Stories tagged “Ransomware.”
30 stories
A suspected ransomware affiliate, operating as "Ransom Busters," is contacting victims before attacks become public, falsely claiming to be a recovery firm that can provide decryption keys and delete stolen data for a fee.
CISA, HHS, and FBI reported that the Medusa ransomware gang has breached over 500 critical infrastructure organizations in the United States since June 2021, an increase from a previous report.
A sophisticated JavaServer Pages (JSP) web shell, attributed to the Clop ransomware group, has been discovered targeting PTC Windchill and FlexPLM servers, designed to decrypt credentials and exfiltrate engineering data.
A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are exploiting a high-severity Windows Task Host vulnerability. The vulnerability, tracked as CVE-2025-60710, allows local attackers with basic user permissions to gain SY…
Philips and General Electric (GE) are investigating claims that the Clop ransomware gang breached their systems and stole data. The Clop gang has listed the companies on its leak site as part of a batch of 43 new victims likely targeted in data theft attacks.
A suspected Chinese-speaking APT is mass-exploiting a critical Broadcom VMware vCenter directory-traversal flaw (CVE-2026-59310, CVSS 9.8) to plant backdoors and stage ransomware across 361 victims in 47 countries.
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt. The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA).
The White House has signed a national security presidential memorandum that enables private security companies to apply for approval to hack foreign cybercrime organizations. The program will be overseen by executive directors designated by the Justice and Homeland Securi…
The best antivirus software to protect your computer in 2026
ZDNET experts put every product through rigorous testing and research to curate the best options for you. Our favorite antivirus software protects your PC, laptop, and mobile devices from malware without costing a fortune.
A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021.
Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his role in ransomware attacks against at least 18 companies worldwide.
The INC Ransomware operation has emerged as the dominant threat actor exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. Fixes for the vulnerability pair were released by SonicWall in mid-July 2026.
Coca-Cola has confirmed that hackers stole data from its dairy subsidiary, Fairlife, during a ransomware attack earlier this month. The company says it is still working to restore some of the impacted systems and operations, but most of the production in the U.S. has been…
Threat actors linked to the Cl0p ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign.
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims.
Cisco Talos details msaRAT, a Rust implant used by the Chaos ransomware group that drives headless Chrome or Edge over the Chrome DevTools Protocol to relay C2 traffic through a Twilio WebRTC TURN channel, hiding the attacker's server from defenders.
Swiss rail giant Stadler has rejected a $12.3 million ransom demand from the Everest ransomware gang after a cyberattack. The hackers stole technical information from a supplier, but no personal data was compromised. Stadler's global production continues as normal.
Enterprise GenAI can amplify ransomware risk by accelerating attacks, but proper governance can contain it. AI assistants and agents inherit identities and permissions, making them vulnerable to attacks.
The Anubis ransomware gang has claimed responsibility for the cyberattack on Coca-Cola's Fairlife dairy subsidiary, threatening to publish allegedly stolen corporate data unless the company pays a ransom.
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments.
The Qilin ransomware gang is exploiting a critical PAN-OS GlobalProtect authentication bypass flaw to breach victims' networks. Palo Alto Networks addressed the vulnerability on May 13 and warned that attackers had begun abusing it to breach corporate networks.
Researchers have identified ENCFORGE, a new Go ransomware deployed by the JADEPUFFER operator, specifically targeting AI model files and training datasets after exploiting a critical remote code execution vulnerability in Langflow servers.
The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints.
The UK has sentenced two hackers tied to a $115M crypto ransom scheme and a public transport breach. The pair pleaded guilty to their involvement in the Scattered Spider cybercrime group, which extorted dozens of companies.
Armenia has detained a Russian tourist named Aleksandr Ermakov on a U.S. extradition request for a REvil ransomware suspect. His lawyers claim that Washington has the wrong man.
Coca-Cola's dairy subsidiary, Fairlife, has suspended its U.S. operations following a ransomware attack that compromised parts of its systems, including production.
Coca-Cola has suspended production at its Fairlife dairy after a ransomware attack. The company's Fairlife production operations across the United States are 'temporarily suspended.'
Coca-Cola's Fairlife dairy subsidiary has been hit by a ransomware attack, disrupting US dairy production. The company has confirmed that production has been temporarily suspended while it responds to the incident and restores impacted systems.
A ransomware group has published nearly 19,000 files allegedly linked to the Kudankulam Nuclear Power Plant on the dark web after a partial data breach involving contractor Reliance Infrastructure. The leaked documents reportedly include facility blueprints, supplier deta…