ransomware47 articles
Gentlemen Ransomware Gang Takes Credit for Nutex Health Breach
Nutex Health has confirmed a data breach in which hackers stole patient, employee, financial, and business information, with the company notifying the SEC and facing a class-action lawsuit in Texas. The Gentlemen ransomware group (also known as Storm-2697) has claimed responsibility, threatening to leak the stolen data within nine days if their demands are not met. The group, which operates as a ransomware-as-a-service and has claimed over 580 victims across 75 countries since emerging in mid-2025, employs double extortion tactics by both encrypting and exfiltrating victim data.
Berlin Tells Rhysida to Get Lost After 5.7TB Data Heist
Berlin has refused to pay a ransom demanded by the Rhysida ransomware group, which hacked into the city's network between August 7–12 and stole over 5.7 terabytes of data. The stolen data reportedly includes personal information of over 12,000 people, financial documents, passwords, payroll information, and other sensitive files. Rhysida has demanded 30 bitcoin (approximately $2.3 million), but Berlin's governing mayor and interior senator have confirmed the city will not comply.
Boston Scientific Hit by Cyberattack, Global Operations in Chaos
Boston Scientific, a major US medical technology company, suffered a cyberattack on August 25 that disrupted global operations, including the ability to process and ship customer orders. The company has disclosed the incident in an SEC filing but cannot yet determine the full scope of operational and financial impacts. It remains unclear whether a data breach occurred or which threat actor is responsible.
ATF Got Hit by Qilin Ransomware. The Reassurances Are Already Flowing.
The ATF has confirmed a cybersecurity incident after the Qilin ransomware group claimed to have attacked the agency, though the breach was limited to a standalone system that was quickly disconnected and did not affect the ATF's broader network or operations. The Department of Justice has designated the event a "major incident" and an investigation is underway. Qilin, a double-extortion ransomware group active since at least 2022 with over 2,000 listed victims, has not yet specified what data was stolen or when it may be leaked.
Berlin Won't Pay Up After Hackers Swipe 5.79TB From City Network
Berlin's state government has confirmed it is the victim of an extortion attempt following a cyberattack in August 2026 that compromised its administrative network and resulted in the exfiltration of data, reportedly 5.79 terabytes according to the attackers. The city has refused to pay the ransom, with Governing Mayor Kai Wegner stating plainly that "the state of Berlin is being blackmailed," while law enforcement and federal security authorities investigate the incident. The ransomware group Rhysida has been named as the likely perpetrator, with officials stating that election infrastructure and sensitive data appear not to have been compromised.
Qilin Ransomware Gang Claims ATF Scalp as Feds Confirm 'Major' Breach
The US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is responding to a "major" cybersecurity incident after the Russia-linked Qilin ransomware gang claimed responsibility, posting the agency on its leak site. ATF states that the breach was limited to a standalone computer system containing investigation target information, with no impact on its broader network or operations. The Department of Justice has designated the compromise a "major incident," and an investigation is ongoing, with ATF declining to provide further details.
Weekly Roundup: Zombie Cards, Salt Typhoon Scissors, and GitHub's AI Blame Deflection
This week's cybersecurity roundup covers a range of notable incidents and developments, including CISA mandating fixes for an actively exploited Ray vulnerability, T-Mobile physically cutting a router cable to halt a Chinese state-sponsored intrusion, and researchers demonstrating a "Zombie Card" attack that enables contactless payments using expired Visa cards. Other highlights include a critical GitHub Actions vulnerability discovered by an AI agent (though the flawed code itself was human-written), Medusa ransomware affiliates exploiting GoAnywhere and BeyondTrust vulnerabilities across 500+ critical infrastructure organizations, and data breaches affecting Alation and Japan's Sakura Internet. Rounding out the week, Canadian firm Crypto4A achieved a landmark FIPS 140-3 Level 3 certification for post-quantum cryptography hardware.
