All news with #ransomware tag

Inotiv Discloses August Ransomware Breach Affecting 9,542

🔒 Inotiv, an Indiana-based contract research organization, disclosed an August ransomware attack that disrupted operations after networks, databases, and internal applications were taken offline. The company says it has 'restored availability and access' to impacted systems and is notifying 9,542 individuals whose information was stolen. The incident, dated to approximately August 5–8, 2025, was claimed by the Qilin ransomware group, which published alleged samples and asserted it exfiltrated roughly 162,000 files totaling about 176 GB, though Inotiv has not confirmed the specific data types or publicly attributed the attack.

SpyCloud: Phishing Targets Corporate Users 3x More

🔍 SpyCloud reported a 400% year‑over‑year increase in successfully phished identities, finding nearly 40% of more than 28 million recaptured phish records contained business email addresses—about three times the rate observed in recaptured malware. The company warns phishing has become the preferred gateway into enterprise environments and is fueling follow‑on attacks such as ransomware. SpyCloud urges organizations to adopt real‑time visibility and automated post‑compromise remediation across both personal and professional identities.

Year-End Infosec Reflections and GenAI Impacts Review

🧭 William Largent’s year-end Threat Source newsletter combines career reflection with a practical security briefing, urging professionals to learn from mistakes while noting rapid changes in the threat landscape. He highlights a Cisco Talos analysis of how generative AI is already empowering attackers—especially in phishing, coding, evasion, and vulnerability discovery—while offering powerful advantages to defenders in detection and incident response. The newsletter recommends immediate, measured experimentation with GenAI tools, training teams to use them responsibly, and blending automation with human expertise to stay ahead of evolving risks.

ThreatsDay: Wi‑Fi Hack, npm Worm, DeFi Theft and More

🔒This week's ThreatsDay roundup highlights a string of high-impact incidents, from a $9 million DeFi drain and an npm-based self-replicating worm to airport Wi‑Fi evil‑twin attacks and mass camera compromises. Researchers and vendors including Fortinet, Microsoft, and TruffleHog disclosed evolving malware techniques, supply-chain abuse, and widespread credential exposure. Practical protections include minimizing long-lived secrets, enforcing CI/CD safeguards, updating detection for eBPF-based threats, and applying MFA and phishing-resistant controls.

Marquis data breach affects over 74 US banks, credit unions

🔒 Financial software provider Marquis Software Solutions disclosed a ransomware intrusion on August 14, 2025, after attackers breached a SonicWall firewall and exfiltrated certain files. The incident potentially impacted roughly 400,000 customers across 74 banks and credit unions and involved names, contact details, Social Security and Taxpayer IDs, account information (no security codes), and dates of birth. Marquis says there is no confirmed misuse or publication of the data to date and is notifying affected institutions and state regulators while implementing enhanced security measures, including MFA, patching, account cleanup, and tightened firewall policies.

Deep Dive: DragonForce Ransomware Cartel and Spider

🔍 DragonForce is a ransomware-as-a-service group that re-emerged in 2023 and has rebranded as a self-described "ransomware cartel," recruiting affiliates with generous revenue shares and customizable encryptors. Recent variants exploit vulnerable drivers like truesight.sys and rentdrv2.sys to disable security controls and shore up earlier encryption flaws. Its partnership with Scattered Spider combines elite social-engineering initial access with deployable ransomware, elevating risk to organizations globally.

UK Plans Ransomware Payment Ban With Security Exemptions

🔒 The UK government plans to ban ransomware payments for public sector and critical national infrastructure, while requiring other businesses to notify authorities if they intend to pay attackers. Announced after a public consultation and detailed in a September policy paper, the measure will include national security exemptions to avoid creating impossible choices for essential services. Security Minister Dan Jarvis said the move is a priority and that adoption will proceed when parliamentary time allows, with ongoing coordination across government and allied states.

University of Phoenix Discloses Data Breach After Oracle Hack

🔒The University of Phoenix disclosed a data breach tied to a zero-day flaw in Oracle E-Business Suite, saying it detected the incident on November 21 after the extortion group posted the university to its leak site. Phoenix Education Partners filed an SEC 8-K announcing the incident and an ongoing review. The university said attackers accessed names, contact details, dates of birth, Social Security numbers, and bank account and routing numbers for current and former students, employees, faculty and suppliers. Affected individuals will receive mailed notifications with next steps.

AI, Automation and Integration: Cyber Protection 2026

🔒 In 2025 threat actors increasingly used AI—deepfakes, automated scripts, and AI-generated lures—to scale ransomware, phishing, and data-exfiltration attacks, exposing gaps between siloed security and backup tools. Publicly disclosed ransomware victims rose sharply and phishing remained the dominant initial vector, overwhelming legacy protections. Organizations are moving to AI-driven automation and unified detection, response, and recovery platforms to shorten dwell time and streamline compliance.

Asahi Ransomware Attack Leads to Massive Data Breach

🔒 Asahi Group Holdings confirmed that a ransomware attack on 29 September, attributed to the Qilin group, resulted in a major data breach affecting over 1.5 million customers and roughly 275,000 employees and family members. The incident disrupted ordering, shipping and production systems across Japan and caused widespread product shortages. Asahi says it did not pay a ransom, has found no evidence the data has been posted publicly, and is strengthening its cybersecurity while notifying those impacted.

