ransomware

2 Cyber Pros Admit to Being BlackCat Ransomware Affiliates

,

Two cybersecurity professionals, Ryan Goldberg and Kevin Martin, pleaded guilty to being affiliates of the BlackCat ransomware gang. They extorted at least five U.S. companies, including a medical device maker, earning $1 million. Both men, along with a third unnamed co-conspirator, used their expertise to commit these attacks while employed at cybersecurity firms.

https://www.databreachtoday.com/2-cyber-pros-admit-to-being-blackcat-ransomware-affiliates-a-30415

Interpol-led Action Decrypts 6 Ransomware Strains, Arrests Hundreds

Operation Sentinel, led by Interpol, arrested 574 individuals and recovered $3 million tied to cybercrimes across 19 countries, deactivating over 6,000 malicious links and decrypting six ransomware strains. The initiative highlights increasing cyber threats, with significant cases in Senegal, Ghana, Benin, and Cameroon reflecting joint international law enforcement efforts.

https://www.bleepingcomputer.com/news/security/interpol-led-action-decrypts-6-ransomware-strains-arrests-hundreds/

CISA Loses Key Employee Behind Early Ransomware Warnings

,

CISA's ransomware warning program, crucial in preventing $9 billion in damages, is jeopardized after its lead, David Stern, resigned rather than accept a reassignment. His departure raises concerns about the program's future and relationships with stakeholders, as it heavily depended on his connections and expertise. CISA asserts that the program continues, but its effectiveness may diminish without Stern's leadership.

https://www.cybersecuritydive.com/news/cisa-ransomware-warning-program-key-employee-left/808589/

From Linear to Complex: An Upgrade in RansomHouse Encryption

,

RansomHouse, a ransomware-as-a-service (RaaS) by Jolly Scorpius, has upgraded its encryption methods from simple to complex strategies, affecting at least 123 victims across critical sectors. The operation employs a double extortion tactic, combining data theft with ransom demands. Its attack chain involves four key phases: Develop, Infiltrate, Exfiltrate & Deploy, and Extort. Tools used include MrAgent, for managing systems, and Mario, the encryptor, which targets VMware environments. The upgraded Mario encryption method is significantly more sophisticated, enhancing operational disruption for victims.

https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/

Defensible by Design: Ransomware and Cybersecurity in 2026

,

Ransomware is now a major concern for organizations, affecting strategy and leadership. CISOs face increasing pressure as ransomware evolves, requiring adaptability and focus on defensible, resilient systems over security illusions. Leadership development should involve real incident experiences and business-focused training. Traditional security budgets are insufficient, pushing for a shift towards recoverability and flexible response strategies. Investors now consider cybersecurity a key factor in funding decisions, linking security posture directly to organizational value. In 2026, success for CISOs will hinge on their ability to withstand and quickly recover from ransomware incidents.

https://www.halcyon.ai/blog/defensible-by-design-ransomware-and-cybersecurity-in-2026

The Hidden Risk in Virtualization: Why Hypervisors Are a Ransomware Magnet

, ,

Hypervisors, critical for virtual environments, are increasingly targeted by ransomware, particularly the Akira group. Attacks can risk numerous VMs simultaneously due to limited security visibility. Effective defenses include robust access controls, multi-factor authentication, hypervisor hardening, regular patching, and effective backup strategies. Organizations should also enhance monitoring for anomalous activities to detect potential breaches early and prepare for recovery scenarios, emphasizing a holistic security approach to protect hypervisors from escalating ransomware threats.

https://www.bleepingcomputer.com/news/security/the-hidden-risk-in-virtualization-why-hypervisors-are-a-ransomware-magnet/

New DroidLock Malware Locks Android Devices and Demands a Ransom

,

New DroidLock malware targets Android users, locks screens for ransom, and can access personal data. It spreads via fake apps, gaining permissions to control devices. It can wipe data, change passwords, and threaten file destruction. Android users are advised to avoid sideloading apps and check permissions.

https://www.bleepingcomputer.com/news/security/new-droidlock-malware-locks-android-devices-and-demands-a-ransom/

Ransomware IAB Abuses EDR for Stealthy Malware Execution

, ,

Ransomware group Storm-0249 exploits EDR tools like SentinelOne to stealthily execute malware. Using social engineering, they trick users into running malicious commands that lead to DLL side-loading, making attacks appear as normal EDR processes, thus evading detection. Recommendations include behavior-based detection and stricter controls on execution of potentially harmful commands.

