Tag: ransomware
-
Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attack on Fully-Patched Devices
SonicWall SSL VPN devices have become the target of Akira ransomware attacks as part of a newfound surge in activity observed in late July 2025.”In the intrusions reviewed, multiple pre-ransomware intrusions were observed within a short period of time, each involving VPN access through SonicWall SSL VPNs,” Arctic Wolf Labs researcher Julian Tuin said in…
-
Ransomware spike linked to potential zero-day flaw in SonicWall devices
Researchers say hackers using;the Akira ransomware strain may be exploiting the vulnerability en masse. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-zero-day-flaw-sonicwall-devices/756641/
-
ISMG Editors: ToolShell Exploit Blurs Crime and Espionage
Also: Rethinking IT-OT Integration; Previewing Black Hat 2025. In this week’s update, four ISMG editors discussed the latest on the ToolShell exploit and the rise of Warlock ransomware, why IT-OT integration may not be the best answer for industrial security and what to expect next week from ISMG Studio at Black Hat Conference 2025. First…
-
SonicWall firewall devices hit in surge of Akira ransomware attacks
SonicWall firewall devices have been increasingly targeted since late July in a surge of Akira ransomware attacks, potentially exploiting a previously unknown security vulnerability, according to cybersecurity company Arctic Wolf. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/surge-of-akira-ransomware-attacks-hits-sonicwall-firewall-devices/
-
SafePay Ransomware Strikes 260+ Victims Across Multiple Countries
The SafePay ransomware organization has quickly become a powerful operator since its initial detection in September 2024, marking a startling increase in the cyber threat scenario. Unlike predominant ransomware-as-a-service (RaaS) models that rely on affiliates for dissemination and profit-sharing, SafePay operates autonomously, with its core developers directly orchestrating intrusions and extortion campaigns. This self-contained approach…
-
Qilin Ransomware Sees Surge After Collapse of Dominant RansomHub RaaS
The ransomware landscape underwent significant disruption, marked by the abrupt cessation of operations from several prominent Ransomware-as-a-Service (RaaS) groups, including RansomHub, Babuk-Bjorka, FunkSec, BianLian, 8Base, Cactus, Hunters International, and LockBit. This wave of disappearances has fragmented the ecosystem, diminishing the dominance of major players and fostering a proliferation of smaller, independent actors. Global law enforcement…
-
LockBit Operators Use Stealthy DLL Sideloading to Mask Malicious App as Legitimate One
Operators of LockBit ransomware have improved their tactics, methods, and procedures (TTPs) to avoid detection and increase damage in the always changing world of cyberthreats. By exploiting DLL sideloading and masquerading, these attackers disguise malicious activities within legitimate system processes, enabling persistence and seamless integration into compromised environments. DLL sideloading tricks trusted applications into loading…
-
Authorities seize BlackSuit ransomware gang’s servers
German authorities said they have seized the servers used by the long-running ransomware gang, BlackSuit, which is blamed for cyberattacks across Europe and the U.S., including the City of Dallas. First seen on techcrunch.com Jump to article: techcrunch.com/2025/08/01/authorities-seize-blacksuit-ransomware-gangs-servers/
-
State of Ransomware 2025 von Sophos – Die Hälfte aller Unternehmen zahlt Lösegeld
First seen on security-insider.de Jump to article: www.security-insider.de/loesegeldzahlungen-cyberangriffen-weltweites-problem-a-2db4c102056043acbdc8f0f2638b8907/
-
Ransomware-Report Erpressungsversuche werden gezielter und Verhandlungen über Lösegeld aggressiver
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies, hat seinen Ransomware-Report für das zweite Quartal 2025 veröffentlicht. Höhepunkte des Berichts umfassen: Große Ransomware-as-a-Service-Gruppen (RaaS) brachen zusammen, wie Lockbit und Ransomhub, was zu einer Fragmentierung des kriminellen Ökosystems geführt hat, das aber nach wie vor sehr aktiv ist. Die Gruppierung um die Ransomware…
