Ransomware

The FBI and European agencies say the SafePay ransomware gang has breached at least 600 organizations in the U.S. and Europe since August 2024 and is now among the most active ransomware groups of 2026. The advisory says SafePay gains access through guessed passwords, phishing, and exploited internet-facing flaws including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, then creates or hijacks accounts, uses remote tools such as AnyDesk and TeamViewer, steals data, and encrypts systems. — This matters because it is a large, ongoing ransomware campaign affecting businesses and critical infrastructure, not an isolated incident. Organizations should urgently review exposure to the listed CVEs, harden remote access, reset weak passwords, watch for phishing and follow-up extortion calls, and check for misuse of legitimate admin tools.

Palo Alto Networks says attackers are now using a GlobalProtect VPN flaw to try to get into corporate networks without valid credentials. The issue, CVE-2026-0257, affects PAN-OS GlobalProtect portal and gateway configurations that use authentication override cookies with specific certificate reuse; attackers can forge those cookies and establish unauthorized VPN access on unpatched devices. Rapid7 says it saw exploitation from at least May 17, 2026, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. — Organizations that use Palo Alto GlobalProtect could be exposed to unauthorized remote access into internal networks, so this is an urgent patch-now issue. Defenders should update PAN-OS immediately and, if needed, disable authentication override cookies or use a separate certificate for that feature.

UK regulators say a ransomware attack on Data Cymru in November 2024 exposed personal data for 3,300 people, most of them children, after attackers used a forgotten test account with the password "Password1" to get in. The ICO said Ogi Networks had created the Test2 account in 2012 and that shared local administrator passwords across impacted systems helped the intruder move from one server to others; 42 GB was exfiltrated before 182.7 GB was encrypted. — This matters because it shows how a single weak, forgotten account and reused admin passwords can turn a small oversight into a breach affecting thousands. Organizations using managed IT providers should review dormant accounts, rotate local admin credentials, and audit shared responsibility for account lifecycle controls.

ShinyHunters says it hacked the FBI’s jobs website, defaced it, and stole 2 TB to 3 TB of data tied to current, former, and prospective FBI employees. According to the group, the intrusion used an unpatched Oracle PeopleSoft pre-authentication remote-code-execution zero-day on the FBI jobs portal, then moved into FBI-managed AWS GovCloud systems; the claims were not confirmed by the FBI, Oracle, or AWS at publication. — If true, this would be a major federal breach affecting highly sensitive personnel and applicant records and would also signal an urgent, unpatched PeopleSoft risk for other organizations. Oracle PeopleSoft users and U.S. government defenders should urgently check exposure, review logs for compromise, and prepare mitigations while awaiting official confirmation or advisories.

A Canadian cybersecurity executive who worked on ransomware and extortion negotiations was arrested in Pennsylvania in a sealed U.S. extortion case reportedly tied to the ShinyHunters hacking group. Court records cited by BleepingComputer show conspiracy and extortion-related charges, including 18 U.S.C. 371, CFAA extortion charge 1030(a)(7)(B), and Hobbs Act extortion charges. Multiple reports linked the arrest to the FBI’s ShinyHunters crackdown and possibly the recent breach of the FBI jobs portal, though the complaint remains sealed. — This matters because it suggests U.S. investigators may be targeting not just hackers but alleged facilitators in a major data-theft extortion ecosystem linked to more than 140 intrusions. Organizations hit by ShinyHunters or similar crews should expect continued law-enforcement disruption but still prioritize credential security, phishing defenses, and cloud/SaaS access controls.

A new report identifies a suspected real-world operator behind The Gentlemen, one of 2026's most active ransomware groups. KrebsOnSecurity, drawing on Check Point, Intel 471, Flashpoint, and Constella data, says the ransomware-as-a-service group has claimed at least 332 victims since mid-2025 and more than 240 in 2026, recruits affiliates with a 90/10 ransom split, and commonly gains entry through internet-facing VPN and firewall devices before rapidly encrypting networks. — This is a major ransomware actor by victim volume, so the attribution and tradecraft details help defenders prioritize monitoring of exposed remote-access and edge devices. Organizations should review exposure of VPNs and firewalls, harden remote access, and watch for intrusion patterns associated with fast-moving affiliate-led ransomware attacks.

Anne Arundel County, Maryland says hackers broke into county systems in August and stole files. The county said it found irregular activity on August 28, 2026, investigated a limited subset of its network, and determined an unauthorized actor copied files from a limited number of systems. Rhysida claimed the attack and threatened to leak 2.6 terabytes of data unless a $2 million ransom was paid; the county is still reviewing what information was taken. — County residents and employees may face exposure of personal or government data, and local services can be disrupted even when only part of a network is hit. Organizations, especially local governments, should review segmentation, backups, and incident response readiness, while affected residents should watch for breach notices and follow-up scams.

A former infrastructure engineer was sentenced after locking thousands of devices on his employer’s network and demanding 20 bitcoin to stop the disruption. Prosecutors said Daniel Rhyne used an administrator account to remotely access the New Jersey industrial company’s network in November 2023, changed passwords, deleted 13 domain admin accounts, reset 301 user accounts, blocked access to 254 servers and 3,284 workstations, and sent a ransom email claiming backups had been deleted. — This is a notable insider-threat case showing how a trusted administrator can inflict ransomware-style damage without deploying malware. Organizations should review privileged access, monitor dormant or unusual admin activity, separate backup controls, and rapidly revoke access when employment issues arise.

Japanese authorities arrested a 28-year-old Russian national alleged to be a core member of the Qilin ransomware gang and extradited him to Germany. German prosecutors want him for a September 2024 attack on a logistics company in which systems were hacked, files were encrypted, and more than $160,000 in cryptocurrency was extorted. Qilin, also known as Agenda, is a ransomware-as-a-service operation tied to major incidents including the Synnovis attack on UK healthcare and later exploitation of Check Point VPN zero-day CVE-2026-50751. — This is a significant law-enforcement action against one of the most active ransomware groups, showing operators can still face arrest across borders. Organizations hit by Qilin or tracking its tactics should note the continued threat from the group even as authorities pursue members.

Advantest says a ransomware attack earlier in 2026 stole personally identifiable information from its systems. The semiconductor test-equipment maker said an unauthorized party breached its network on February 15, 2026, accessed some systems, and extracted data from servers; the exposed data can include contact details, dates of birth, Social Security numbers, national ID numbers, driver’s license and passport numbers, medical information, and financial information. No ransomware gang has publicly claimed the attack so far, and the number of affected people is still unknown. — People whose data was taken face a real risk of identity theft, fraud, and phishing, especially given the sensitivity of the records involved. Affected individuals should use the offered monitoring services and watch for suspicious account activity, while organizations should treat this as a significant ransomware-related data theft case.

Researchers say more than 30,000 Fortinet firewalls and virtual private network gateways were compromised and can expose the organizations behind them to further hacking. SOCRadar said a campaign it calls FortiBleed systematically tried known passwords against internet-exposed Fortinet devices, harvested working credentials, then monitored traffic and reused newly captured passwords to spread further; victims span companies and government bodies in more than 190 countries. — Organizations using Fortinet edge devices may already have attackers inside even without a new software flaw. This is urgent for network defenders: audit Fortinet logins, rotate passwords and tokens, review device configurations, and check for signs of credential harvesting or unauthorized access.

A Trump Mobile website flaw reportedly let anyone pull customer order records, exposing personal details of people who preordered the company’s phone service and handset. According to The Register and the finder, a simple HTTP POST request to exposed application programming interface (API) endpoints returned batches of records containing names, postal addresses, email addresses, phone numbers, customer numbers, enrollment IDs, and order-channel details; no CVE is assigned, and the issue was reportedly fixed after disclosure attempts. — Affected customers could face phishing, impersonation, or account-targeted fraud if their contact and order data was exposed. Trump Mobile users should watch for suspicious calls, texts, and emails referencing orders or account setup, while the company should clarify scope and notify affected users if exposure is confirmed.