LockBit Claims US Bank Scalp With September Leak Deadline
US Bank is investigating claims by ransomware group LockBit that it breached the bank and stole data, with a threat to leak the information on September 3 unless an undisclosed ransom is paid. The bank states there is currently no indication its internal systems were compromised or that unauthorized access occurred. LockBit, which re-emerged in 2025 with a new ransomware variant after a law enforcement takedown in 2024, has a history of retaining victim data even after ransoms are paid.
Cl0p Names 40+ Windchill Victims — Shell, Philips, Fiserv Among Those Called Out
The Cl0p ransomware group has named over 40 organizations as victims of a campaign exploiting CVE-2026-12569, a critical vulnerability in PTC's Windchill PLM platform that allows unauthenticated remote code execution. Attackers deployed web shells to steal data — including databases, engineering documents, and blueprints — ranging from 1 GB to several terabytes per victim, with high-profile targets including Shell, Philips, Fiserv, and Zebra Technologies. Several named companies have acknowledged the claims and launched investigations, though none has confirmed a significant breach, and GE was notably removed from Cl0p's victim list, possibly indicating ransom negotiations.
Nearly 2,000 Hacked WordPress Sites Are Powering a Surprisingly Sophisticated Criminal Operation
A large-scale cybercrime operation called **StopAndProtect** has compromised nearly 2,000 outdated WordPress websites, using them as infrastructure to distribute malware, issue attacker commands, and store stolen data from victims. The campaign begins with fake ClickFix CAPTCHA prompts that trick users into running malicious PowerShell commands, deploying a toolkit that includes ransomware, a credential stealer, a screen locker, a worm, and a chat utility for communicating with victims. As of late July 2026, over 6,000 unique IP addresses have been compromised, with researchers urging users to be wary of unexpected CAPTCHA prompts that instruct them to run commands outside the browser.
Meet Ransom Busters: The Ransomware Affiliate Posing as Your Rescuer While Charging $60K for the Privilege
A ransomware affiliate known as **Ransom Busters** is targeting victim organizations with unsolicited emails, claiming to have hacked ransomware groups' servers and offering to delete stolen data in exchange for fees of $20,000–$60,000. Cybersecurity firm GuidePoint found strong technical evidence — including shared tools, identical passwords, and the same attacker hostname across multiple incidents — suggesting the group is itself a ransomware affiliate rather than any legitimate third party, essentially running a secondary extortion scheme against victims already attacked by groups like DragonForce. Experts warn that paying such actors provides no guarantee data will be deleted and should be treated as a scam. The article also highlights the **broader ransomware landscape**, which is growing more fragmented and sophisticated, with 93 active groups recorded in Q2 2026, 2,139 organizations listed on data leak sites, and average ransom payments surging 176% to nearly $1.9 million — driven largely by data exfiltration-focused extortion rather than traditional encryption attacks.
ShinyHunters Turns Up the Heat on Ernst & Young After Tax Data Breach
Ernst & Young (EY) suffered a data breach between March 28 and April 12, in which hackers stole sensitive client information — including Social Security numbers, account numbers, and tax-related documents — from a third-party service management platform. The notorious extortion group ShinyHunters has since claimed responsibility, adding EY to its leak site and threatening to release the stolen data if the firm does not make contact by July 31. EY has not disclosed the number of affected individuals or confirmed the attacker's identity, but is offering impacted clients 24 months of free credit monitoring and identity protection services.
Madera Community Hospital Took a Year to Tell 150,000 People Their Data Was Stolen
Madera Community Hospital in California has notified over 150,000 individuals that their personal, financial, and medical information was compromised in a cyberattack that occurred in May 2025. Hackers accessed the hospital's network for two days and likely exfiltrated files containing sensitive data, including Social Security numbers, health insurance details, and biometric information, though the hospital found no evidence the data was publicly released. The extortion group behind the attack ultimately withdrew its ransom demand, claiming it did not want to harm patients.
Ransomware Surges While Everyone's Busy Watching the AI Show
Ransomware attacks surged nearly 20% in July 2024, reaching 799 incidents — the second-highest monthly total of the year — with finance, tech, pharmaceutical, and education sectors seeing the sharpest increases. The US was the most targeted country, accounting for 322 of the attacks, while two gangs — The Gentlemen and Qilin — together claimed responsibility for roughly a third of all incidents. Notably, attacks on utilities, legal firms, and government agencies actually declined during the same period.
