FBI and CISA warn SafePay ransomware has hit at least 600 organizations. Learn how the group attacks networks and what security teams can do to prevent…
Tag: ransomware
PwC Data Breach Claim – Everest Ransomware Group Claims to Have Stolen 590 GB of Data
The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, the global professional services firm. This alleged data theft includes…
PwC Allegedly Hit by Everest Ransomware Group, 590GB of Data Stolen
The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns…
Risky Bulletin: Supply chain attack lets ransomware group inside 40 shipping companies
A ransomware group used a supply chain compromise to hack around 40 shipping companies, the Pentagon assembles a technology sabotage unit, PHP2Shell…
PLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers
Guardicore Labs uncovers a Ransomware detection campaign targeting MySQL servers. Attackers use Double Extortion and publish data to pressure victims.
Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site
On 30 September 2026, law enforcement took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorised access.…
FBI Flags SafePay Ransomware as One of 2026’s Most Active Threats After 600 Victims
The FBI, alongside cybersecurity authorities in Germany and the United Kingdom, issued a joint advisory this week warning that a ransomware group called…
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
The group has been linked to a 2025 attack targeting technology firm Ingram Micro.
Ransomware Gangs Exploit GlobalProtect VPN Flaw — What to Check
Ransomware groups exploit a GlobalProtect VPN vulnerability to reach enterprise systems. Here’s what security teams should investigate.
INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages
SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen…
Qilin ransomware suspect arrested; linked to Synnovis hack
German law enforcement has arrested a 28-year-old Russian national suspected of playing a key role in the Qilin ransomware operation.
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks – and both are evolving their tactics in an attempt to outdo one another
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials…
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations…
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA,…
Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June
Unit 42 investigates network compromises across numerous industries
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by…
Ransomware groups expand targeting of Palo Alto Networks vulnerability
Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal.
PLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers
Guardicore Labs uncovers a Ransomware detection campaign targeting MySQL servers. Attackers use Double Extortion and publish data to pressure victims.