-
Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
The threat actor linked to the exploitation of the recently disclosed security flaws in Microsoft SharePoint Server is using a bespoke command-and-control (C2) framework called AK47 C2 (also spelled ak47c2) in its operations.The framework includes at least two different types of clients, HTTP-based and Domain Name System (DNS)-based, which have been dubbed AK47HTTP and AK47DNS,…
-
Check Point stellt seinen Ransomware Report Q2 2025 vor
Die neue Nummer 1 unter den Ransomware-Gruppen, Quilin, geht sogar so weit, dass sie ihren Kunden eine juristische Prüfung gestohlener Daten anbietet, um zu bewerten, welche Verstöße gegen Regularien und Gesetze durch den Datendiebstahl dem Opfer drohen, sowie die Vorbereitung einer Dokumentation über diese Vergehen, um sie Behörden vorlegen zu können, damit diese gegen das…
-
Microsoft-Sicherheitslücke in Deutschland weit verbreitet
Tags: bug, china, cyberattack, cybersecurity, germany, infrastructure, microsoft, ransomware, risk, software, update, usa, vulnerabilityDie Gefahr ist noch nicht gebannt: Experten verzeichnen weiter steigende Infektionszahlen.Deutsche Unternehmen, Behörden und Bildungseinrichtungen sind in Europa am stärksten von der schwerwiegenden Schwachstelle in der Sharepoint-Software von Microsoft betroffen. Nach einer Analyse des europäischen Cybersecurity-Unternehmens Eye Security wurden bislang weltweit 396 infizierte Server in 145 Organisationen identifiziert 42 davon betreffen demnach Unternehmen, die in…
-
Ransomware Payment Bans: Prevention Strategy or Misguided Policy?
It’s no secret that ransomware is on the rise, as this escalation is echoed across numerous industry reports. The Verizon 2025 Data Breach Investigations Report (DBIR), for instance, starkly illustrates this reality, revealing that ransomware (with or without encryption) was present in 44% of all breaches reviewed. This marks a substantial 37% increase from their…
-
As ransomware gangs threaten physical harm, ‘I am afraid of what’s next,’ ex-negotiator says
Tags: ransomwareCrims warned 40% of respondents that they and their families would suffer First seen on theregister.com Jump to article: www.theregister.com/2025/07/31/ransomware_physical_harm_threats/
-
Everest Ransomware Claims Mailchimp as New Victim in Relatively Small Breach
Everest ransomware claims Mailchimp breach, leaks 943,000 lines of data. While limited in size, it adds to a spike in global ransomware activity this July. First seen on hackread.com Jump to article: hackread.com/everest-ransomware-claims-mailchimp-small-breach/
-
DragonForce Ransom Cartel Profits Off Rivals’ Demise
The fall of RansomHub led to a major consolidation of the ransomware ecosystem last quarter, which was a boon for the DragonForce and Qilin gangs. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/dragonforce-ransom-cartel-profits-rivals-demise
-
SafePay Claims Ingram Micro Breach, Sets Ransom Deadline
The ransomware gang claims to have stolen 3.5TB of data, and told the technology distributor to pay up or suffer a data breach. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/safepay-ingram-micro-breach-ransom-deadline
-
Ingram Micro Partners ‘Concerned’ About Claimed SafePay Data Theft
Solution providers tell CRN they fear their own company’s or their customers’ data could be made public in the wake of reports that the Safepay ransomware organization has stolen 3.5 terabytes of Ingram Micro data. First seen on crn.com Jump to article: www.crn.com/news/security/2025/ingram-micro-partners-concerned-about-claimed-safepay-data-theft
-
The Booker Prize Longlist and Hacker Summer Camp
This week Bill connects the hype of literary awards to cybersecurity conference season. We highlight key insights from the Q2 2025 IR Trends report, including phishing trends, new ransomware strains, and top targeted sectors. Finally, check out all the places Talos will be at Black Hat. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/the-booker-prize-longlist-and-hacker-summer-camp/