Ransomware Crews Have Done Their Homework: It's the IT Manager They Want
Ransomware attackers are increasingly targeting mid-level managers — particularly those in their mid-40s working in finance, HR, sales, or operations — rather than executives, because these employees hold "business privilege" that gives them influence over payment decisions and access to sensitive data. Research by Zscaler tracking 351 victims found that attackers conduct detailed reconnaissance to map organisational structures and identify the people most likely to accelerate a ransom payment. More broadly, the ransomware landscape is intensifying, with blocked attempts up 146%, public extortion cases up 70%, and stolen data volumes up 92% over the past year.
Ransom Cartel Kingpin Gets 16 Years While Half His Crew Remains at Large
Maksim Silnikau, a 40-year-old Belarusian national, was sentenced to 16 years in prison for creating and operating Ransom Cartel, a ransomware-as-a-service operation that targeted at least 18 companies between 2021 and 2023. He built the criminal enterprise by providing locking software, stolen credentials, and an affiliate management system, routing ransom payments through cryptocurrency mixers. A separate federal case in New Jersey related to the Angler Exploit Kit malvertising scheme remains unresolved, with two co-defendants still at large.
River Bank Paid Ransomware Crew to Delete Stolen Data. Trust Them on That.
River Bank & Trust suffered a ransomware attack on June 16, in which hackers accessed portions of its network and exfiltrated data, prompting the company to take affected systems offline and disable compromised accounts. The bank engaged with the threat actors and obtained representations that the stolen data had been deleted, likely following a ransom payment. The investigation is ongoing, and River has yet to determine whether personal information was stolen or whether the incident will materially impact its business.
ExfilSquad Claims Police Database Scalp as UK Public Sector Breach Spree Continues
The Police National Legal Database (PNLD) has confirmed a data breach in which cybercriminals stole names, organisations, and work email addresses belonging to police officers, criminal justice staff, government partners, and customers, with no evidence that passwords were compromised. The breach is linked to an extortion group called "ExfilSquad," which claims to have stolen a 1.9 GB dataset containing around 135,000 law enforcement contact records, and also claimed responsibility for a recent breach of the UK Department for Education affecting over 607,000 records. Key details — including how attackers gained access, the exact number of victims, and whether a ransom was demanded — have not yet been disclosed.
American Bank Trusts Ransomware Gang's Pinky Promise to Delete Stolen Data
A US bank used the unusual term "removed" in its data breach disclosure, rather than the more common terms like "stolen," "copied," or "accessed." The wording implies the bank may be suggesting the ransomware group actually deleted the data rather than retaining it — essentially trusting the criminals' promise to dispose of it. The article highlights how the language used in breach disclosures is often carefully chosen, ranging from vague to misleading, to downplay the true nature of what occurred.
ShareFile Shutdown Orders, Citrix Bleed 2 Ransomware, and AI Coding Assistants You Can't Trust
This weekly cybersecurity recap highlights a recurring theme: attackers are exploiting the same ordinary vulnerabilities faster than defenders can patch them, using the same AI-powered tools now available to security teams. Key incidents include Progress urging ShareFile customers to shut down Storage Zone Controllers due to an unspecified external threat, active exploitation of Citrix Bleed 2 to deploy DragonForce ransomware, a compromised Jscrambler npm package stealing developer credentials, and a new attack technique called HalluSquatting that tricks AI coding assistants into installing malicious code. The recap also covers a broad range of trending CVEs, new malware families, and emerging threat groups, underscoring that the gap between patch availability and active exploitation continues to narrow.
Stadler Rail Tells Ransomware Gang to Take a Hike on a CHF 10 Million Demand
Swiss rail manufacturer Stadler Rail refused a CHF 10 million ransom demand from the Everest ransomware gang after attackers accessed technical data from a supplier via a shared data exchange platform using compromised credentials. The company stated that no personal or security-relevant data was affected and that its own IT systems remained fully intact. Unusually, Stadler has not appeared on Everest's data leak site despite refusing to pay, which departs from the typical ransomware extortion playbook.
