Tag: ransomware
1069 articles
Ransomware gangs exploit Windows Task Host flaw
Ransomware gangs are exploiting a high-severity flaw in Windows Task Host, a core component that could allow them to escalate privileges and wreak havoc on your system. This vulnerability, already patched by Microsoft, poses significant risks to users, especially those with basic user permissions.
BlackFile Targets Financial Firms in Ongoing Extortion Campaign
Financial firms are under attack by a relentless extortion group called BlackFile, which has been targeting the sector with alarming persistence since the start of the year. This threat actor has also set its sights on other industries, including med tech, with no signs of slowing down.
Azure Breach Exposes Millions of Employee Records at Top Firms
A threat actor known as TheHatman is peddling a staggering 1.7 million employee records from McDonald's, along with millions more from other top firms, allegedly stolen from Microsoft Azure environments. The breach, which Hudson Rock deems highly authentic, has left giants like Vodafone, Tata Consultancy Services, and IHG Hotels & Resorts vulnerable.
China-nexus APT Exploits VMware Flaw to Deploy Ransomware
A China-linked APT group has been exploiting a recently patched VMware vCenter vulnerability to deploy ransomware in a widespread campaign that hit 361 victims across 47 countries. The attackers used the flaw to gain root access and, in some cases, installed a Babuk-derived ransomware that locks files with a ".babyk" extension.
US Authorizes Private Firms for Cyber Counterattacks
The US has taken a bold step in cyberspace, launching a program that empowers select private companies to launch targeted counterattacks against ransomware gangs and other cybercrime syndicates. This innovative approach aims to disrupt and dismantle these threats, with the government maintaining control and ensuring accountability every step of the way.
Akira Ransomware Actors Exploit Safe Mode to Evade EDR Protections
Cyber attackers have found a sneaky way to bypass EDR protections by exploiting Safe Mode, leaving security systems blind to their malicious activities. In one recent incident, an exposed SonicWall VPN with no multi-factor authentication was all it took for hackers to gain entry and start wreaking havoc.
Uber Freight Probes Data Breach Claims by Helix Hacking Group
Uber Freight is investigating claims that a hacking group called Helix has stolen nearly 1 million files from the company, posting them online as evidence. The breach has sparked an urgent probe into unauthorized access to Uber Freight's systems and data repositories.
Microsoft's Shared Responsibility Model Exposes SaaS Backup Gaps
Many organizations mistakenly assume Microsoft handles data restoration, but the reality is their Shared Responsibility Model leaves SaaS backup gaps that can expose customers to data loss and ransomware attacks. Native recovery tools only address short-term data issues, not long-term cyber resilience.
Gunra Ransomware Targets Infrastructure via Fortinet Flaws
Gunra Ransomware is exploiting critical Fortinet flaws, including CVE-2024-55591, to gain super-admin privileges and infiltrate government and critical infrastructure networks. This alarming vulnerability allows remote attackers to craft requests and bypass authentication, putting sensitive systems at risk.
DeadLock Ransomware Leverages Blockchain to Evade Takedown
DeadLock Ransomware is taking a disturbingly clever approach to evade shutdown by leveraging the Polygon blockchain to conceal its operational addresses, making it a formidable foe for cybersecurity efforts. By cleverly using decentralized building blocks, the group has already amassed a shocking 80 victims, mostly in Europe.
DeadLock Ransomware Exploits Polygon Smart Contracts
DeadLock Ransomware takes a sophisticated approach by leveraging the Session messaging network and blockchain-backed services to streamline its extortion process, making it harder for victims to recover. Its operators use a clever combination of decentralized chat and a self-contained HTML app to communicate with victims and demand payment in Bitcoin or Monero.
Ransomware gangs exploit Microsoft SharePoint flaw
Ransomware gangs are actively exploiting a high-severity Microsoft SharePoint flaw, known as CVE-2026-45659, that allows them to execute arbitrary code on unpatched servers, and it's crucial to patch up ASAP to avoid falling victim. Microsoft has already released security updates for affected SharePoint versions, so make sure to get those installed pronto!
