Tag: ransomware
-
Cyberkriminelle nehmen Deutschland zunehmend ins Visier
Im Jahr 2024 wurden insgesamt 154 Ransomware-Angriffe auf deutsche Organisationen gezählt ein besorgniserregender Anstieg. Zwar liegen die USA mit 1.821 Angriffen weiterhin weit vorn, gefolgt von Großbritannien mit 216 Fällen. Doch Deutschland holt rasant auf ein klares Zeichen dafür, dass deutsche Unternehmen für Cyberangreifer immer interessanter werden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cyberkriminelle-nehmen-deutschland-zunehmend-ins-visier/a41609/
-
SonicWall Investigating Potential SSL VPN Zero-Day After 20+ Targeted Attacks Reported
SonicWall said it’s actively investigating reports to determine if there is a new zero-day vulnerability following reports of a spike in Akira ransomware actors in late July 2025.”Over the past 72 hours, there has been a notable increase in both internally and externally reported cyber incidents involving Gen 7 SonicWall firewalls where SSLVPN is enabled,”…
-
Ransomware groups shift to quadruple extortion to maximize pressure
Threat actors are using a new quadruple extortion tactic in ransomware campaigns, while double extortion remains the most common approach, according to Akamai. Ransomware … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/05/ransomware-extortion-tactics-quadruple-extortion/
-
SonicWall investigates ‘cyber incidents,’ including ransomware targeting suspected 0-day
Bypassing MFA and deploying ransomware”¦sounds like something that rhymes with ‘schmero-day’ First seen on theregister.com Jump to article: www.theregister.com/2025/08/04/sonicwall_investigates_cyber_incidents/
-
Ransomware Hits Phone Repair Insurance Firm, Causing Millions in Damage
Wilhelm Einhaus, a businessman from Bockum-Hövel, Germany, pioneered cell phone insurance services, establishing a robust network that integrated innovative offerings like a 24-hour repair and replacement program. His enterprise expanded rapidly, partnering with major telecommunications providers such as Deutsche Telekom and 1&1, and distributing products through over 5,000 retail outlets nationwide. At its zenith, the…
-
SonicWall urges customers to take VPN devices offline after ransomware campaign
Multiple cybersecurity incident response firms are warning about the possibility that a zero-day vulnerability in some SonicWall devices is allowing ransomware attacks. First seen on therecord.media Jump to article: therecord.media/sonicwall-possible-zero-day-gen-7-firewalls-ssl-vpn
-
Details emerge on BlackSuit ransomware takedown
The Russian cybercrime group attacked more than 180 organizations before members abandoned the brand and dispersed to new ransomware groups earlier this year. First seen on cyberscoop.com Jump to article: cyberscoop.com/blacksuit-ransomware-takedown/
-
Black Hat USA: Halcyon and Sophos tag-team ransomware fightback
Ransomware experts Halcyon and Sophos are to pool their expertise in ransomware, working together to enhance data- and intelligence-sharing and bringing more comprehensive protection to customers. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366628361/Black-Hat-USA-Halcyon-and-Sophos-tag-team-ransomware-fightback
-
Akira Ramps Up Assault on SonicWall Firewalls, Suggesting Zero-Day
An uptick of ransomware activity by the group in late July that uses the vendor’s SSL VPN devices for initial intrusion shows evidence of an as-yet-undisclosed flaw under exploitation. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/akira-sonicwall-firewalls-zero-day
-
Securing the Skies: Balancing Cybersecurity, Innovation and Risk in Modern Aviation
Commercial aviation has always treated safety as non-negotiable, yet its digital attack surface keeps widening. Aerospace security specialists Lawrence Baker and Jeffrey Hall tell Mike Vizard that the industry now juggles classic ransomware on ticketing systems and loyalty apps while defending aircraft and ground equipment that were never designed for today’s threat landscape. Airlines are..…
-
Uptick in Akira Ransomware Actors Targeting SonicWall VPNs
Arctic Wolf has spotted an increase in Akira ransomware attacks targeting SonicWall SSL VPNs First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/uptick-akira-ransomware-actors/
-
Leaked, Patched, and Still Hacked: The SharePoint Zero-Day Crisis
This week we explore the recent Microsoft SharePoint vulnerability that has led to widespread exploitation by ransomware gangs and Chinese State-sponsored hackers. We also cover the confirmed compromise of multiple US agencies, including the Department of Homeland Security, in a large-scale cyber espionage campaign. Kevin Johnson joins to discuss the implications of these events, the……
-
Aktivitäten mit Fokus auf Sonicwall-SSL-VPNs der Ransomware Akira nehmen zu
Ende Juli 2025 hat Arctic Wolf eine Zunahme von Ransomware-Aktivitäten festgestellt, bei denen Sonicwall-Firewall-Geräte als Einstiegsstellen genutzt wurden. In den analysierten Fällen wurden innerhalb kurzer Zeit mehrere sogenannte ‘Pre-Ransomware”-Intrusionen mit Zugang über Sonicwall-SSL-VPNs durchgeführt. Obwohl Angriffe auf Basis kompromittierter Zugangsdaten nicht in allen Fällen ausgeschlossen werden können, deuten die vorliegenden Hinweise auf eine Zero-Day-Schwachstelle in…
-
SonicWall firewalls targeted in ransomware attacks, possibly via zero-day
Attackers wielding the Akira ransomware and possibly a zero-day exploit have been spotted targeting SonicWall firewalls since July 15, 2025. >>In the intrusions reviewed, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/04/sonicwall-firewalls-ssl-vpn-ransomware-akira/