-
Anubis Ransomware Targets Android and Windows Users to Encrypt Files and Steal Credentials
Ransomware activity has skyrocketed in the ever-evolving cyber threat landscape, with Bitsight’s State of the Underground 2025 study indicating a 53% increase in ransomware group-operated leak sites and a roughly 25% increase in unique victims reported on leak sites throughout 2024. Amid this escalation, the Anubis ransomware variant has emerged as a formidable player, first…
-
Ransomware Gangs Leverage TrickBot Malware to Steal US $724 Million in Cryptocurrency
Ransomware affiliates associated with groups like Ryuk, Conti, and Diavol have increasingly relied on the modular TrickBot malware to facilitate sophisticated extortion campaigns, resulting in over US$724 million in cryptocurrency theft. Originally emerging in 2016 as a banking Trojan, TrickBot has transformed into a versatile malware platform that supports initial access, credential theft, and lateral…
-
OnlyFans, Discord ClickFix-Themed Pages Spread Epsilon Red Ransomware
Tags: ransomwareBeware of Epsilon Red ransomware as attackers impersonate Discord, Twitch and OnlyFans using fake verification pages with .HTA files and ActiveX to spread malware. First seen on hackread.com Jump to article: hackread.com/onlyfans-discord-clickfix-pages-epsilon-red-ransomware/
-
Ransomware gangs capitalize on law enforcement takedowns of competitors
After authorities dismantled LockBit and RansomHub, other groups rushed in to snatch up their affiliates, according to a new report that highlights a cybercrime ecosystem in flux. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-groups-competition-check-point-report/756451/
-
Ingram Micro threatened with post-ransomware data leak
Group that attacked distributor indicate they have terabytes of data that was stolen from the channel player First seen on computerweekly.com Jump to article: www.computerweekly.com/microscope/news/366628299/Ingram-Micro-threatened-with-post-ransomware-data-leak
-
Ransomware up 179%, credential theft up 800%: 2025’s cyber onslaught intensifies
Exploits multiply as defenders play catch-up: Vulnerability disclosure rose by 246%, and publicly available exploits increased by 179%, with over 20000 vulnerabilities disclosed in the first half of 202535% of which already have exploit code.A backlog of 42000 vulnerabilities awaiting NVD analysis and delays in CVE enrichment leave organizations blind to many critical flaws, the…
-
Mehr Backup-Kontrolle mit integrierten Immutable- und Datenresilienz-Funktionen
Smarte Ransomware-Abwehr: Neue integrierte Unveränderbarkeit und Data-Resilience-Funktionen von Arcserve bieten mehr Backup-Kontrolle sowohl in der Cloud als auch onpremises. Arcserve-Unified-Data-Protection (UDP) 10.2 und die neuen Funktionen des Arcserve-Cyber-Resilient-Storage helfen Organisationen jeder Größe, die Kontrolle über unveränderbaren Backup-Speicher sowohl in der Cloud als auch vor Ort zu erlangen. Die Softwarelösungen bieten eine integrierte Kontrolle des Immutable…
-
Ransomware Attacks Escalate to Physical Threats Against Executives
Semperis found that executives were physically threatened in 40% of ransomware incidents, in a bid to pressure victims to pay demands First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-attacks-escalate/
-
Cyberkriminelle setzen Ingram Micro Ultimatum
Tags: attack, breach, cyberattack, data, group, intelligence, leak, lockbit, ransomware, service, technology, threatRansomware-Gangster erpressen Ingram Micro.Anfang Juli 2025 wurde bekannt, dass der IT-Dienstleister Ingram Micro von einer Ransomware-Attacke betroffen ist. Diese zog auch einen mehrtägigen Ausfall der IT-Systeme nach sich. Inzwischen laufen die Systeme zwar größtenteils wieder, trotzdem könnte der größte Schaden noch bevorstehen.Denn inzwischen hat sich die Ransomware-Bande Safepay zu dem Angriff bekannt und Ingram Micro…