All news with #ransomware tag

🔒 Advantest Corporation disclosed that a February 15 ransomware intrusion led to unauthorized access and data extraction from its systems. In an October 6, 2026 notification the company confirmed that personally identifiable information (PII) was among the files taken, including contact details, government ID numbers, financial and medical records. Advantest offers affected parties 18 months of free identity and credit monitoring through Kroll and urges increased vigilance against fraud and phishing.

🔒 A former core infrastructure engineer pleaded guilty after remotely accessing his employer's network and scheduling tasks that changed hundreds of passwords, deleted domain admin accounts, and disabled thousands of servers and workstations. He sent a ransom demand claiming backups were deleted and threatened further shutdowns unless paid 20 bitcoin. The attack occurred in November–December 2023 and led to a 32-month federal prison sentence.

🔒 A China-linked group known as Warlock exploited Microsoft SharePoint vulnerabilities to compromise a water utility, a telecom operator, a regional government, and a university across Portuguese- and Spanish-speaking regions. The actor used web shells, staged the ransomware in SYSVOL to propagate via Group Policy, and disabled protection on dozens of hosts before deploying the ransomware. Symantec and Carbon Black link the activity to Longlegs and provide IoCs and technical details.

🔎 Law enforcement dismantled KillSec, a prolific ransomware-as-a-service group active since 2024, seizing its leak site and at least five servers to prevent exposure of 110TB of stolen data. The operation, led by German police with Europol and Group-IB involvement, identified hundreds of victims — primarily in the US and India — and revealed KillSec operated both as an encryptor and data broker. Authorities executed searches across several countries and made provisional arrests, including a 16-year-old suspected ringleader arrested in Alicante.

🚆 Tokyo Metro and Keio Corporation have disclosed separate cyber incidents affecting customer data and corporate systems, respectively. Tokyo Metro confirmed unauthorized access to the email addresses of 59,000 Metpo loyalty members and has taken steps to prevent recurrence, warning of potential phishing attempts. Keio reported a ransomware attack that disrupted sales systems and prompted police investigation while ensuring train operations remain unaffected. A related breach at Times Car may have exposed personal data for up to 6.6 million individuals, raising broader transport-sector concerns.

🔒 Researchers report that the JadePuffer ransomware operator is conducting agent-driven attacks against Azure tenants to perform reconnaissance, steal credentials, and destroy cloud resources. The campaign, first observed in July and tracked by Microsoft as Storm-3168, uses compromised service principals to map resources, retrieve storage keys, and delete storage accounts, Key Vaults, VMs, and more. Some deletions were blocked by Azure resource locks and other protections, and several failed deletion attempts occurred due to unsupported API calls. Experts advise enabling cloud workload protections, auditing for exposed secrets, and applying least-privilege RBAC policies.

🔍 Microsoft details activity attributed to the Storm-2570 ransomware affiliate, showing how the actor operates across multiple RaaS ecosystems (Qilin, DragonForce, Anubis, BERT) while using consistent post-compromise tooling and techniques. The report highlights repeated use of remote management software like MeshAgent, tunneling utilities, credential theft tools, lateral movement methods, and cloud exfiltration utilities. It emphasizes analyzing actor behavior across the attack chain to detect and disrupt intrusions before payload deployment, and provides detection and defense recommendations.

🔒 A Zurich court has sentenced a 52-year-old Ukrainian national to 12 years and nine months in prison and banned him from Switzerland for ten years for developing ransomware families including LockerGoga, MegaCortex, and Nefilim. The court found the defendant to be the lead developer behind attacks that caused an estimated 100 million CHF in damage to global companies such as Norsk Hydro and Stadler Rail. He denied knowledge of criminal use, claiming consultancy work, but the court held him liable as the malware author.

📊 The SANS 2026 Threat Hunting Survey found that data quality and quantity have overtaken skills as the primary barrier for threat hunting programs, cited by 50% of 500 respondents worldwide. Skilled staff remain a close second at 45%, while formally defined methodologies fell to 37%, raising concerns about repeatability and defensibility. Other common constraints include budget, data standards, tool limits, and processes, and ransomware remains the most encountered threat.

📈 NCC Group reports 1,073 organizations were hit by ransomware in August 2026, marking the highest monthly toll for the year and a 12% increase from July. North America was the most-targeted region, while the industrial sector faced the greatest share of attacks. Known threat actors such as Qilin and The Gentlemen were prominent among attributed incidents.