https://www.bleepingcomputer.com/news/security/ransomware-iab-abuses-edr-for-stealthy-malware-execution/

FinCEN Says Ransomware Gangs Extorted Over $2.1B From 2022 to 2024

,

FinCEN reports ransomware gangs extorted over $2.1 billion from 2022 to 2024, peaking in 2023 with 1,512 incidents and $1.1 billion in payments. A decline in 2024 saw 1,476 incidents and $734 million in payments, attributed to law enforcement actions against gangs like BlackCat and LockBit. The manufacturing, financial services, and healthcare sectors were most affected, with these industries suffering significant losses. Over 267 ransomware families were identified, with Akira being the most reported. Majority of payments were made in Bitcoin (97%).

https://www.bleepingcomputer.com/news/security/fincen-says-ransomware-gangs-extorted-over-21b-from-2022-to-2024/

The Golden Scale: ‘Tis the Season for Unwanted Gifts

,

SLSH (Scattered LAPSUS$ Hunters) has resumed activities with claims of accessing Salesforce data through a Gainsight breach, threatening to leak information and demanding ransom before a self-imposed deadline. Their new ransomware, “ShinySp1d3r,” currently targets Windows, with plans for broader compatibility. Additionally, there are reports of insider recruitment attempts and involvement in significant data theft on a large scale. With a volatile holiday season approaching, cybersecurity vigilance is critical as SLSH escalates their threats, fostering concerns for various organizations.

https://unit42.paloaltonetworks.com/new-shinysp1d3r-ransomware/

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’

,

Rey, admin of the notorious cybercriminal group “Scattered LAPSUS$ Hunters” (SLSH), has been identified following an interview where he confirmed his real identity. SLSH, comprising three hacking groups, has extorted major corporations through social engineering, including companies like Toyota and FedEx. Rey previously managed data leak operations for other ransomware groups and recently launched a new ransomware service called ShinySp1d3r. Despite initially engaging in cybercrime, Rey, now 15, claims to be trying to distance himself from the criminal activities and has communicated with law enforcement about his involvement. His digital footfalls, however, led to his identification.

https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/

Ransomware’s Fragmentation Reaches a Breaking Point While LockBit Returns

,

Ransomware landscape in Q3 2025 shows record fragmentation with 85 active groups and 1,590 victims. Despite law enforcement efforts, smaller, decentralized operations have emerged post-takedowns, reducing credibility in ransom payments. New brands like LockBit 5.0 highlight a potential return to centralization, increasing operational scale and trust. Ransomware tactics are evolving, making traditional tracking methods ineffective; analysts now need to monitor affiliate behavior and economic motivations to navigate the changing ecosystem.

https://thehackernews.com/2025/11/ransomwares-fragmentation-reaches.html

Violent Cybercrime Surges in Europe Amid Big Payouts

, ,

Cybercriminals in Europe are increasingly engaging in violent tactics, with 18 reported incidents in 2025, predominantly in France. This surge, termed “violence as a service,” includes high-profile cases like the kidnapping of Ledger co-founders. The UK remains the most targeted country for cybercrime, with over 2,100 attacks recorded since 2024, primarily from ransomware and data theft groups. The rise in violence is linked to organized networks that facilitate traditional cybercrime and physical theft, especially concerning cryptocurrency.

https://www.theregister.com/2025/11/04/cybercriminals_increasingly_rely_on_violence/

Ransomware Hackers Look for New Tactics Amid Falling Profits

,

Ransomware profits are down, forcing cybercriminals to adopt new tactics to demand payment, including bribing insiders and using social engineering techniques such as callback phishing. Fewer organizations are paying ransoms, and the average payment has dropped significantly. This has fragmented the ransomware ecosystem, with smaller groups targeting industries and regions that weren’t previously affected. Attackers now focus on recruiting insiders, directly contacting executives with ransom demands, and exploiting supply chains. Enterprises should become more vigilant against internal threats as hackers adapt their techniques to make up for lost earnings.

https://www.databreachtoday.com/ransomware-hackers-look-for-new-tactics-amid-falling-profits-a-29867

Scroll to Top