Tag: ransomware

Cybersecurity agencies from South Korea and the United States have warned that Gunra ransomware operators are exploiting Fortinet and Schneider Electric vulnerabilities to compromise critical infrastructure organizations worldwide.

A newly unsealed U.S. court filing reveals how a persistent Windows device ID helped FBI connect an alleged Scattered Spider member to a cyber intrusion targeting a luxury jewelry retailer.

This week's cybersecurity roundup covers the disruption of the NetNut proxy botnet, AI driven attack techniques, browser based ransomware, phishing campaigns, malware activity, and critical vulnerabilities affecting organizations worldwide.

This ThreatsDay roundup covers ransomware phishing campaigns, sandbox escapes, Apple email vulnerabilities, Linux kernel privilege escalation flaws, AI compute hijacking, and large scale malware operations affecting enterprise and consumer systems worldwide.

A U.S. government entity reportedly paid $1 million to Kairos in a data theft extortion case involving stolen files, blockchain tracked payments, and encryption free ransomware tactics targeting sensitive county records.

Operation Endgame has disrupted the Amadey and StealC malware ecosystem, resulting in the takedown of 326 servers, 142 domains, recovery of 27 million stolen credentials, and restriction of more than $47 million in criminal cryptocurrency assets.

DragonForce ransomware operators have been linked to a new Go based remote access trojan called Backdoor.Turn that hides command and control communications through Microsoft Teams relay infrastructure, enabling long term stealthy access to victim networks.

Cybersecurity researchers have identified multiple ClickFix campaigns distributing malware loaders including BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, highlighting evolving attack techniques that leverage social engineering, compromised websites, and fake software updates.

A critical cPanel vulnerability CVE-2026-41940 is being actively exploited by threat actor Mr_Rot13 to deploy Filemanager backdoor, enabling credential theft, ransomware, botnet activity, and persistent system compromise across global infrastructure.

Instructure confirms an agreement with ShinyHunters following a Canvas breach involving 3.65TB of stolen data impacting nearly 9000 institutions, with threat actors leveraging a vulnerability to exfiltrate sensitive education records.

CISA has added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link routers to its KEV catalog, setting a May 2026 deadline for federal agencies to act.

CISA updates its Known Exploited Vulnerabilities catalog with eight new flaws, including Cisco SD WAN Manager issues, urging federal agencies to patch by April and May 2026.