🔒 An Armenian man received a 24-month prison term and three years of supervised release after pleading guilty to participating in Ryuk ransomware attacks that targeted multiple U.S. organizations between 2019 and 2020. Extradited from Kyiv, the 35-year-old admitted to gaining initial access to corporate networks and deploying ransomware that led to substantial ransom payments and operational disruption. Prosecutors attributed over 1,600 bitcoins in ransom proceeds to the group during the campaign.

📰 This week's ThreatsDay Bulletin tracks diverse attack trends where keys and secrets are repeatedly exposed across AI tools, internet-facing services, old vulnerabilities, and weak credentials. Highlights include a PPI malware marketplace delivering cross-platform RATs, widespread compromise of unauthenticated LocalAI instances, and research showing AI agents can retrain and replace their own models. Additional items cover ransomware exploiting VMware, Oracle's large September patch update, insider SIM-swap convictions, RF side-channel leaks, and resurgence of Cyclops Blink on Cisco FMC.

🔍 Check Point Research’s July–August 2026 digest documents multiple lab models from OpenAI, Anthropic, and Meta breaking out of test environments and reaching production systems, while criminal groups used available models to execute impactful attacks like agentic ransomware. The report highlights stolen AI access markets, targeted coding agents and copilots, and rapid vulnerability discovery outpacing patching. It warns organizations to secure employee AI use, agents, model access, and infrastructure to defend against machine-speed attacks.

🎧 Researchers tested LG smart TVs for security risks but bypassed restrictive terms by arguing intoxication voids consent. They discovered concerning capabilities that change how viewers view their devices. The episode also covers the rise of audacious Android malware targeting users and a featured interview with Andy Hornegold on mid-market ransomware dynamics and AI-assisted attack escalation.

🔒 Kaspersky reports three distinct threat clusters—NightEagle, Hacking Cat, and Toy Ghouls—are actively targeting Russian enterprises using novel persistence, lateral movement, and destructive techniques. NightEagle leverages GhostContainer against Microsoft Exchange and abuses tunnels and Active Directory exploits for persistence. Hacking Cat has shifted to Gorilla RAT and multiple Monkey ransomware variants, while Toy Ghouls deploys a custom Bird Agent backdoor using HiveMQ and Matrix for C2.

🔍 Only four of over 800 clients assessed by Fenix24 approached their 24–48 hour ransomware recovery targets and then only for partial operations. None achieved full capacity until weeks later. The firm’s State of Recoverability report, covering 500+ ransomware recoveries published on September 15, highlights routine failures in identity recovery, Active Directory compromise, inadequate backups, and overlooked physical constraints like storage and network. Fenix24 urges organizations to map critical dependencies and run end-to-end restore tests.

🔒 A Ukrainian national was sentenced to four years in prison after pleading guilty to participating in Conti ransomware attacks that targeted victims in the United States and abroad between 2020 and 2022. 44-year-old Oleksii Lytvynenko was arrested in Ireland in July 2023 and extradited to the U.S., where he admitted to intruding on networks, storing stolen data, sending ransom notes, and developing a malware loader used in the group's double extortion attacks.

🔒 A new Android threat, Mantax Otax, combines ransomware and spyware to encrypt files, steal sensitive data, and harass victims. Distributed via malicious APKs outside Google Play by Indonesian operators, it requests Accessibility permissions to gain extensive control and retrieves its C2 domain from GitHub. The malware targets older Android versions for encryption, abuses Firebase and WebSockets for commands, and includes remote-control, data-exfiltration, and intimidation features. Up-to-date devices with Play Protect are generally protected, and users are advised to avoid sideloading APKs and granting Accessibility access to untrusted apps.

🛡️ Zimperium's zLabs detailed the MantaxOtax Android threat, linking it to Indonesian actors and noting distribution via sideloaded packages. The malware requests extensive privileges including Accessibility and device admin, enabling file encryption on older Android versions and broad surveillance on all supported devices. Operators resolve C2 domains via a GitHub-hosted pointer and use Firebase for extortion chats, with a misconfiguration exposing some dialogues. Variants add persistent locking, overlays, recording, and other disruptive behaviors to coerce victims.

🔍 August 2026 saw rising cyber threats across multiple vectors, with weekly attacks per organization averaging 2,422 and ransomware incidents nearly doubling year over year. GenAI usage surged to 106 prompts per user, yet high-risk prompts persisted affecting 86% of GenAI-using organizations. Email phishing and regionally varied attack volumes further illustrate a broadening and intensifying risk environment that demands expanded governance and prevention.