University of Pennsylvania Confirms Oracle EBS Data Theft

🔒 The University of Pennsylvania disclosed that attackers exploited a previously unknown Oracle E-Business Suite zero-day in August to obtain files containing personal information. In a notification filed with Maine's Attorney General, Penn said at least 1,488 individuals had data taken and warned the overall total may be larger. The university reported no evidence so far that the stolen information has been misused or published and has not publicly attributed the intrusion; the incident aligns with a broader campaign linked to the Clop ransomware group.

Vaillant CISO: From Technology to Strategic Cyber Leadership

🔒 Raphael Reiß, CISO at Vaillant Group, warns that rising geopolitical tensions and increasingly professional cybercriminals — now aided by AI — have lowered the barrier to complex attacks. Vaillant applies a holistic, multilayered security approach that spans IT, global production and customer-facing products, combining preventive and reactive controls. Reiß emphasises people-first awareness training and pragmatic compliance with standards such as NIS2, DORA and the Cyber Resilience Act. His advice is direct: analyse your starting point and start rather than wait.

Understanding Zero-Day Attacks: Risks and Defenses

🛡️ Zero-day attacks exploit software vulnerabilities that are unknown to the vendor, enabling attackers to compromise systems before patches are available. They target high-value platforms such as operating systems, web browsers, enterprise applications, and IoT devices, often using spear-phishing or zero-click techniques. Because signature-based tools frequently miss novel exploits, effective defense requires rapid patching, behavior-based detection (EDR, NDR, XDR), network segmentation, and investigative analysis of packet-level data to detect, contain, and learn from incidents.

Kaspersky Enhances Embedded Systems Security for 2025

🔒 Kaspersky has released a major update to Kaspersky Embedded Systems Security, targeting the unique risks of legacy and resource-constrained devices. The Windows edition introduces a behavioral analysis engine plus Automatic Exploit Prevention, Anti-Cryptor, a Remediation Engine, BadUSB protection, a firewall, and a security status indicator. The Linux edition adds certificate-based allowlisting and Web Threat Protection to simplify safe updates and guard web-enabled embedded devices. Planned Q1 2026 improvements include MDR integration, BadUSB for Linux, and ARM support.

Sha1-Hulud NPM Worm Returns, Broad Supply‑Chain Risk

🔐 A new wave of the self‑replicating npm worm, dubbed Sha1‑Hulud: The Second Coming, impacted over 800 packages and 27,000 GitHub repositories, targeting API keys, cloud credentials, and repo authentication data. The campaign backdoored packages, republished malicious installs, and created GitHub Actions workflows for command‑and‑control while dynamically installing Bun to evade Node.js defenses. GitGuardian reported hundreds of thousands of exposed secrets; PyPI was not affected.

Europol Takes Down Cryptomixer Bitcoin Mixing Service

🔒 Europol, working with Swiss and German authorities, has seized over €25m in Bitcoin and taken control of the Cryptomixer service following coordinated actions in Zurich between 24 and 28 November. Three servers, the cryptomixer.io domain and more than 12 terabytes of data were confiscated, and a seizure banner replaced the site after law enforcement shut down the hybrid mixing platform. Since its founding in 2016, Cryptomixer is believed to have processed more than €1.3bn in Bitcoin and was widely used to obfuscate proceeds from ransomware, drug and weapons trafficking, and payment card fraud.

Police Seize Cryptomixer and €24M in Bitcoin Servers

🔒 Law enforcement in Switzerland and Germany dismantled the Cryptomixer cryptocurrency-mixing service during Operation Olympia, seizing three servers, the cryptomixer.io domain, and about €24 million in Bitcoin. Europol and Eurojust supported the operation. Cryptomixer had been used to obfuscate proceeds from ransomware, drug and weapons trafficking, and payment card fraud by pooling and redistributing funds across many addresses, often taking a commission for the service.

Asahi Data Breach Exposes Personal Details of 1.9M

🔒Asahi Group Holdings confirmed a ransomware-driven data breach discovered in September that affected up to 1.9 million people. The company says personal information including names, genders, addresses, phone numbers and email addresses was exfiltrated, and the Qilin ransomware group claimed responsibility and published sample files. Production and shipping were suspended during the incident and system restoration is ongoing. Asahi reports no payment card data was exposed and has opened a dedicated contact line for affected individuals.

November 2025 security roundup: leaks, ransomware, policing

🔍 In his November roundup, ESET Chief Security Evangelist Tony Anscombe highlights major cybersecurity developments that warrant attention. He draws attention to Wiz's finding that API keys, tokens and other sensitive credentials were exposed in repositories at several leading AI companies, and to a joint advisory revealing the Akira ransomware group's estimated $244 million takings. Tony also flags privacy concerns around X's new location feature, outlines how Australia intends to enforce a proposed under‑16 social media ban, and notes a Europol/Eurojust operation that disrupted malware families including Rhadamanthys.

Seven Security Practices That Should Be Retired Now

🔒 This article identifies seven security practices that have become obsolete in modern, cloud-first and hybrid workplaces. Contributors including Amit Basu, George Gerchow and others warn against relying on perimeter defenses, legacy VPNs, SMS-based 2FA and on-premises SIEMs, and caution about overreliance on EDR or compliance-only programs. It recommends shifting to Zero Trust, SASE, continuous monitoring and active security awareness to close visibility gaps and reduce risk.