Paying Ransomware Criminals Doesn't Make Them Go Away. Surprise.
New data from Proofpoint reveals that paying ransomware demands offers no guarantee of safety, with 22% of UK organisations that paid being extorted a second time. Globally, 54% of victim organisations paid ransoms, yet 2% never recovered their files at all, and law enforcement takedowns like Operation Cronos confirmed that criminals routinely retain victim data even after receiving payment. AI is increasingly being used to enhance the phishing and credential-harvesting attacks that precede ransomware, though experts stress that building organisational cyber-resilience remains a far more effective strategy than paying attackers.
Anubis Ransomware Gang Claims Fairlife Hit, Gives Coca-Cola One Week to Pay
The Anubis ransomware group has claimed responsibility for a cyberattack on Fairlife, a Coca-Cola subsidiary, which disrupted production and resulted in the theft of approximately 1 TB of confidential data. The group is threatening to leak the stolen data unless a ransom is paid within one week. Active since December 2024, Anubis employs a double-extortion model and has targeted roughly 100 organisations, and is also notable for a "wiper mode" feature that can permanently delete victims' files.
Estée Lauder Confirms Employee Data Stolen in Oracle EBS Zero-Day Attack
Estée Lauder has begun notifying employees that their personal data was stolen from its Oracle E-Business Suite (EBS) system in August 2025, when the Cl0p cybercrime group exploited a zero-day vulnerability (CVE-2025-61882) enabling unauthenticated remote code execution. The compromised data includes sensitive information such as Social Security numbers, passport numbers, bank account details, health information, and payroll data. The company is offering affected individuals 24 months of free identity monitoring and has notified law enforcement, though it has not disclosed how many people were impacted.
Ransomware Knocks Fairlife's US Dairy Plants Offline
Coca-Cola's dairy subsidiary Fairlife has been hit by a ransomware attack that forced a temporary halt to production at its US plants, while its Canadian facilities remain operational. The attack compromised a portion of Fairlife's systems, including production-related systems, prompting the company to activate its incident response plan, engage cybersecurity experts, and notify law enforcement. Key details remain unclear, including who carried out the attack, whether data was stolen, and when US production is expected to resume.
Roundup: Iranian Spooks Track US Troops Via Ad Data, macOS Malware Plays Dead, and a Textile Firm Goes Bust After Six Weeks of Ransomware Hell
This SecurityWeek roundup covers a broad range of cybersecurity developments, including a German manufacturer filing for bankruptcy after a six-week production shutdown caused by a cyberattack, and Iranian threat actors exploiting advertising and cellular roaming data to track US military personnel's smartphones. Other highlights include the discovery of CrashStealer, a new macOS information-stealing malware that disguises itself as a legitimate crash reporter, and a joint CISA guide providing organisations with a framework for establishing Coordinated Vulnerability Disclosure programs. Additional stories touch on supply chain breaches affecting Lidl customers, ransomware targeting an Asian IT firm, and a cybercrime group claiming to have stolen over 1TB of data from naval defence manufacturer Thyssenkrupp Marine Systems.
Armenia Locks Up Russian Tourist Named Aleksandr Ermakov. Problem: There Are Two of Them.
Armenia has detained a Russian tourist, Aleksandr Yuryevich Ermakov, at Yerevan's airport on a US extradition request targeting a REvil ransomware suspect of the same name, but his lawyers argue Washington has the wrong man. The US and allied governments actually want Aleksandr Gennadievich Ermakov, a sanctioned cybercriminal linked to the hack of Australian health insurer Medibank and convicted in Russia for co-writing the SugarLocker ransomware, who is currently serving a sentence barring him from leaving Russia. The mix-up may stem from the US warrant omitting the patronymic that distinguishes the two men, with the detained man's lawyers noting that no fingerprints or full passport data have been produced to confirm his identity.