-
Ransomware gangs join attacks targeting Microsoft SharePoint servers
Ransomware gangs have recently joined ongoing attacks targeting a Microsoft SharePoint vulnerability chain, part of a broader exploitation campaign that has already led to the breach of at least 148 organizations worldwide. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-gangs-join-attacks-targeting-microsoft-sharepoint-servers/
-
Aktivitäten mit Fokus auf Sonicwall-SSL-VPNs der Ransomware Akira nehmen zu
Ende Juli 2025 hat Arctic Wolf eine Zunahme von Ransomware-Aktivitäten festgestellt, bei denen Sonicwall-Firewall-Geräte als Einstiegsstellen genutzt wurden. In den analysierten Fällen wurden innerhalb kurzer Zeit mehrere sogenannte ‘Pre-Ransomware”-Intrusionen mit Zugang über Sonicwall-SSL-VPNs durchgeführt. Obwohl Angriffe auf Basis kompromittierter Zugangsdaten nicht in allen Fällen ausgeschlossen werden können, deuten die vorliegenden Hinweise auf eine Zero-Day-Schwachstelle in…
-
Leaked, Patched, and Still Hacked: The SharePoint Zero-Day Crisis
This week we explore the recent Microsoft SharePoint vulnerability that has led to widespread exploitation by ransomware gangs and Chinese State-sponsored hackers. We also cover the confirmed compromise of multiple US agencies, including the Department of Homeland Security, in a large-scale cyber espionage campaign. Kevin Johnson joins to discuss the implications of these events, the……
-
German phone repair biz collapses following 2023 ransomware attack
Founder miffed over prosecutors holding onto its Bitcoin First seen on theregister.com Jump to article: www.theregister.com/2025/08/04/einhaus_group_ransomware_collapse/
-
ShadowSyndicate Infrastructure Used by Multiple Ransomware Groups Including Cl0p, LockBit and RansomHub
Cybersecurity researchers have uncovered significant overlaps between the attack infrastructure of ShadowSyndicate, also known as Infra Storm by Group-IB, and several prominent ransomware-as-a-service (RaaS) operations. Active since July 2022, ShadowSyndicate has been linked to high-profile RaaS brands such as AlphaV/BlackCat, LockBit, Play, Royal, Cl0p, Cactus, and RansomHub. The group, speculated to function more as a…
-
Interlock Ransomware Uses ClickFix Exploit to Execute Malicious Commands on Windows
The Interlock ransomware group was connected to several sophisticated cyber incidents that targeted firms in North America and Europe, according to a recent report published in July 2025 by eSentire’s Threat Response Unit (TRU). The group, active since September 2024, employs a multi-stage attack chain that begins with the exploitation of compromised websites, such as…
-
Analysten warnen: Hackern wird es oft zu leicht gemacht
Mit bestehenden Codebausteinen können Cyberkriminelle schnell und einfach neue Malware erstellen. Am Beispiel der Ransomware-Varianten Nitrogen und LukaLocker gehen Analysten ihrem Ursprung nach und zeigen, wie sich Unternehmen vor diesem zunehmenden Phänomen schützen können. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hackern-leicht-gemacht
-
Akira Ransomware targets SonicWall VPNs in likely zero-day attacks
Akira ransomware targets fully patched SonicWall VPNs in suspected zero-day attacks, with multiple intrusions seen in late July 2025. Arctic Wolf Labs researchers reported that Akira ransomware is exploiting SonicWall SSL VPNs in a likely zero-day attack, targeting even fully patched devices. Arctic Wolf Labs observed multiple intrusions via VPN access in late July 2025.…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 56
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Endgame Gear mouse config tool infected users with malware Auto-Color Backdoor: How Darktrace Thwarted a Stealthy Linux Intrusion Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal Decrypted: FunkSec Ransomware Threat actor uses…
-
Qilin Ransomware Affiliate Panel Login Credentials Exposed Online
A significant security breach within the Qilin ransomware operation has provided unprecedented insight into the group’s affiliate network structure and operational methods. On July 31, 2025, internal conflicts between the ransomware group and one of its affiliates led to the public exposure of sensitive operational details, marking a rare glimpse into the inner workings of…
-
Microsoft SharePoint Hackers Switch Gears to Spread Ransomware
Threat actors exploit SharePoint flaws to access internal systems, steal sensitive data, and carry out surveillance, impersonation, and extortion. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-sharepoint-vulnerabilities-exploitation/
-
US Agencies Warn of Surging Interlock Ransomware Attacks Targeting Healthcare, Businesses
Federal agencies warn of rising Interlock ransomware attacks targeting healthcare and critical sectors using double extortion and advanced social engineering. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-interlock-ransomware-healthcare-warning/
-
Akira Ransomware Exploits 0-Day Vulnerability in SonicWall Firewall Devices
Tags: access, attack, cyber, cybersecurity, exploit, firewall, ransomware, vpn, vulnerability, zero-dayCybersecurity firm Arctic Wolf has identified a significant increase in ransomware attacks targeting SonicWall firewall devices in late July 2025, with evidence pointing to the exploitation of a previously unknown zero-day vulnerability. The company’s investigation revealed multiple coordinated attacks using SonicWall SSL VPNs as the initial access point, raising serious concerns about the security of…