Osaka Metropolitan University shut down much of its IT environment and canceled classes after a suspected ransomware attack disrupted email, internal networks, and administrative systems. The university said about 500 servers stopped operating, with impacts across academic administration, payroll, HR, finance, library services, and websites. Japanese media reported that data tied to at least 130,000 current and former students, staff, and related individuals may have been exposed, though OMU said it has not yet confirmed data theft. — This is a major disruption at one of Japan’s largest universities, affecting teaching and core business systems while raising possible data-exposure risks for students and staff. People connected to the university should watch for official breach notices and phishing, while peer institutions should review ransomware resilience, segmentation, and backup recovery plans.

The University of Illinois Chicago said a ransomware attack hit servers at its College of Medicine, temporarily taking some systems offline and leading to data theft. UIC said its main university network was not affected and patient care at UI Health was not disrupted. The Booba ransomware gang claimed the attack and said it stole 344 GB of data; the university is investigating whether personal, research, or academic information was compromised. — This matters because a breach at a medical school can expose sensitive personal, academic, and research data even when clinical care stays online. People connected to UIC’s College of Medicine should watch for breach notices and possible follow-on phishing or fraud, while defenders should review restoration, access controls, and data-exposure scope.

AngMar Management Services says hackers stole patient personal and health information from its systems, affecting 126,196 people. The Texas company, which supports home health and hospice providers, detected suspicious activity in mid-July and confirmed in early September that data was taken. Stolen information includes Social Security numbers, diagnosis and medical history details, insurance data, prescription information, provider names, and dates of service; Interlock later claimed the theft on its leak site. — This exposed highly sensitive medical and identity data that can fuel fraud, impersonation, and extortion. Patients and partner providers should treat related calls and emails with caution and monitor for misuse of medical and financial information.

A China-linked group is using Warlock ransomware to attack critical infrastructure and public-sector organizations in Portuguese- and Spanish-speaking countries. Symantec says the attackers are exploiting multiple Microsoft SharePoint vulnerabilities, including the older 2025 'ToolShell' bugs and newer 2026 SharePoint flaws recently highlighted by CISA, to reach a water utility, a telecommunications provider, a university, and a regional government across Europe, Africa, and Latin America. In at least one case, the attackers also deployed a tool to disable security software across dozens of systems before encrypting them. — Organizations running on-premises Microsoft SharePoint should treat this as urgent because unpatched servers are still being used as an entry point for ransomware against essential services. Defenders should patch SharePoint immediately, review internet-exposed deployments, and hunt for post-compromise activity such as security-tool tampering and admin-like lateral movement.

The city of Vicksburg, Mississippi says a ransomware attack forced it to shut down computer systems, disrupting utility-payment processing while emergency services remained online. Mayor Willis Thompson said the city is investigating with the FBI, the Department of Homeland Security, state officials, and private cybersecurity responders. Officials have not said which group was responsible or whether data was stolen, but they are assessing possible exposure of information tied to customers, contractors, vendors, employees, and business partners. — This matters to residents, city workers, and vendors because it affects access to local government services now and may turn into a data-breach notification later. Organizations in local government should treat this as another reminder that ransomware can halt routine civic functions, while affected users should watch for official updates about payment delays or possible data exposure.

CISA warned that attackers are now actively exploiting a Microsoft SharePoint server flaw that can let a low-privilege user run code on vulnerable systems. The bug, CVE-2026-45659, is a deserialization issue in SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition; Microsoft released fixes on May 21, 2026 after the CVE was omitted from its May security update listing. CISA added it to the Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to patch by Saturday. — Organizations running on-premises SharePoint, especially internet-exposed servers, should treat this as urgent because attackers can exploit it remotely with only Site Member-level access. Patch immediately, review internet exposure, and check for signs of compromise on SharePoint servers.

CISA says a newly tracked Microsoft SharePoint server flaw is already being used in real attacks, putting organizations with exposed SharePoint systems at immediate risk. The agency added CVE-2026-58644, a remote-code-execution vulnerability, to its Known Exploited Vulnerabilities catalog, meaning attackers can run code on vulnerable servers; the article indicates active exploitation but the provided text does not include affected versions or patch details. — Organizations running SharePoint should treat this as urgent because attackers are already exploiting it in the wild. Defenders should identify exposed SharePoint servers, apply Microsoft fixes or mitigations as soon as available, and hunt for signs of compromise immediately.

Hackers are actively breaking into vulnerable on-premises Microsoft SharePoint servers and stealing secret machine keys that can let them keep impersonating users even after the software is patched. The flaw, CVE-2026-50522, is a critical unauthenticated remote-code-execution bug caused by unsafe deserialization in SharePoint's WS-Federation sign-in handling at /_trust/default.aspx. WatchTowr says exploitation started within hours of a public proof-of-concept release, and Defused saw related attack activity days earlier. — Organizations running on-premises SharePoint should treat this as urgent because patching alone may not remove attacker access if machine keys were stolen. Apply Microsoft's July updates immediately, then investigate for compromise and rotate affected keys and credentials.

Attackers are already using a newly published exploit to target Microsoft SharePoint servers, putting organizations with internet-exposed SharePoint at immediate risk. The flaw, CVE-2026-55040, is a critical authentication-bypass bug in SharePoint Enterprise Server 2016 and SharePoint Server 2019 that lets an unauthenticated attacker impersonate a site user or administrator through the JSON Web Token (JWT) validation pipeline. Microsoft patched it in July 2026, and Defused says the Rapid7 proof-of-concept was quickly seen hitting honeypots. — Organizations running on-premises SharePoint should treat this as urgent because public exploit code is already being used in the wild. Patch immediately and reduce exposure by restricting or proxying internet-facing SharePoint access, especially Central Administration.

JetBrains says a critical flaw in TeamCity On-Premises can let an attacker remotely take control of vulnerable build servers. The issue, CVE-2026-63077, is an authentication bypass in the agent polling protocol that can be exploited over HTTPS to run operating system commands with the server process's privileges. JetBrains says all TeamCity On-Premises versions are affected, TeamCity Cloud is already protected, and fixes are available in versions 2025.11.7 and 2026.1.3 plus a security patch plugin for TeamCity 2017.1+. — TeamCity often holds source code, build secrets, and deployment access, so compromise can cascade into software supply-chain and environment-wide damage. Organizations running TeamCity On-Premises should patch or install the security plugin immediately and restrict internet exposure behind a VPN or other access controls.

A man accused of helping deploy Ryuk ransomware against U.S. victims has pleaded guilty in federal court after being extradited from Ukraine. U.S. prosecutors say Karen Serobovich Vardanyan provided initial access to corporate networks and helped deploy Ryuk between November 2019 and April 2020, encrypting hundreds of servers and workstations. Court records cited attacks including a Michigan company, a technology company in Oregon, and a school in Texas, with the conspirators allegedly receiving about 1,610 bitcoin in ransom payments. — This matters because it ties a named individual to one of the most damaging ransomware operations and shows continued prosecution years after the attacks. Defenders and affected sectors should treat it as a reminder that initial-access brokers and old Ryuk tradecraft still shape current ransomware threats descended from Ryuk and Conti.