Ransomware Knocks Out Fairlife Milk Production Across the US
Coca-Cola has suspended US production at its dairy subsidiary Fairlife following a ransomware attack that compromised portions of the company's systems, including production-related infrastructure. The company has activated incident response protocols, notified law enforcement, and is working with cybersecurity experts to assess the full impact, though it states that product quality and safety have not been affected. Key details such as the attackers' identity, how the breach occurred, and whether any ransom demands have been made remain undisclosed.
Nichirei Cyberattack Leaves Japan's Frozen Food Chain on Ice
Japanese frozen food giant Nichirei was hit by a cyberattack on July 13, forcing it to disconnect its systems and disrupting operations at its refrigerated warehouses and shipping divisions, with knock-on effects for restaurants, retailers, and delivery services. The company confirmed that hackers targeted its servers and that some affected systems contained personal information, prompting an initial report to Japan's Personal Information Protection Commission over a potential data leak. Nichirei announced it would begin gradually restoring operations but has withheld details of the attack, leaving it unclear whether a ransomware group was involved.
Citrix Bleed 2, Rogue Drivers, and Poisoned Packages: Ransomware Groups Are Getting Creative
Ransomware groups including Anubis, The Gentlemen, and the VECT/TeamPCP alliance are employing increasingly sophisticated tactics, such as exploiting the critical Citrix Bleed 2 vulnerability (CVE-2025-5777), using legitimate remote management tools to blend in with normal IT activity, and leveraging a BYOVD zero-day to disable enterprise security solutions. The VECT/TeamPCP partnership represents a notable evolution in the threat landscape, combining supply chain credential theft with ransomware deployment at scale, though implementation flaws in VECT's encryptor have undermined its effectiveness. The FBI has issued a flash alert warning that credentials and data stolen in these campaigns pose a persistent long-term risk, as affiliated actors are likely to continue weaponizing them well after the initial breach.
ShinyHunters Breach Exposes Data of 3.8 Million Medtronic Patients
Medical technology company Medtronic suffered a data breach in April 2026 when the extortion group ShinyHunters accessed its corporate IT systems, compromising the personal and medical information of over 3.8 million individuals. Stolen data included names, contact details, dates of birth, Social Security numbers, and health-related information, though Medtronic states there is no evidence the data was publicly exposed. The company is offering affected individuals 24 months of free credit monitoring and identity theft protection services, and has implemented additional cybersecurity safeguards.
AI Agent Runs Ransomware Attack Start to Finish, No Human Required
Sysdig researchers have documented what they claim is the first fully automated, LLM-driven ransomware attack, carried out by a threat actor dubbed JadePuffer. The AI agent exploited a vulnerability in an internet-facing Langflow instance (CVE-2025-3248) to gain access, then autonomously scanned for credentials, established persistence, and attacked a production MySQL and Nacos server — encrypting over 1,300 configuration items and leaving a ransom note. Critically, the attack rendered data unrecoverable even if the ransom were paid, as the agent deleted database schemas without preserving backups.
Small US County Paid $1 Million to Make Stolen Data Go Away. It Might Not Have.
A US county government, reportedly Union County, Ohio, paid a $1 million Bitcoin ransom to the Kairos cyber extortion group following a May 2025 brute-force attack in which over 2 terabytes of data were stolen. Negotiations began at $100,000 and ended at $1 million after the attackers imposed a hard deadline, with the group originally demanding $3 million. The breach ultimately affected over 45,000 individuals whose sensitive personal, financial, and medical information was compromised, though no file-encrypting ransomware was involved and there is no independent verification that the stolen data was actually deleted.
Botnets in Your Living Room, Ransomware in Your Browser, and AI That Follows the Wrong Orders: This Week in Security
This week's cybersecurity recap highlights how attackers exploited ordinary, trusted systems rather than sophisticated vulnerabilities. Key incidents included Google and the FBI disrupting the NetNut residential proxy botnet (comprising at least 2 million devices), a fake GitHub PoC repository delivering the ChocoPoC RAT via a malicious dependency, and AI-generated browser ransomware leveraging Chromium's File System Access API. Additional notable stories covered WhatsApp username impersonation concerns, a Scattered Spider suspect extradited to the US, and multiple phishing-as-a-service toolkits emerging in the wild. The overarching theme was misplaced trust — in home devices, clean-looking code, identity reset flows, and browser permissions — underscoring that attackers need little more than a familiar, overlooked entry point.
