Advertisement
Insider Threat: Former Negotiator Pleaded Guilty to BlackCat Attacks
A former cybersecurity negotiator at DigitalMint has pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks against U.S. organizations.
CVE-2023-46604: Apache ActiveMQ RCE Exploited by HelloKitty - Patch Now
Over 6,400 Apache ActiveMQ servers are exposed to RCE via CVE-2023-46604. Threat actors like HelloKitty are actively exploiting this high-severity flaw.
Beyond Backups: Essential BCDR for Ransomware & Operational Resilience
Learn why traditional data backups are insufficient for business continuity. This analysis highlights the critical role of BCDR in mitigating ransomware and outage…
Payouts King Ransomware Deploys QEMU VMs to Evade EDR Solutions
Payouts King ransomware leverages QEMU virtualization and reverse SSH tunnels to bypass endpoint security and encrypt MSSQL servers on corporate networks.
CVE-2023-46604: Apache ActiveMQ RCE Exploited in the Wild
CISA warns of active exploitation for CVE-2023-46604, a critical RCE flaw in Apache ActiveMQ used by ransomware groups. Update to version 5.18.3 or later.
Germany Ransomware Surge: How SafePay and Qilin Target Mittelstand
Germany sees a 92% surge in data leaks as ransomware actors like SafePay and Qilin pivot toward the Mittelstand and professional services sectors.
Advertisement
6-Year Ransomware Campaign Targets Turkish SMBs: An Analysis
A persistent six-year ransomware operation has targeted Turkish home users and SMBs, exploiting under-reporting to maintain operational longevity.
Storm-1175: High-Velocity Medusa Ransomware Campaigns
Runtime Rebel reports on Storm-1175's rapid Medusa ransomware campaigns, exploiting N-day and zero-day vulnerabilities for financial gain.
German Authorities Identify GandCrab and REvil Ransomware Leaders
German and US authorities identify Russian nationals behind GandCrab and REvil ransomware operations, marking a major step in ransomware attribution.
Qilin and Warlock Ransomware Bypass 300+ EDR Tools via BYOVD
Threat actors Qilin and Warlock use Bring Your Own Vulnerable Driver (BYOVD) tactics and msimg32.dll to disable security software on compromised endpoints.
BKA Unmasks REvil Leadership Behind 130 German Ransomware Attacks
Germany's BKA unmasks the leadership of the REvil (Sodinokibi) ransomware group, including the representative UNKN, following a major threat intel investigation.
Germany Doxes UNKN: Identity of REvil and GandCrab Leader Revealed
German authorities identify Daniil Maksimovich Shchukin as UNKN, the lead operator behind the notorious GandCrab and REvil ransomware operations.
Multi-Extortion Ransomware Tactics: A Deeper Dive
Analyze the evolution of multi-extortion ransomware, its reliance on data leaks, and strategies for mitigating the impact of exfiltrated data.
BRICKSTORM Malware: Hardening vSphere & VCSA Against Advanced Threats
Defend VMware vSphere and VCSA against BRICKSTORM malware. Learn hardening strategies, identity management, Zero Trust networking, and advanced logging to thwart…
Ransomware Preparation: Healthcare Facilities' Defense Strategy
Hospitals face inevitable ransomware attacks. Learn why proactive incident response planning, regular rehearsals, and robust technical controls are crucial for defense.
Cyberattacks Target Latin American Government and Health Sectors
Recent disruptive cyberattacks and ransomware probes are targeting government infrastructure and health services across Latin America and the Caribbean.
TeamPCP Supply Chain Campaign: First Victim, Cloud Enumeration, Ransomware
Detailed analysis of TeamPCP supply chain campaign, covering the first confirmed victim, post-compromise cloud enumeration tactics, and dual ransomware operations.
Bearlyfy Targets 70+ Russian Firms with Custom GenieLocker Ransomware
Pro-Ukrainian group Bearlyfy deploys GenieLocker ransomware in a campaign targeting over 70 Russian organizations to cause maximum business disruption.
Silnikau Sentenced: BitPaymer Ransomware Botnet Operator Receives 2 Years
Russian national Maksim Silnikau sentenced for managing a botnet used in BitPaymer ransomware attacks targeting 72 U.S. companies and demanding $100 million.
TA551 Botnet Operator Sentenced: Analyzing Shathak Ransomware Tactics
Russian national Ilya Angelov sentenced for managing the TA551 botnet, a major facilitator of ransomware attacks via sophisticated phishing campaigns.
U.S. Sentences Yanluowang Ransomware Facilitator Aleksei Volkov
Russian national Aleksei Volkov sentenced to 81 months for facilitating Yanluowang ransomware attacks, causing $9M in damages to U.S. organizations.
M-Trends 2026: Evolving Ransomware, Persistence, and SaaS Attack Vectors
M-Trends 2026 reveals critical shifts in adversary TTPs: destructive ransomware, zero-day exploitation for persistence, and voice phishing for SaaS access.
Mandiant M-Trends 2026: Handoff Time Shrinks to 22 Seconds
Mandiant's M-Trends 2026 report reveals a drastic reduction in initial access handoff times to 22 seconds, demanding faster detection and response.
Iranian Handala Group Leverages Telegram for Malware Delivery and C2
FBI alerts organizations to Handala, an Iranian MOIS-linked group using Telegram APIs for data exfiltration, ransomware, and wiper attacks across sectors.