Check Point says attackers used a zero-day flaw to break into some of its VPN systems, and at least one confirmed follow-on intrusion was linked to the Qilin ransomware operation. The main issue, CVE-2026-50751, is an unauthenticated authentication-bypass bug affecting Remote Access VPN, Mobile Access / SSL VPN, and Spark gateways when configured with deprecated IKEv1, legacy clients, and no mandatory machine certificate; Check Point also disclosed CVE-2026-50752, an IKEv1 certificate-validation flaw that could enable man-in-the-middle attacks on site-to-site VPNs. Exploitation began May 7 and has hit a few dozen organizations globally. — Organizations using affected Check Point VPN setups could be exposed to break-ins without valid credentials, with ransomware risk if attackers get in. This is urgent: apply Check Point's updates immediately or disable IKEv1, require machine certificates, and follow the vendor's mitigations.

Cisco says attackers have been using a flaw in Secure Firewall Management Center to get unauthorized access to vulnerable management systems. The zero-day, CVE-2026-20316, is caused by built-in static credentials for a low-privilege account and affects Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0; Cisco released hotfixes, said there are no workarounds, and published a /var/tmp/license.tmp log indicator that may show compromise. Cisco also updated guidance for separate critical FMC auth-bypass CVE-2026-20079, but said it is not aware of exploitation of that bug. — Organizations using on-premises Cisco Secure FMC should treat this as urgent because attackers are already using it and Cisco says it can be chained with other bugs for deeper access. Install the hotfixes immediately, review the listed logs for compromise, and rotate credentials, keys, and certificates if affected systems show the indicator.

Cisco says attackers are actively exploiting a critical flaw in Cisco Secure Firewall Management Center, the system many organizations use to manage their firewalls. The bug, CVE-2026-20079, is an authentication bypass that can be triggered with crafted HTTP requests and can lead to root access on vulnerable devices. Cisco patched it in March 2026, added indicators of compromise in July, and now says exploitation began in August; CISA has added it to the Known Exploited Vulnerabilities catalog. — Organizations running internet-reachable Cisco Secure FMC should treat this as urgent because attackers can break in without valid credentials and take over the management system. Apply Cisco's patches immediately and restrict the FMC interface from internet access.

A researcher’s public release of six Windows zero-days has already led attackers to exploit three of them, and Microsoft says more unpatched flaws remain. Microsoft named the bugs as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma; it said BlueHammer, RedSun, and UnDefend saw attacks after proof-of-concept exploit code was posted, while YellowKey is tracked as CVE-2026-45585 and, along with GreenPlasma and MiniPlasma, still lacks a fix. — Windows defenders may have little time between public disclosure and real-world attacks, especially when proof-of-concept exploit code is available. Organizations should review Microsoft mitigations immediately, monitor for compromise tied to these bug names and CVE-2026-45585, and prioritize hardening or temporary workarounds where patches do not yet exist.

Swiss prosecutors say a Ukrainian software developer helped build and run ransomware attacks that hit companies in Switzerland and other countries, and they are seeking a 12-year prison sentence. The case centers on alleged involvement in LockerGoga, MegaCortex, and Nefilim attacks between December 2018 and May 2020, with claimed losses of more than 130 million Swiss francs. Prosecutors say the defendant took part in attacks on 10 companies, including Stadler Rail, Crealogix, and Meier Tobler, and that the wider investigation involved authorities in Switzerland, France, the Netherlands, Norway, Ukraine, and the United States. — This is a significant enforcement case around several destructive ransomware families that caused major business disruption and extortion losses. It gives defenders and victims more concrete attribution around older but important ransomware campaigns and shows continued international pursuit of the people behind them.

Attackers have started breaking into internet-exposed VMware vCenter servers using a newly patched critical flaw. The issue, CVE-2026-59310, is a CVSS 9.8 directory traversal bug in the vCenter Syslog server that can let a remote attacker with network access execute arbitrary code. Quirso says exploitation began around August 3 and observed more than 360 victim IP addresses across 47 countries, with attackers deploying the reverse_ssh tool to keep persistent outbound access. — Organizations that run VMware vCenter, especially systems reachable from the internet, should treat this as urgent and patch immediately, then check for reverse shells and unexpected outbound connections. vCenter is a high-value management system, so compromise can have broad downstream impact across virtualized infrastructure.

Researchers say the pro-Ukraine hacktivist group Hacking Cat has expanded from defacements and leaks to destructive intrusions against Russian targets. Kaspersky linked the group to a newly documented remote-access trojan called Gorilla RAT and to Monkey Ransomware, which encrypts files with a .monkey extension; in some cases, attackers reportedly gained initial access by exploiting Microsoft Exchange server vulnerabilities before tunneling deeper into victim networks. The report also ties Hacking Cat to joint operations using Nemo Wiper, malware built to destroy data rather than collect ransom. — This shows hacktivist activity in the Russia-Ukraine conflict becoming more capable and destructive, with real operational impact on targeted organizations. Defenders at exposed Russian and regionally relevant organizations should urgently review Exchange exposure, hunt for Gorilla RAT, Monkey Ransomware, and Nemo Wiper activity, and prepare for data-destructive incidents rather than ordinary website vandalism.

A Ukrainian national has pleaded guilty in the United States for helping carry out Conti ransomware attacks that hit victims in the U.S. and other countries. The Justice Department said Oleksii Lytvynenko admitted joining the Conti conspiracy in 2021, possessing data stolen from 12 victims, and helping code a loader, malware used to install tools needed for ransomware intrusions. Prosecutors say Conti targeted more than 1,000 victims worldwide and collected over $150 million before the group fragmented in 2022. — This matters because Conti was one of the most damaging ransomware groups of its era, and the case adds concrete attribution and operational detail defenders can use to understand how these attacks were carried out. It also shows continued law-enforcement pressure on the people behind major ransomware campaigns and their successor groups.

A newly reported Android malware family called Mantax Otax can lock files, spy on victims, and pressure them to pay ransom. Zimperium says the malware is being distributed by Indonesian operators through phishing and malicious APKs installed outside Google Play. It abuses Android Accessibility permissions, pulls command-and-control details from GitHub, uses Firebase or WebSockets for commands, steals SMS, one-time passwords, WhatsApp and Telegram data, and encrypts files on Android 9 and older devices. — This is a combined mobile ransomware and spyware threat that can both steal sensitive data and extort victims, especially people sideloading apps outside Google Play. Users should avoid unofficial APKs, deny Accessibility access to untrusted apps, and make sure Play Protect is enabled and updated.

CISA says ransomware gangs are now using a critical WatchGuard firewall bug to break into vulnerable networks. The flaw, CVE-2025-14733, is an unauthenticated remote-code-execution issue caused by an out-of-bounds write in WatchGuard Firebox devices running Fireware OS 11.x, 12.x, and 2025.1 through 2025.1.3; WatchGuard said exposure depends on IKEv2 VPN and some branch office VPN configurations, and CISA had already listed it as actively exploited in December. — Organizations using affected WatchGuard Firebox firewalls face elevated risk because this bug is now tied not just to intrusion activity but to ransomware. Patch immediately, check WatchGuard's indicators of compromise, and review IKEv2 and branch office VPN configurations on exposed devices.

Healthcare software company Veradigm says attackers used credentials stolen from a third-party vendor to access a limited customer-services API and copy patient data. The company said the exposed data includes personal information and Social Security numbers for some patients, while clinical information was not affected. The Gentlemen ransomware group claimed the intrusion separately and says it stole 3.5 million patient records, but Veradigm has not confirmed that figure. — Patients and healthcare customers may face identity-theft risk even though medical records were not reportedly exposed. Affected organizations should watch for breach notices, assess exposure through Veradigm integrations and vendor access, and prepare for possible follow-on extortion or phishing.

