SOCRadar researchers uncovered a sophisticated ransomware operation in late September 2026 after discovering an exposed command-and-control server that…
Tag: ransomware
Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site
On 30 September 2026, law enforcement took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorised access.…
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. Detectives have linked the man…
FBI Warns SafePay Ransomware Has Hit 600+ Organizations: Here’s What We Know
FBI and CISA warn SafePay ransomware has hit at least 600 organizations. Learn how the group attacks networks and what security teams can do to prevent…
Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups
A ransomware operation known as The Gentlemen is using a mix of security tampering, service disruption and file encryption to make recovery harder for…
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
The group has been linked to a 2025 attack targeting technology firm Ingram Micro.
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages
SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen…
Qilin ransomware suspect arrested; linked to Synnovis hack
German law enforcement has arrested a 28-year-old Russian national suspected of playing a key role in the Qilin ransomware operation.
Gentlemen Ransomware Hackers Hijack Legitimate Lenovo Drivers to Disable Security Software
The Gentlemen ransomware operation is abusing legitimate Lenovo and Safetica kernel drivers to terminate security software, weakening endpoint defenses…
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks – and both are evolving their tactics in an attempt to outdo one another
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into…
SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers
SafePay ransomware has affected at least 600 separate victims across multiple critical infrastructure sectors, according to a joint government advisory…
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations…
CISA Warns SafePay Ransomware Has Hit 600+ Organizations and Destroyed Backup Systems
CISA has warned that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors, combining data…
INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds
Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. The…
Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June
Unit 42 investigates network compromises across numerous industries
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by…
Ransomware groups expand targeting of Palo Alto Networks vulnerability
Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal.