storm-0501 hackers shift to ransomware attacks in the cloud
Microsoft warns that a threat actor tracked as Storm-0501 has evolved its operations, shifting away from encrypting devices with ransomware to focusing on cloud-based encryption, data theft, and extortion. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/storm-0501-hackers-shift-to-ransomware-attacks-in-the-cloud/
-
First AI-Powered Ransomware PromptLock Targets Windows, Linux and macOS
ESET has identified PromptLock, the first AI-powered ransomware, using OpenAI models to generate scripts that target Windows, Linux… First seen on hackread.com Jump to article: hackread.com/first-ai-promptlock-ransomware-windows-linux-macos/
-
Experimental PromptLock ransomware uses AI to encrypt, steal data
Threat researchers discovered the first AI-powered ransomware, called PromptLock, that uses Lua scripts to steal and encrypt data on Windows, macOS, and Linux systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/experimental-promptlock-ransomware-uses-ai-to-encrypt-steal-data/
-
Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks
The financially motivated threat actor known as Storm-0501 has been observed refining its tactics to conduct data exfiltration and extortion attacks targeting cloud environments.”Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, First seen on thehackernews.com…
-
Emulating the Expedited Warlock Ransomware
AttackIQ has released a new attack graph that emulates the behaviors exhibited by Warlock ransomware, which emerged in June 2025. Beginning in July, Warlock operators have primarily targeted internet-exposed, unpatched on-premises Microsoft SharePoint servers, exploiting a set of recently disclosed zero-day vulnerabilities, specifically CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, collectively referred to as the “ToolShell” exploit…
-
TDL001 – Cybersecurity Explained: Privacy, Threats, and the Future – Chester Wisniewski
Tags: access, ai, attack, backdoor, breach, business, ciso, computer, country, crime, crimes, cyber, cybercrime, cybersecurity, data-breach, defense, detection, edr, email, finance, firewall, gartner, government, guide, hacker, hacking, Hardware, infosec, Internet, jobs, linkedin, mail, malicious, microsoft, military, monitoring, network, password, phishing, phone, privacy, programming, ransomware, risk, russia, scam, skills, software, sophos, spam, sql, strategy, switch, technology, threat, update, virus, vulnerability, wifi, windowsSummary “The Defenders Log” Episode 1 features host David Redekop and guest Chet Wisniewski discussing the dynamic world of cybersecurity. Wisniewski, with decades of experience, traces his journey from early BBS and phone network exploration to becoming a cybersecurity expert. They delve into the evolution of hacking, the emergence of profitable cybercrime like email spam,…
-
Storm-0501 debuts a brutal hybrid ransomware attack chain
Tags: access, attack, backup, breach, ciso, cloud, data, exploit, least-privilege, microsoft, ransom, ransomware, risk, threat, vulnerabilityA holistic approach to put organizations under pressure: Microsoft’s DiGrippo emphasizes that the unique aspect of this new method is that it leverages hybrid environments that have both on-prem and cloud assets. “They put you in a situation where you’re under a significant amount of pressure because they’ve escalated privileges for themselves on both your…
-
Microsoft details Storm-0501’s focus on ransomware in the cloud
The financially motivated threat group demonstrates deep knowledge of hybrid cloud environments, which allows it to rapidly steal sensitive data, destroy backups and encrypt systems for ransomware. First seen on cyberscoop.com Jump to article: cyberscoop.com/storm-0501-ransomware-microsoft-threat-intelligence/
-
Storm-0501 debuts a brutal hybrid ransomware attack chain
Tags: access, attack, backup, breach, ciso, cloud, data, exploit, least-privilege, microsoft, ransom, ransomware, risk, threat, vulnerabilityA holistic approach to put organizations under pressure: Microsoft’s DiGrippo emphasizes that the unique aspect of this new method is that it leverages hybrid environments that have both on-prem and cloud assets. “They put you in a situation where you’re under a significant amount of pressure because they’ve escalated privileges for themselves on both your…
-
Cephalus Ransomware Exploits RDP for Initial Access in Latest Attack Campaign
Tags: access, attack, authentication, credentials, cyber, cybersecurity, data-breach, endpoint, exploit, mfa, ransomware, threatCybersecurity researchers at Huntress identified a novel ransomware variant dubbed Cephalus, deployed in two separate incidents targeting organizations lacking robust access controls. This emerging threat, which claims its name from Greek mythology symbolizing inevitable tragedy, leverages exposed Remote Desktop Protocol (RDP) endpoints as its primary initial access vector, exploiting compromised credentials without multi-factor authentication (MFA).…
-
Someone Created First AI-Powered Ransomware Using OpenAI’s gpt-oss:20b Model
Cybersecurity company ESET has disclosed that it discovered an artificial intelligence (AI)-powered ransomware variant codenamed PromptLock.Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-time. The open-weight language model was released by OpenAI earlier this month.”PromptLock First seen on thehackernews.com…
-
Cephalus ransomware: What you need to know
Cephalus is a relatively new ransomware operation that emerged in mid-2025, and has already been linked to a wave of high-profile data leaks. First seen on fortra.com Jump to article: www.fortra.com/blog/cephalus-ransomware-what-you-need-know
-
Storm-0501 Hits Enterprise With ‘Cloud-Based Ransomware’ Attack
The financially motivated threat group used cloud resources to conduct a complex, ransomware-style attack against an enterprise victim. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/storm-0501-cloud-based-ransomware-attack
-
AI-Powered Ransomware Has Arrived With ‘PromptLock’
Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/ai-powered-ransomware-promptlock
-
Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier
A suspected ransomware attack on a Swedish software provider is believed to have impacted around 200 of the country’s municipal governments. First seen on therecord.media Jump to article: therecord.media/sweden-municipalities-ransomware-software