Stadtwerke Landsberg, a city-owned utility in Bavaria, said hackers encrypted its central IT network on September 1, disrupting office systems and limiting customer service. The utility said electricity, water, and other essential services were not affected, but forensic work is ongoing and it cannot yet rule out theft of customer data including names, addresses, phone numbers, email addresses, and bank details. No ransomware group or extortion demand was identified. — This is the kind of attack that can interrupt public services and put residents’ personal and financial information at risk. Customers should watch for follow-up phishing or fraud, while other utilities should review ransomware response plans, network isolation, and backup security.

Berlin cut two state ministries off the city government network after authorities found a security breach affecting their shared IT environment. The ministries for urban development and for mobility and environment were isolated as a precaution, leaving staff without normal email and internet access and disrupting some public services. Officials have not yet named the attacker, confirmed data theft, or disclosed a CVE, but local reporting says a vulnerability in one ministry’s systems may have been exploited. — This is a live government-network intrusion with real service disruption, affecting ministry operations and residents who rely on housing and benefits systems. Berlin agencies and other public-sector defenders should watch for follow-up details on the intrusion path, patch any related exposed systems quickly, and prepare for possible wider containment steps.

N-able says attackers exploited a flaw in its N-central remote monitoring and management platform to gain administrator access and pivot into customer-managed systems. The issue, CVE-2026-18577, affects N-central versions before 2026.3.1.7 in both on-premises and cloud-hosted deployments and is described as a new patch-bypass method for the earlier flaw CVE-2026-18556. N-able said attackers abused the Take Control remote-access feature and in some cases set up Cloudflare tunnels for persistence. — Managed service providers and their customers can lose control of many endpoints at once if an N-central server is compromised, making this especially urgent. Organizations using N-central should patch immediately, review the published indicators of compromise, and check for unauthorized remote sessions, scripts, accounts, and Cloudflare tunnel services.

US Bank says it is investigating LockBit’s claim that the ransomware gang breached the bank and stole data, with a pay-or-leak deadline set for September 3. LockBit posted US Bank on its leak site but did not say what data was allegedly taken or how many records are involved. US Bank said it has no current evidence of unauthorized access to its network or impact to internal systems and has not confirmed the claim. — A claimed breach at a major U.S. bank could affect customers and employees if stolen data is eventually verified and published. Financial institutions, customers, and partners should watch for follow-up disclosures, possible notification letters, and fraud or phishing that may use any leaked information.

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives said a separate standalone system was compromised in a "major incident" after the Qilin ransomware gang claimed ATF on its dark-web leak site. ATF said the affected environment was isolated from its main enterprise network and that there was no indication the enterprise network, eForms system, or other ATF systems were affected. The agency says it cut connections to the breached environment and is investigating with the Department of Justice. — This is a significant breach at a U.S. federal law-enforcement agency and could involve stolen sensitive government data even if core ATF systems were not impacted. Federal defenders and partner organizations should watch for follow-on disclosures, while anyone interacting with ATF should be alert for phishing or fraud using potentially stolen information.

A cybercrime service called CRPx0 says it has rapidly increased the number of victim organizations it lists while expanding from scam activity into ransomware and data theft. The group advertises white-label ransomware-as-a-service and full-network intrusion services, including database theft, lateral movement, and persistence. According to the article and cited research, affiliates can use fake Windows Update and fake Google reCAPTCHA ClickFix lures that trick victims into pasting commands, leading to Python-based ransomware on Windows and macOS. — This matters because the service lowers the skill needed to launch extortion attacks and uses social-engineering lures that can fool ordinary employees on both Windows and Mac devices. Organizations should warn staff about fake CAPTCHA or update prompts, restrict script execution where possible, and watch for ClickFix-style command-paste attempts.

Paylogix says hackers stole sensitive personal, financial, and health-related data from its benefits administration systems, affecting at least tens of thousands of people. The company said attackers were in its network from November 13 to November 18 and took files containing Social Security numbers, bank account information, health insurance data, medical data, passport numbers, taxpayer IDs, and electronic signatures. Paylogix did not name the attackers, but Akira listed the company on its leak site in January. — People whose payroll and benefits data passed through Paylogix face risks including identity theft, financial fraud, and misuse of health information. Employers, insurers, and affected individuals should treat this as a serious third-party breach, watch for official notices, and review accounts and fraud protections.

A suspected ransomware affiliate is posing as a data recovery company called Ransom Busters and contacting ransomware victims before their attacks become public. GuidePoint Security and Coveware say the actor claimed it could provide decryption keys and delete stolen data for fees of $20,000 to $60,000, citing supposed access to ransomware-as-a-service panels for groups including DragonForce, Settra, and Anubis. Investigators linked incidents through overlapping tools and tactics, including SoftPerfect Network Scanner, s5cmd, Remotely, a backdoor account using the password 'Numlock!123,' and the hostname 'DESKTOP-BBETH6K.' — This raises the risk for ransomware victims because paying one party may no longer mean stolen data stays contained. Organizations hit by ransomware should route all negotiation and recovery decisions through trusted incident responders and be wary of unsolicited 'recovery' offers claiming insider access to decryptors or stolen files.

Attackers are actively breaking into organizations that use PTC Windchill and FlexPLM, a product lifecycle management platform used by many industrial companies. The flaw, CVE-2026-12569, is an improper input validation bug that lets a remote unauthenticated attacker run arbitrary code through crafted requests. PTC began releasing patches and mitigations on June 17 and said attackers have used the bug to install persistent JSP web shells for remote command execution and data theft; CISA has added it to the Known Exploited Vulnerabilities catalog. — This is urgent for manufacturers and other firms that rely on Windchill or FlexPLM, because attackers can break in over the network without valid credentials and keep long-term access. Organizations should apply PTC's patches or mitigations immediately, check for the published indicators of compromise, and treat exposed servers as potentially compromised.

CISA and the FBI say the Medusa ransomware group has hit more than 500 victims as of April 2026, up from 300 previously disclosed, with many victims in critical infrastructure and a strong focus on healthcare. The agencies updated a joint advisory to say Medusa affiliates often exploit newly announced flaws within 24 hours and in some cases have used exploits up to a week before public disclosure, while also using tools such as AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp, and Splashtop during intrusions. — Organizations, especially healthcare providers and other critical infrastructure operators, should treat this as an urgent warning to patch quickly, review remote-access tools, and hunt for credential theft and lateral movement. For the public, it signals ongoing risk of service disruptions at hospitals and local governments if defenses lag behind newly disclosed vulnerabilities.

CISA says ransomware gangs are now using a patched Windows flaw to take full control of vulnerable PCs and servers. The issue, CVE-2025-60710, is a high-severity privilege-escalation bug in Windows Task Host that affects Windows 11 and Windows Server 2025; Microsoft patched it in November 2025. It stems from a link-following weakness and can let a local attacker with basic user access gain SYSTEM privileges. — Organizations running unpatched Windows 11 or Windows Server 2025 systems face added risk that a small foothold can be turned into full device takeover during ransomware intrusions. This raises the urgency to verify the November 2025 Microsoft fix is installed and to review endpoint access that could give attackers local user-level entry.

An Akira ransomware affiliate broke into a victim network through a SonicWall SSL VPN account that was not protected by multi-factor authentication, stole credentials and files, and then tried to encrypt systems after rebooting a host into Safe Mode. Huntress says the attacker used credential spraying, Remote Desktop Protocol access to a domain controller, Active Directory enumeration, WinRAR and s5cmd for data theft, and AnyDesk for persistence and command-and-control, but the Safe Mode reboot appears to have broken the akira.exe encryptor on that host. — This matters because it shows a real Akira intrusion chain that defenders can act on now: protect VPN access with MFA, review SonicWall and remote-access logs, and hunt for RDP, AnyDesk, WinRAR, and s5cmd activity. Even though encryption failed on one system, the attackers still stole data, so affected organizations face extortion and potential downstream fraud or exposure.