Medtronic Tells Patients Their Health Data May Have Walked Out the Door in April Breach
Medtronic is notifying patients that their personal and health data — including names, Social Security numbers, and medical information — may have been stolen during a cyberattack in which unauthorised actors accessed its corporate systems for nearly a week in April. The extortion group ShinyHunters claimed responsibility, alleging it stole over nine million records and demanding a ransom, though Medtronic has not publicly attributed the attack or confirmed whether data was actually exfiltrated. The company states that no medical devices were affected and is offering impacted individuals two years of complimentary credit and identity monitoring services.
AI Compute Theft, Apple Mail Holes, BlueHammer Ransomware: This Week's Security Roundup
This week's cybersecurity news covers a range of threats — including AI compute hijacking, an Apple email flaw, and BlueHammer ransomware — all sharing a common theme: attackers exploiting small, overlooked weaknesses rather than launching large-scale attacks. The vulnerabilities span browsers, bots, sandboxes, and AI systems, often involving weak permissions, exposed servers, or trusted tools being misused. The key takeaway is that minor security gaps — not major breaches — are the real entry points worth paying attention to.
FortiBleed Credential Harvest Is Directly Feeding INC and Lynx Ransomware Operations
The FortiBleed campaign, a large-scale credential-harvesting operation targeting over 430,000 FortiGate firewalls across 150 countries, has been directly linked to the deployment of INC Ransom and Lynx ransomware. Active since at least February and likely run by a Russian initial access broker involving around 20 individuals, the operation has compromised over 110 million credentials and resulted in ransomware attacks on 12 organisations, with hundreds of endpoints encrypted. SOCRadar confirmed the connection after an operational security mistake by the attackers exposed internal files, revealing a single operator working both ransomware negotiation panels using infrastructure tied to the FortiBleed campaign.
A U.S. County Paid $1 Million to a Group That Never Even Locked a Single File
A U.S. government entity, likely Union County, Ohio, paid approximately $1 million in bitcoin to a group called Kairos after hackers stole over 1.6 million files and threatened to publish sensitive records, including data from the prosecutors' office. Unlike typical ransomware attacks, Kairos never encrypted any systems — it relied solely on the threat of leaking stolen data as leverage, reflecting a growing trend where extortion groups skip encryption entirely. After a month-long negotiation, the county paid ten times its opening offer, receiving only an unverifiable "proof of deletion" in return, with blockchain tracing linking the funds to exchanges including Bybit, OKX, and a Russian service.
Avalon Malware Framework Bundles Ransomware, Credential Theft and AI-Assisted Development Into One Nasty Package
Cybersecurity researchers have uncovered a modular malware framework called **Avalon**, distributed via phishing emails, which combines credential theft, lateral movement, remote access, and ransomware (internally named CrownX) into a single toolkit. The framework employs sophisticated evasion techniques targeting major security vendors and shows signs of AI-assisted development, highlighting how AI is lowering the barrier to entry for malware creation. These findings coincide with other emerging AI-driven threats, including a fully autonomous LLM-powered ransomware attack and a novel malware that uses a public LLM API to translate plain-language attacker instructions into shell commands — requiring no coding knowledge whatsoever.
An AI Agent Just Ran a Ransomware Attack, Start to Finish
A threat actor called JadePuffer exploited a critical authentication vulnerability (CVE-2025-3248) in the open-source AI framework Langflow to gain code execution and conduct an agentic ransomware attack, using the LLM itself to autonomously perform reconnaissance, harvest credentials, and move laterally through connected systems. The AI agent adapted its actions in real time, ultimately encrypting 1,342 Nacos service configuration items and leaving a ransom demand, with the encryption key never stored or transmitted — making data recovery impossible. Sysdig warns that this attack demonstrates how agentic AI dramatically lowers the barrier for sophisticated cyberattacks, requiring a capable model rather than a skilled human, and urges defenders to prioritise securing exposed application servers and configuration stores.
