Ransomware · News & analysis
SafePay Advisory Puts Backup Administration Inside the Ransomware Threat Model
An international advisory describes attacks on recovery infrastructure, giving businesses a concrete test for who can alter their backups.
NEWS · ALERTS · RESEARCH
Ransomware
Original cybersecurity reporting and practical analysis, alongside headlines from trusted publications, agencies and researchers.
Original reporting & analysis
Ransomware · News & analysis
Ransomware Investigations Trace a Route From VPN Access to Virtual Servers
Unit 42’s October update makes virtualization management a necessary part of investigating affected GlobalProtect gateways.
Ransomware · News & analysis
Anne Arundel Separates Two Data-Theft Investigations as Criminal Claims Surface
The county’s October update distinguishes an earlier notification process from a separate 2026 intrusion.
Ransomware · News & analysis
Ransomware Response Plans Face a Human Test as Staff Threats Escalate
Semperis’s new victim survey highlights intimidation, putting employee support and escalation procedures alongside technical recovery.
Ransomware · News & analysis
Record Ransomware Claims Demand Careful Reading—and a Recovery Test
Comparitech’s third-quarter report separates confirmed incidents from unverified claims, a distinction that matters when businesses turn threat statistics into spending decisions.
Ransomware · News & analysis
MonsterCloud Charges Put Ransomware Recovery Promises Under Scrutiny
Federal prosecutors allege that a recovery provider secretly paid attackers while selling clients a different explanation.
Ransomware · News & analysis
Warlock Intrusions Put Domain-Wide Recovery Plans to the Test
New Symantec and Carbon Black research traces ransomware activity from SharePoint access to the systems used to distribute software across an organization.
Ransomware · News & analysis
Ransomware Recovery Plans Need an Answer for Stolen Data
New Zscaler findings distinguish the growth of stolen data from victim counts—and show why a successful restore cannot settle every extortion incident.
Ransomware · News & analysis
Ryuk Sentencing Puts the Long Tail of Ransomware Recovery in Focus
A federal sentence tied to attacks in 2019 and 2020 illustrates why incident records can matter long after systems are restored.
Ransomware · News & analysis
The Ransomware Name Changes. The Intrusion Pattern May Not.
New research on Storm-2570 makes the case for investigating the behavior leading up to encryption, rather than waiting for a familiar ransom note.
Headlines from our sources
62 sourced updates · Publication dates or labeled coverage weeks shown · Read full coverage at the source
SecurityWeek
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison ↗
Industry newsDataBreaches.net
Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat ↗
Industry newsHelp Net Security
Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator ↗
Industry newsDataBreaches.net
Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses ↗
Industry news
SOCRadar
n0n Ransomware: Inside an AI-Assisted Extortion Operation ↗
ResearchThe Record
Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea ↗
Industry newsSOCRadar
September 2026: FBI Breach, Clop Hijack & IDScan Leak ↗
ResearchSOCRadar
PHP2Shell Weaponized After Japanese Real Estate Extortion ↗
ResearchHelp Net Security
Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack ↗
Industry newsHelp Net Security
71% of vulnerability exploitation starts within a week of disclosure ↗
Industry newsThe Hacker News
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware ↗
Industry newsThe Hacker News
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions ↗
Industry newsSecurityWeek
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware ↗
Industry newsSecurityWeek
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 ↗
Industry newsCISA News
CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors ↗
Agency · CISAInfosecurity Magazine
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy ↗
Industry newsHelp Net Security
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June ↗
Industry newsInfosecurity Magazine
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account ↗
Industry newsThe Record
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024 ↗
Industry newsFBI / IC3 Industry Alerts
#StopRansomware: SafePay Ransomware ↗
Agency · FBIDataBreaches.net
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA ↗
Industry newsThe Hacker News
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA ↗
Industry newsCISA Cybersecurity Advisories
#StopRansomware: SafePay Ransomware ↗
Agency · CISASOCRadar
INC and The Gentlemen Ransomware: Exposed AI Infrastructure ↗
ResearchKrebsOnSecurity
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site ↗
Industry newsDark Reading
When Your Ransomware Negotiator Works for the Other Side ↗
Industry newsThe Record
Baltimore suburb confirms August data breach after ransomware claims ↗
Industry newsInfosecurity Magazine
Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments ↗
Industry newsDark Reading
F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud ↗
Industry newsDataBreaches.net