Researchers say the DeadLock ransomware group is using Polygon blockchain smart contracts to support parts of its extortion operation, making its infrastructure harder for defenders and law enforcement to disrupt. The report describes a ransomware campaign in which blockchain-hosted logic or pointers help replace more traditional web infrastructure that can be seized or blocked, showing a resilience tactic rather than a newly disclosed software vulnerability or CVE. — This matters because it shows ransomware groups adapting to survive domain takedowns and infrastructure seizures, which can prolong extortion pressure on victims. Defenders should track DeadLock activity, update detection for blockchain-linked infrastructure, and not assume traditional disruption steps will be enough.

Nonprofit health system AnMed is still dealing with fallout from a July 26 cyberattack that knocked out IT systems and left multiple facilities closed to appointments. The group calling itself The Gentlemen posted ransom demands on AnMed's Facebook page and claimed to have stolen 6 terabytes of data, including sensitive patient and HR records, though AnMed says it has not yet confirmed the scope of any patient-data impact. The incident was initially described by AnMed as a malware-related cybersecurity disruption affecting four hospitals and clinics in Georgia and South Carolina. — This is a significant healthcare ransomware event because it is disrupting care delivery and may involve highly sensitive medical data. Patients and partners should watch for official breach notices and phishing, while healthcare defenders should review exposure of internet-facing systems, privileged accounts, and social media administration access.

Multiple local governments in the United States are dealing with cyberattacks that shut down public services, with Suisun City in California saying malware hit critical systems including 911 routing and dispatch. Suisun City declared an emergency and routed calls through the county; Coweta, Oklahoma said ransomware affected all city computers and files; Mitchell, South Dakota shut down government networks; and Washburn County, Wisconsin and Coryell County, Texas also disclosed attacks causing service outages. — These attacks are disrupting emergency response, court operations, utility payments, and other basic public services for residents. Local governments and nearby agencies should review continuity plans, isolate affected systems quickly, and prepare alternate communications and dispatch procedures during outages.

South Korean agencies say North Korea’s Lazarus hackers and the Gunra ransomware operation used overlapping tools and infrastructure to attack South Korean organizations. AhnLab’s 'Operation Double Barrel' report says the campaigns exploited flaws in Korean financial security software used for banking and government services, compromised 15 legitimate Korean websites for watering-hole attacks, and also used spearphishing; victims included government agencies, cryptocurrency exchanges, IT service providers, and a defense company. — This matters because people and organizations could be infected just by visiting a compromised legitimate site if they have outdated required security software installed. South Korean users and defenders should prioritize patching related software, review web and email defenses, and investigate for the shared malware, command-and-control infrastructure, and SSH key overlap described in the advisory.

SonicWall says attackers are actively exploiting two previously unpatched flaws in its SMA1000 secure remote-access appliances, and customers should install emergency updates now. The bugs are CVE-2026-15409, a critical server-side request forgery issue in the Work Place interface that can be triggered remotely without logging in, and CVE-2026-15410, a code-injection flaw in the Management Console that requires an authenticated administrator. Affected SMA1000 models include the 6210, 7210, and 8200v on specified 12.4.3 and 12.5.0 hotfix builds; fixes are in 12.4.3-03453 and 12.5.0-02835 and later. — These devices sit at the edge of corporate networks, so active exploitation can put remote access infrastructure at immediate risk. Organizations using SMA1000 should patch now, check SonicWall’s indicators of compromise, and if compromise is found, re-image or redeploy appliances and reset passwords and TOTP tokens.

The U.S. unsealed an indictment against three Russians accused of running Media Land and ML Cloud, hosting services that allegedly helped cybercriminals carry out attacks against victims in the United States and elsewhere. Prosecutors say Aleksandr Volosovik, Yulia Pankova, and Kirill Zatolokin provided infrastructure and technical support designed to shield criminal customers from law enforcement, enabling ransomware groups including LockBit, BlackSuit, and Play as well as stolen-card marketplaces such as Briansclub and Bidencash; the indictment cites 44 victims and about $62 million in losses. — Bulletproof hosting is a key enabler for ransomware, fraud, and stolen-data markets, so this case matters beyond the named defendants. Defenders should note the specific infrastructure and actor links, while affected organizations and the public should expect continued law-enforcement disruption efforts rather than an immediate end to related threats.

French rugby club Stade Français Paris says a cyberattack disrupted part of its IT systems and that attackers may have stolen data. The club says it restored systems from clean backups, while Qilin claimed the attack on its leak site and reportedly published documents tied to 18 players as proof of access; the club is investigating what information was exposed and has not confirmed the authenticity or full scope of the leak. — This matters to club staff, players, and other affected individuals because sensitive personal or operational data may have been exposed even though core services were restored. Organizations facing similar extortion threats should verify backups, review for data theft as well as encryption, and prepare notifications if personal information was compromised.

The alleged creator and administrator of the Ransom Cartel ransomware operation has been sentenced to 16 years in U.S. prison after attacks on at least 18 companies worldwide. The Justice Department says Belarusian national Maksim Silnikau built the ransomware-as-a-service operation in 2021, recruited affiliates on Russian-language cybercrime forums, supplied stolen credentials and encryption tools, ran the affiliate portal, and helped extort at least $5.2 million between 2021 and 2023. — This is a significant enforcement action against a ransomware operator tied to real business disruption, data theft, and multimillion-dollar losses. It matters to organizations because it highlights the ongoing risk from affiliate-based ransomware operations that combine stolen network access, data theft, and extortion.

River Financial, the holding company for River Bank & Trust, says hackers deployed ransomware in June 2026, stole data from parts of its network, and later claimed to delete that data. The intrusion was discovered three days after the June 16 attack, affected portions of the server environment, and led the company to take systems offline and disable compromised administrative accounts. River says its investigation is still ongoing and it has not yet determined whether personally identifiable information was accessed or exfiltrated. — This is a real ransomware-related bank intrusion with confirmed data theft, even though the company says the attackers represented that they deleted the stolen files. Customers and partners should watch for breach notifications and fraud, while defenders should review admin-account security, segmentation, and incident response readiness.

Cisco Talos says the Chaos ransomware group is deploying a new Rust-based backdoor called msaRAT that hides its command traffic by sending it through Google Chrome or Microsoft Edge instead of connecting directly to attacker servers. The malware is loaded in memory from an MSI installer posing as a Windows update, then uses the Chrome DevTools Protocol to control a headless browser, reach a Cloudflare Workers endpoint, and relay encrypted WebRTC traffic through Twilio TURN servers to obscure the attackers’ infrastructure. — This gives attackers a stealthier way to stay in networks and evade security tools because the malware blends into normal browser traffic. Organizations should hunt for the reported indicators, watch for suspicious headless browser activity and remote debugging use, and harden defenses against the email, voice-phishing, and fake IT/software-update lures used to start these intrusions.

Europol says it flagged 4,340 URLs for removal during a June-July 2026 operation targeting online content linked to The Com, a decentralized extremist network that recruits and abuses young people online. The action was run by Europol's EU Internet Referral Unit and Spain's CITCO with investigators from nine countries, and focused on content tied to self-harm, child sexual abuse material, violent attacks, grooming, doxing, swatting, and attack manuals; Europol says The Com includes subgroups involved in cyber intrusions and ransomware. — This matters because The Com blends violent extremism with cyber-enabled abuse such as sextortion, doxing, swatting, and ransomware, often targeting minors through mainstream online platforms. Platforms, investigators, schools, and families should watch for coded recruitment content and coercion tactics, while defenders should note the group’s overlap with cybercrime activity.

