When ransomware cripples a businessβs systems or stealthy malware slips past defenses, the first instinct is to get everything back online as quickly as possible. That urgency is understandable β Cybersecurity Ventures estimates ransomware damage costs $156 million per day. But businesses cannot let speed overshadow the more pressing need to understand exactly what happened,..
A newly discovered ransomware family, Osiris, targeted a major foodservice franchisee in Southeast Asia in November 2025. Despite sharing a name with a 2016 Locky ransomware variant, security researchers confirm this represents an entirely new threat with no connection to its predecessor. However, evidence suggests potential links to threat actors previously associated with Inc ransomware [β¦]
LockBit 5.0 affiliate panel provide unprecedented visibility into the infrastructure of one of the worldβs most notorious ransomware-as-a-service (RaaS) operations. Following the high-profile Operation Cronos disruption, security researchers have confirmed that LockBit has largely maintained its core operational procedures. However, cosmetic updates including holiday-themed interface elements suggest active development and continued operations. The leaked materials [β¦]
A sophisticated campaign has weaponized over 2,500 variants of a legitimate security driver to disable endpoint protection before deploying ransomware and remote access trojans. Attackers are abusing truesight.sys, a kernel-mode driver from Adlice Softwareβs RogueKiller antivirus suite. The legacy version 2.0.2 contains a critical vulnerability allowing arbitrary process termination via IOCTL command 0x22E044. This enables [β¦]
The leaks tied to the BlackBasta ransomware group and Russian hosting company Media Land pulled back the curtain on something defenders rarely get to see: the internal machinery and people behind a major ransomware operation. In February 2025, an unknown individual using the handleΒ ExploitWhispersΒ appeared on Telegram and published a massive archive of BlackBastaβs internal chats [β¦]
In a report a week before its Davos conference, the World Economic Foundation said 64% world business leaders are most worried about cyber fraud, replacing ransomware at their top concern. AI vulnerabilities also ranked high, as did threats fueled by geopolitics. The group argued that a coordinated approach to cybersecurity is needed.
Security researchers have published an inβdepth technical analysis of the DragonForce ransomware operation, along with details of working decryptors for both Windows and ESXi systems targeting specific victims. By the time its dedicated Data Leak Site (DLS) was identified later that month, 17 victim organizations had already been listed. DragonForce markets itself as a cartel [β¦]
Large language models are not fundamentally transforming ransomware operations. However, they are dramatically accelerating the threat landscape through measurable gains in speed, volume, and multilingual capabilities. According to SentinelLABS research, adversaries are leveraging LLMs across reconnaissance, phishing, tooling assistance, data triage, and ransom negotiations creating a faster, noisier threat environment that demands immediate defender adaptation. [β¦]
Everest ransomware claims to have breached Nissan Motor Corporation, alleging the theft of 900GB of internal data, including documents and screenshots.
UH officials refused to provide key information, including which cancer research project had been affected or how much UH paid the hackers to regain access to files.
Arctic Wolf Labs has uncovered a new ransomware variant dubbed βFogβ striking US organizations, primarily in education and recreation, through hijacked VPN access. First spotted on May 2, 2024, the attacks highlight vulnerabilities in remote access tools and the rapid encryption tactics used to exploit them.β Arctic Wolfβs Incident Response team investigated multiple cases starting [β¦]