US Local Governments Targeted in Wave of Cyber Attacks
Local governments are under siege, with a growing wave of cyber attacks crippling their operations - just like Suisun City, which was forced to declare a state of emergency after a malicious software attack shut down its entire IT network. The attacks are leaving communities vulnerable, with city services and internal operations grinding to a halt.
Gunra Ransomware Targets Infrastructure with Fortinet, Schneider Electric Exploits
Gunra ransomware is on the loose, exploiting vulnerabilities in critical infrastructure from Fortinet and Schneider Electric to wreak havoc on organizations worldwide. This malicious campaign uses double-extortion tactics, combining data theft with file encryption to maximize damage.
US, South Korea Warn of Gunra Ransomware Gang's Global Reach
US and South Korean authorities are sounding the alarm on the global threat of the Gunra Ransomware Gang, warning that this malicious group has evolved into a sophisticated ransomware-as-a-service operation. The joint advisory aims to alert network defenders to the gang's growing reach and devastating impact on organizations worldwide.
Ransomware Attacks Surge as Qilin Targets Vulnerabilities
Malicious activity is on the rise, with nearly 400 million attacks blocked by Kaspersky products in Q2 2026 alone, showcasing a surge in large-scale web exploitation and targeted ransomware operations. This alarming trend highlights the need for robust online protection.
Ransomware gangs exploit SonicWall SMA1000 flaws
Ransomware gangs are actively exploiting two recently patched flaws in SonicWall's SMA1000 remote-access gateway, which can let attackers hijack vulnerable servers and send requests on their behalf. The vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, were patched in mid-July, but threat actors are now using them in real-world attacks.
Ransomware Gangs Target Mid-Level Managers to Accelerate Payments
Ransomware gangs are now taking a sniper approach, targeting mid-level managers with precision to get payments faster. This new tactic is a far cry from the scattergun methods of the past, with one recent campaign hitting 351 victims across 334 organizations in just a month.
Ransomware Attacks Surge 20% as New Gangs Target Finance, Healthcare
Ransomware attacks are on the rise, surging 20% in July with a staggering 799 incidents reported, with finance, healthcare, and tech industries becoming prime targets for new gangs. The alarming increase marks the second-busiest month of the year so far, with the US leading the list of targeted countries.
Google Exposes Redact Extortion Group's Ties to BlackFile Rebrand
Google's Threat Intelligence Group uncovered a clever rebranding scheme by the notorious extortion group formerly known as BlackFile, which has now resurfaced under the name Redact, after allegedly being hijacked by a rogue affiliate. The group had claimed retirement, but clearly wasn't done causing trouble, raking in around $10.69 million in Bitcoin transactions.
Ransom Cartel creator gets 16 years for cybercrime scheme
A 40-year-old Belarusian cybercriminal has been sentenced to 16 years in prison for masterminding a massive ransomware scheme that targeted at least 18 companies and attempted to extort a staggering $5.2 million. The defendant, who pleaded guilty to conspiracy and identity theft charges, was a longtime fixture on Russian-speaking cybercrime forums before his arrest and extradition.
Canadian Hacker Pleads Guilty in Snowflake Extortion Scheme
A Canadian hacker has pleaded guilty to masterminding a massive extortion scheme targeting Snowflake customers, compromising at least 165 accounts and swiping billions of sensitive records in a brazen heist that raked in over $2.5m in ransom payments. Connor Riley Moucka, 26, faces up to 32 years in prison for his role in the 2024 cyber attacks.
Ransomware Kingpin Silnikau Gets 16 Years in Prison
In a major win for cybersecurity, Maksim Silnikau, the mastermind behind the notorious Ransom Cartel ransomware operation, has been sentenced to 16 years in prison for his role in wreaking havoc on victims worldwide. The Belarusian national was brought to justice through a collaborative effort between US and Polish authorities.
Snowflake Breaches Expose 100 Million People as Hacker Pleads Guilty
A massive data breach at Snowflake has left a staggering 100 million people vulnerable, after hackers exploited stolen credentials to access sensitive records at over 165 organizations. The mastermind behind the breach, Connor Riley Moucka, has pleaded guilty to multiple charges, including computer fraud and identity theft.