Swiss rail manufacturer Stadler says the Everest extortion group breached a data exchange platform shared with one of its suppliers and demanded about $12.3 million not to leak stolen data. Stadler says the incident happened in mid-July 2026, that its own IT systems and production were not disrupted, and that the attackers took technical information from the supplier side rather than security-relevant or personal data. The company filed a criminal complaint and says it will not pay. — This is a real supply-chain-linked extortion event affecting a major transportation manufacturer, even though Stadler says operations and rail vehicles were not impacted. Organizations that share files or platforms with suppliers should review third-party access, data exchange security, and exposure of technical documents.

A cyberattack on Japanese cold-chain and frozen-food company Nichirei disrupted deliveries to KFC Japan and may force some stores to limit menus, shorten hours, or close. Nichirei said unauthorized access caused system failures that stopped shipment and warehouse operations, and later confirmed attackers accessed a server storing personal information. No ransomware family, malware, or CVE has been identified publicly, and the company said it is withholding details to prevent further damage. — This shows how an attack on a logistics supplier can quickly spill into consumer-facing disruptions and possible data exposure. Organizations that depend on Nichirei or similar third parties should review contingency plans and watch for breach notifications, while affected users should monitor for updates about any exposed personal data.

Coca-Cola said a ransomware attack at its Fairlife dairy subsidiary temporarily stopped production of Fairlife products at U.S. facilities. In an SEC Form 8-K, the company said attackers gained unauthorized access to some systems, including production-related systems, and that it activated incident response and business continuity measures; Canadian production was not affected, and no ransomware group or data theft has yet been confirmed. — This is an operationally significant ransomware disruption affecting food production, not just office systems. Organizations with manufacturing or industrial operations should review segmentation, backup recovery, and business continuity plans, while customers and partners should watch for supply disruptions and any later breach notifications.

French and Dutch authorities, with Europol and partners from 16 countries, seized 33 servers and multiple domains tied to the 'First VPN' service, which investigators say was widely used in ransomware, fraud, and data-theft attacks. Authorities arrested or questioned a Ukrainian administrator, infiltrated the service, and said intelligence from the takedown identified thousands of users, with 506 users and 83 intelligence packages shared internationally. — The takedown targets a criminal privacy service that allegedly supported major cybercrime operations and may generate follow-on investigations into ransomware and data-theft cases. Defenders and incident responders should watch for new attribution and victim-notification leads emerging from the seized data.

A newly identified ransomware actor called Spirals broke into a South Asian IT services company and went from initial access to data theft and encryption in less than a day. Symantec says the attackers entered through an internet-exposed Microsoft IIS server, uploaded an ASP.NET web shell, enabled Remote Desktop, dumped credentials from the SAM and LSASS, moved laterally with Windows Management Instrumentation (WMI) and PsExec, and used revsocks, Chisel, and Cloudflare Tunnel for persistence. The Rust-based ransomware used intermittent encryption to speed up locking files and dropped a ransom note named RECOVERY_SECTION.log. — This is a fast-moving ransomware playbook that can leave defenders very little time to respond once attackers get in. Organizations with exposed IIS servers should urgently review exposure, hunt for the listed tools and indicators, and verify that endpoint protection, backups, and lateral-movement controls are working.

Canada’s signals intelligence agency says it carried out state-authorized hacks in 2025 against a ransomware-as-a-service gang, foreign fentanyl-chemical traffickers, and a violent extremist group. In its annual report, the Communications Security Establishment said one operation made the ransomware gang’s infrastructure inoperable and deleted stolen data being advertised on the dark web, and that it also conducted 10 additional technical disruptions against major ransomware gangs last year. The specific groups, malware, and infrastructure were not named. — This is a rare public acknowledgment that a government agency directly disrupted criminal cyber infrastructure rather than only warning about it. Defenders should watch for follow-on disclosures about which ransomware groups were hit, because that could affect threat tracking, infrastructure blocklists, and victim-notification efforts.

Microsoft says a threat actor has used a destructive Windows backdoor called GigaWiper for more than eight months to maintain access and sabotage infected systems. First seen in October 2025, the Go-based malware combines older wiping components with backdoor functions, supports command-and-control through RabbitMQ and Redis, and can run PowerShell, upload files, take screenshots, record screens, trigger a Blue Screen of Death, encrypt files in both reversible and destructive modes, and wipe disks at the physical-drive level. — This is not just another infostealer or ransomware sample: it gives attackers a single tool for stealthy access and for crippling machines on demand. Defenders should hunt for the malware’s persistence and command-and-control activity, especially RabbitMQ, Redis, MinIO Client, and destructive commands, because the impact can range from spying to irreversible data loss.

A former ransomware negotiator at DigitalMint was sentenced after prosecutors said he secretly helped BlackCat ransomware attacks against U.S. organizations. Court records say Angelo Martino worked with two other former DigitalMint and Sygnia negotiators as BlackCat affiliates between April 2023 and April 2025, demanded payments, threatened to leak stolen data, and shared victims’ insurance limits and negotiation positions with the gang to maximize ransom demands. — This matters because it shows attackers can exploit trusted insiders at companies hired to help victims during ransomware crises. Organizations using outside negotiators or incident-response firms should review access, logging, conflict controls, and what sensitive insurance and negotiation data those vendors can see.

Latvia's state-owned forestry company LVM is still restoring systems weeks after a ransomware attack knocked customer and contractor services offline. Latvian authorities said the attackers likely spent more than a week in the network and exploited an unpatched vulnerability in software that had not been updated for two years. CERT.LV said about 44 GB of data was leaked, including internal documents, email, code repositories, digital certificates, cryptographic keys, and user credentials. — This is a significant ransomware and data-theft incident affecting a major state-owned enterprise, with possible downstream risk from leaked credentials and cryptographic material. Organizations in Latvia, especially public-sector and state-linked entities, should review exposure, rotate affected secrets and certificates, and urgently patch internet-facing systems.

Mount Royal University in Calgary says hackers broke into its network, stole files from a shared storage drive used by students and staff, and deleted data from university systems. The university says the June 17 attack disrupted online services, internet access, and internal systems; data was confirmed stolen from certain folders on its H drive, while a separate J drive holding departmental data was wiped, with no current evidence it was copied first. The CMD Organization extortion group claimed the attack, published sample files including passport scans, and demanded 30 bitcoin. — Students, employees, and former staff may face identity and privacy risks, while the university may lose some data permanently. Affected people should watch for direct breach notices and consider credit and identity monitoring; defenders in education should review file-share access, backup resilience, and extortion response plans.

A 19-year-old accused Scattered Spider member was extradited from Finland to the United States to face charges tied to hacking and extortion. The FBI says Peter Stokes helped breach an unnamed luxury jewelry retailer around May 12, 2025 by calling the IT help desk from Google Voice numbers, posing as employees, and getting password and multifactor authentication resets; the attackers allegedly compromised three accounts, including two IT administrator accounts, used ngrok for persistent access, stole data, and demanded $8 million in cryptocurrency. — This matters because it gives defenders a concrete look at how Scattered Spider is still using help-desk impersonation to break into companies without exploiting software flaws. Organizations, especially those with privileged IT accounts, should harden help-desk identity checks, review MFA reset procedures, and monitor for unauthorized remote-access tools such as ngrok.

Researchers say an attacker used a large language model to automate a full ransomware and extortion attack against exposed servers, ending with encrypted and deleted data. Sysdig said the intrusion began by exploiting Langflow CVE-2025-3248, an unauthenticated remote-code-execution flaw, then moved to a production server running MySQL and Alibaba Nacos, abused Nacos CVE-2021-29441 and the product's default JWT signing key, added a backdoor admin, and encrypted 1,342 configuration records before dropping database schemas. — Organizations running internet-exposed Langflow or Nacos instances could face fast, destructive break-ins that do not reliably allow recovery even if a ransom is paid. Defenders should urgently patch or isolate exposed systems, rotate credentials, and check for cron-based persistence, rogue Nacos admins, and database tampering.