DeepSeek Wrote Working Browser Ransomware Without Knowing the API Existed
Cybersecurity researchers at Check Point have identified a malware sample generated by DeepSeek that combines a novel browser-native ransomware technique with a broader information-stealing toolkit, marking the first documented case of an AI independently developing a previously theoretical attack path. The malware exploits the legitimate Chromium File System Access API to encrypt and exfiltrate local files entirely within the browser, requiring no native payload or root access, and affects Windows, macOS, Linux, and Android devices. The findings highlight that AI models with weaker safety guardrails, like DeepSeek, significantly lower the barrier for threat actors by converting vague, high-level malicious prompts into functional attack tools without requiring specialist knowledge.
DeepSeek Wrote Browser Ransomware When Asked Nicely Enough
Cybersecurity firm Check Point Research discovered that DeepSeek generated a near-functional browser-based ransomware sample called "InfernoGrabber 9000," which exploits the Chrome File System Access API to encrypt local files without requiring any native software installation. Although the original sample was incomplete, researchers found that only minimal technical expertise was needed to make it fully operational, and they successfully built a working proof-of-concept using DeepSeek's latest model with slightly rephrased prompts. Check Point warns that this type of AI-assisted, browser-native attack is likely already being attempted by real threat actors, lowering the bar for cybercriminals significantly.
FortiBleed Gang Moonlights for INC and Lynx Ransomware as Credential Haul Reaches 110 Million
The FortiBleed credential theft campaign has been directly linked to INC and Lynx ransomware operations, with an operator found accessing negotiation panels for both groups while using stolen FortiGate credentials to facilitate ransomware deployments. SOCRadar's investigation revealed the campaign targeted around 430,000 FortiGate firewalls globally, harvesting over 110 million credentials, with at least 12 confirmed ransomware deployments resulting in hundreds of encrypted endpoints. Evidence suggests the operation is run by an approximately 20-person Russian-speaking group, likely acting as an initial access broker, with signs they may be expanding their targeting beyond Fortinet devices to Citrix infrastructure.
Play Ransomware Claims MyPillow Scalp — Lindell Says It's a Political Stitch-Up
The Russian-language ransomware group Play has claimed to have stolen sensitive financial and personal data from Mike Lindell's MyPillow, setting a Friday deadline for the company to make contact before publishing the data. Lindell has denied the breach, dismissing the claims as a politically motivated "hit job" related to his gubernatorial campaign. Play has targeted over 900 organisations since 2022 and is known for data theft and extortion tactics.
Microsoft Dismantles Shady Code-Signing Operation Fuelling Ransomware Campaigns
Microsoft has taken down a malware-signing service that threat actors were using to get ransomware and other malicious software past Windows security defences. The operation targeted a cybercriminal outfit providing a kind of laundering service for malware, giving it legitimately signed certificates so it looked trustworthy to the operating system.
Shadow AI Is the Insider Threat Nobody's Watching
Verizon's 2026 Data Breach Investigations Report reveals a fourfold increase in "shadow AI" use, with 67% of employees who regularly use AI at work doing so through unauthorized personal accounts, potentially exposing sensitive corporate data such as source code, documents, and proprietary research to unvetted third-party platforms. The report also highlights worsening vulnerability management, with remediation rates for critical flaws dropping from 38% to 26% and resolution times rising from 32 to 43 days, while ransomware featured in nearly half of all breaches. On a positive note, ransom payments continued to decline, with 69% of victims refusing to pay and the median payment falling slightly to just under $140,000.
Grafana Labs Got Its GitHub Raided. It's Not Paying Up.
Grafana Labs has disclosed that an unauthorized attacker obtained a token to access its GitHub environment and stole its codebase, subsequently threatening to release the code unless a ransom was paid. The company refused to pay, citing FBI guidance and the fact that no customer data or operational systems were affected. The incident's impact may be limited, as much of Grafana's code is already open source, though it remains unclear exactly what proprietary code was taken.