Check Point says code generated by DeepSeek can be adapted into a working browser-based ransomware attack that encrypts a victim’s local files after they approve a browser permission prompt. The sample, dubbed "InfernoGrabber 9000," is a Python Flask web app targeting Android users and abuses Chrome and Chromium-based browsers’ File System Access API to read and write local files without a traditional malware install, relying on phishing-style social engineering rather than a browser exploit or CVE. — This lowers the barrier for criminals to build ransomware-like attacks that run in the browser, where users may trust the prompt because it comes from a legitimate browser feature. Defenders should review controls around Chromium-based browsers and file-access permissions, and users should be wary of websites asking for broad local file access.

Nidec says a ransomware attack hit part of the server environment at its Taiwanese subsidiary, Nidec Chaun Choung Technology, and the attackers are now demanding $2 million. The company said the June 22, 2026 incident led it to shut down the affected server and network to contain the damage and that it is investigating possible data leakage and any effect on production and shipping. Blackfield claims it stole data and threatened to publish or sell it if Nidec does not negotiate. — This is a disruption and extortion risk for a large global manufacturer whose products feed automotive, computing, robotics, and other supply chains. Organizations connected to Nidec should watch for follow-on fraud or leaked documents, while manufacturers should review ransomware containment, segmentation, and backup recovery plans.

Arctic Wolf says multiple 2026 Anubis ransomware attacks began with either stolen VPN credentials or exploitation of CitrixBleed 2, putting organizations with exposed Citrix access at risk. The report ties Anubis intrusions to CVE-2025-5777 in Citrix NetScaler, then details follow-on use of legitimate remote management tools including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, plus cloudflared, authenticated proxies, and SSH SOCKS tunnels for persistence and lateral movement. — This matters because attackers are mixing a known edge-device flaw with normal-looking IT tools, making ransomware intrusions harder to spot until systems are already at risk. Organizations using Citrix remote access should patch and review VPN exposure, hunt for these remote admin tools, and closely monitor domain controllers, remote desktop servers, hypervisors, backup systems, and network storage.

A former Huntress employee publicly alleged that a current company insider passed information from U.S. law enforcement to a ransomware actor known as DevMan, potentially putting customers at risk. The claims center on an alleged December 2025 insider incident rather than Huntress's separate Klue-related exposure; Huntress said the matter involved an employee who showed poor judgment in communicating with a cybercriminal, and said it took the concerns seriously. The article does not provide technical indicators, affected customer count, or independent confirmation from law enforcement. — If true, this would be a serious insider-threat case at a security vendor, with possible exposure of investigative information and downstream risk to customers. Defenders should watch for confirmation, assess any Huntress notifications, and treat this as a potential trust and supply-chain concern rather than a proven breach at this stage.

CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on May 20, 2026, citing evidence of active exploitation. The additions include legacy Microsoft Windows, DirectX, Internet Explorer, and Adobe Reader bugs, plus Microsoft Defender flaws CVE-2026-41091 (elevation of privilege) and CVE-2026-45498 (denial of service). Federal agencies must remediate by the deadlines set under BOD 22-01. — KEV additions indicate real-world exploitation and help defenders prioritize patching and mitigations. Organizations, especially federal agencies, should urgently assess exposure to the newly listed Microsoft Defender and legacy Windows-related vulnerabilities.

A Microsoft Defender security flaw was exploited before a patch was available, and U.S. officials now say ransomware attackers used it in real intrusions. The bug, tracked as BlueHammer and CVE-2026-33825, is a local privilege-escalation flaw in Microsoft Defender; it was publicly disclosed on April 2, patched on April 14, added to CISA’s Known Exploited Vulnerabilities catalog on April 22, and CISA has now updated that entry to specify ransomware use. Huntress said it observed zero-day exploitation before Microsoft released fixes. — Organizations using Windows systems with Microsoft Defender should treat this as a high-priority post-zero-day issue and verify patching immediately. The new ransomware tie raises the urgency because attackers used the flaw to gain higher privileges that can help them take over systems and deploy follow-on malware.

Researchers say a newly identified backdoor called Mistic is being used to quietly keep access inside company networks in attacks tied to KongTuke, an initial access broker linked to ransomware groups. Symantec says Mistic has been used since April 2026 against organizations in insurance, education, IT, and professional services, including deployment after ModeloRAT in at least one case. The malware is side-loaded through MpExtMs.exe and a malicious version.dll, can run payloads in memory, steal credentials via a fake login prompt, and receive commands from attacker-controlled servers; Zscaler says it also appeared in a multi-stage ClickFix infection chain and can load Beacon Object Files for in-memory post-exploitation. — Organizations in the named sectors may be facing a low-visibility foothold used to prepare ransomware attacks, not just one-off malware infections. Defenders should hunt for KongTuke and ClickFix activity, review Symantec and Zscaler indicators, and watch for suspicious DLL side-loading, fake login prompts, and Microsoft Teams-based social engineering.

Attackers used a fake Microsoft Edge update process to trick employees into installing a malicious browser extension that helped deploy malware on their computers. Zscaler says the 'Edgecution' campaign starts with Microsoft Teams messages from fake IT support and uses Chrome Native Messaging in Microsoft Edge to let the extension communicate with a local Python-based backdoor outside the browser sandbox. The activity is linked by tactics and infrastructure patterns to an initial access broker associated with the Payouts Kings ransomware operation. — This matters because it turns a browser extension into a bridge for full system compromise, not just in-browser abuse, and it is being used in real ransomware-linked intrusions. Organizations should warn users about fake IT support messages, restrict extension installs, and monitor or lock down Native Messaging host configurations on managed endpoints.

Indian vehicle maker Bajaj Auto disclosed that a ransomware attack hit its operations and also affected Bajaj Auto Technology Limited. In a regulatory filing, the company said it detected the incident on June 24, 2026, took containment steps, and brought in cybersecurity experts; it has not yet named the threat actor, said whether data was stolen, or disclosed any ransom demand. — This is a live disruption at one of India’s largest manufacturers, so suppliers, employees, and customers may face operational delays while the scope is still unclear. Manufacturers and partners should watch for follow-up notices, be alert for extortion or phishing tied to the incident, and review exposure if they connect systems or data with Bajaj Auto.

Researchers say a new ransomware group called Prinz Eugen is breaking into organizations and encrypting their newest or most recently changed files first to increase pressure to pay. ThreatDown says the operators appear to use stolen Remote Desktop Protocol (RDP) credentials, legitimate remote monitoring and management tools such as RemotePC, and hands-on-keyboard activity. The Go-based encryptor uses ChaCha20-Poly1305, appends a .prinzeugen extension, may delete originals after verifying decryption works, and currently shows at least several known victims, including a reported Standard Bank incident. — Organizations with exposed or weakly protected remote access are at risk, especially if attackers can reuse stolen credentials and blend in with legitimate admin tools. Defenders should review RDP exposure, audit remote-management tool use, hunt for the listed indicators of compromise, and watch for unusual admin account creation.

A cyberattack forced Mackay Sugar, one of Australia's largest sugar producers, to shut down two mills in Queensland and stop sugarcane harvesting in the Mackay region. The company said the incident affected parts of its operations and that cybersecurity experts and authorities are investigating while systems are restored. No ransomware claim, data-theft disclosure, or technical details about the intrusion method have been confirmed yet. — This is a real-world operational technology and business disruption incident affecting food production and local growers, not just office IT. Organizations in agriculture and other industrial sectors should review incident response plans, segmentation between business and plant systems, and contingency procedures for outages.

DragonForce ransomware operators used Microsoft Teams network relays to disguise malware communications during an attack on a major U.S. services company. Symantec says the attackers deployed a custom Go-based backdoor called Backdoor.Turn that abused Teams' TURN relays (servers that help route traffic when direct connections fail) to mask command-and-control traffic as Microsoft activity. The December 2025 intrusion also used bring-your-own-vulnerable-driver tactics, including HWAuidoOs2Ec.sys, wsftprm.sys (CVE-2023-52271), GameDriverx64.sys (CVE-2025-61155), and K7RKScan.sys (CVE-2025-1055), before data theft and ransomware deployment. — This matters because defenders may see the malware's traffic as legitimate Microsoft Teams activity, making detection and blocking harder during a ransomware attack. Organizations should review Microsoft Teams-related network trust assumptions, hunt for the listed indicators, and prioritize controls against driver-based security-tool tampering and suspicious use of SQL/MSSQL servers.

Authorities say they shut down AudiA6, a cryptocurrency laundering service allegedly used by ransomware groups and other cybercriminals to wash more than $380 million. Europol said the operation was linked to more than 15 ransomware and large-scale crypto-theft investigations, while arrests in Georgia and earlier evidence from a 2025 arrest in Poland helped identify administrators, seize 25 domains, freeze cryptocurrency, and recover about 6,000 know-your-customer identity records tied to mule accounts. — This matters because ransomware profits only scale when criminals can cash out, and AudiA6 allegedly served as a central laundering hub for that process. Crypto platforms, investigators, and organizations tracking extortion activity should watch for related wallet exposure and mule-account abuse, while victims may gain new leads tying attacks to payment flows.

Mid and South Essex NHS Foundation Trust says the 2024 Qilin ransomware attack on pathology provider Synnovis exposed about 2,380 records tied to specialist diagnostic testing, and the total may rise as records are matched to individual patients. The incident is the same long-running data theft and service-disruption event that hit NHS pathology services in southeast London on June 3, 2024; patient data was later published after failed extortion, and affected trusts are still identifying who must be notified. — This shows the fallout from a major healthcare ransomware breach is still growing years later, with more patients and hospitals discovering exposed records. Affected NHS organizations need to keep tracing exposed data and notifying people, while patients contacted about past diagnostic testing should treat breach notices seriously and watch for scams or misuse of their information.

A ransomware attack forced Evanston Township High School in Illinois to close for at least two days, canceling summer school, sports camps, and other on-campus activities. The school said phone systems are down and staff have limited access to email, Google accounts, and other network systems including eSchool. External forensics specialists and breach counsel were engaged, and the FBI is involved. No ransomware group has publicly claimed responsibility yet. — This is a real-world operational disruption affecting students, families, and staff, not just an IT outage. Schools and local governments should review incident response readiness, offline recovery options, and communications plans, while affected families should watch for follow-up notices about any data exposure.

The FBI says Silent Ransom Group is targeting U.S. law firms by pretending to be IT support, then stealing data and extorting victims without encrypting files. In 2026 attacks, the group reportedly used callback phishing emails, phone-based social engineering, remote desktop access, and in some cases sent an operative on site to insert a USB or external drive after a failed remote-access attempt; the attackers then used tools such as WinSCP and Rclone to exfiltrate data. — Law firms and other organizations should treat unsolicited IT calls, emails, and in-person support visits as potential attack vectors, not just remote phishing. The warning is urgent because the attackers use legitimate admin tools and leave few traces, so organizations should verify IT identities, restrict external-drive use, and harden remote-access workflows now.

Sophos says it found a ransomware attack toolkit in a customer environment that was built with help from AI coding agents and used to hide from security software and map a victim's Windows network. The framework included Cobalt Strike traffic-masking profiles, Telegram-based command and control, a Cloudflare Worker redirector, and Python tools that generated Rust and Go payloads for evasion and execution. Sophos found operator logs referencing a ransom note and organizations listed on a ransomware leak site, indicating criminal use rather than legitimate red-team testing. — This shows AI tools are being used to speed up real ransomware tradecraft, especially defense evasion and internal network discovery. Defenders should review detections for Telegram and Cloudflare-backed command channels, unusual payload loaders, and suspicious Active Directory reconnaissance, and treat AI-assisted malware development as an operational threat rather than a theory.

The U.S. sanctioned Nobitex, Iran’s largest cryptocurrency exchange, saying it helped process transactions tied to ransomware actors and Iran’s Islamic Revolutionary Guard Corps. The Treasury’s Office of Foreign Assets Control also designated Nobitex executives and targeted other Iranian exchanges including Wallex, Bitpin, and Ramzinex as part of its "Economic Fury" campaign, alleging sanctions evasion and terrorist-financing support rather than a software flaw or CVE-tracked vulnerability. — This matters because ransomware groups and state-linked actors depend on payment channels to move money, and sanctions can disrupt those routes while raising compliance risk for exchanges, companies, and users who interact with them. Organizations handling crypto exposure should review sanctions screening and watch for links to designated wallets and entities.

IMA Diligence Services says attackers stole sensitive personal data from a legacy server managed by a third party, affecting 525,306 people. The company says the intruders accessed the server between December 8 and December 16 and exfiltrated files containing names, addresses, Social Security numbers, driver's license numbers, financial account and credit card data, medical and health insurance information, and in some cases passport and taxpayer ID numbers. SecurityWeek says the Genesis ransomware group previously claimed the attack and said it stole 700 GB of data. — This is a high-impact breach because it exposed the kinds of data that can be used for identity theft, fraud, and medical or financial scams. Affected people should watch for the company's notice, enroll in credit monitoring, and consider fraud alerts or account monitoring, while defenders should review third-party legacy systems and data-retention exposure.

Play ransomware operators have posted MyPillow to their leak site, claiming they stole sensitive internal data and will publish it if the company does not pay. According to the gang’s dark-web extortion post, the alleged haul includes personal and confidential data, client documents, budgets, payroll records, IDs, tax files, and finance information. The article does not provide technical details on the intrusion method, affected systems, or data volume, and MyPillow had not confirmed the breach at publication time. — If the claim is accurate, employees, customers, and business partners could face privacy risks, fraud, or follow-on phishing using stolen records. Defenders should watch for confirmation, review for signs of Play ransomware activity, and prepare incident-response, notification, and credential-reset steps if exposure is verified.

ReliaQuest and SonicWall say attackers exploited CVE-2024-12802 on SonicWall Gen6 SSL-VPN appliances to bypass MFA when admins installed patched firmware but did not complete required LDAP reconfiguration steps. Intrusions observed from February to March involved brute-forced credentials, internal reconnaissance, RDP access, and attempted deployment of Cobalt Strike and a BYOVD tool across multiple sectors and geographies. — Organizations using SonicWall Gen6 SSL-VPN may still be exposed even if they believe they are patched, because firmware updates alone do not fully mitigate the flaw. Defenders should verify the manual remediation, hunt for listed indicators, and treat exposed Gen6 devices as potentially compromised.

Microsoft said it seized domains and hundreds of VMs tied to Fox Tempest, a criminal service that abused Microsoft Artifact Signing using more than 580 fraudulent accounts created with fake identities. The operation allegedly sold code-signing certificates used to sign malware including Oyster, Lumma, Vidar, and Rhysida, and was linked to ransomware actors including Vanilla Tempest as well as INC, Qilin, and Akira affiliates. — Trusted code-signing helps malware bypass user suspicion and some security controls, so this service likely enabled broader, more effective intrusions. Defenders should review detections and hunting for suspicious signed binaries and malware families named by Microsoft.