AhnLab Archives • Daily CyberSecurity

Larva-26002 Threat Actor Escalates Attacks on MS-SQL Servers ICE Cloud Malware Larva-26002

Larva-26002 Threat Actor Escalates Attacks on MS-SQL Servers

Do Son March 25, 2026

The AhnLab Security intelligence Center (ASEC) has issued a fresh warning regarding the persistent threat actor known...

LockBit 5.0 Sustains Global Ransomware Dominance LockBit 5.0 Ransomware Ransomware-as-a-Service (RaaS)

LockBit 5.0 Sustains Global Ransomware Dominance

Do Son January 9, 2026

The hydra of the cybercrime world has grown another head. Since its emergence in late 2019, the...

Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics Gentlemen Ransomware, BYOVD Double Extortion

Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics

Do Son December 17, 2025

A sophisticated new ransomware operator has rapidly ascended the ranks of the cybercriminal underworld, targeting industries across...

Critical WSUS RCE (CVE-2025-59287) Actively Exploited to Deploy ShadowPad Backdoor Vulnerability Digest Zero-Day Exploits Seedworm APT Dindoor Backdoor RedKitten Campaign AI-Generated Malware WSUS RCE ShadowPad CVE-2025-59287

Vulnerability Digest Zero-Day Exploits Seedworm APT Dindoor Backdoor RedKitten Campaign AI-Generated Malware WSUS RCE ShadowPad CVE-2025-59287

Critical WSUS RCE (CVE-2025-59287) Actively Exploited to Deploy ShadowPad Backdoor

Do Son November 21, 2025

The AhnLab Security Intelligence Center (ASEC) has uncovered an active exploitation campaign in which threat actors weaponized...

LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’ LNK Stomping, MoTW Bypass

LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’

Do Son September 26, 2025

Windows shortcut files (.LNK) were designed to simplify user navigation, but for years, they’ve been a favorite...

Kawa4096: A New Ransomware Group with Akira-Style Branding and Qilin-Like Notes CVE-2024-22394

Kawa4096: A New Ransomware Group with Akira-Style Branding and Qilin-Like Notes

Do Son September 23, 2025

In June 2025, a new ransomware group known as Kawa4096 surfaced, launching disruptive attacks against multinational organizations...

BlackLock Ransomware: A New Cross-Platform Threat Spreading Rapidly

Do Son September 22, 2025

The AhnLab Security Intelligence Center (ASEC) has released a detailed analysis of BlackLock, a relatively new ransomware...

BlackNevas Ransomware: A Persistent Global Threat With Impossible-to-Decrypt Payloads INC Ransom Pacific Cyber Threats OysterLoader Malware Rhysida Ransomware Black Basta Ransomware BYOVD Technique Velociraptor Abuse, Storm-2603 Ransomware Crypto24, Ransomware Ransomware Payments, UK Legislation ZACROS data breach

INC Ransom Pacific Cyber Threats OysterLoader Malware Rhysida Ransomware Black Basta Ransomware BYOVD Technique Velociraptor Abuse, Storm-2603 Ransomware Crypto24, Ransomware Ransomware Payments, UK Legislation ZACROS data breach

BlackNevas Ransomware: A Persistent Global Threat With Impossible-to-Decrypt Payloads

Do Son September 12, 2025

AhnLab researchers have published a technical analysis of BlackNevas, a ransomware group that has been steadily launching...

CyberVolk Ransomware’s Decryption Flaw Makes Data Recovery Impossible The created ransom note

CyberVolk Ransomware’s Decryption Flaw Makes Data Recovery Impossible

Do Son September 11, 2025

AhnLab researchers have released an in-depth technical analysis of the CyberVolk ransomware, a strain that has been...

DireWolf: The New Ransomware Group Targeting Global Businesses DireWolf execution flow

DireWolf: The New Ransomware Group Targeting Global Businesses

Do Son September 4, 2025

The DireWolf ransomware group, first emerging in May 2025, has rapidly evolved into a formidable cyber threat...

Interlock Ransomware Strikes: A New Strain Is Wrecking Havoc in North America and Europe Interlock ransomware, double extortion

Interlock Ransomware Strikes: A New Strain Is Wrecking Havoc in North America and Europe

Do Son August 29, 2025

The AhnLab Security Emergency Response Center (ASEC) has published new research on the Interlock ransomware group, which...

The Underground Ransomware Gang Is Back with a Vicious New Global Campaign

Do Son August 27, 2025

The Underground ransomware gang is intensifying its operations, launching continuous ransomware attacks against companies worldwide, including high-profile...

GitHub Malware Campaign: SmartLoader Poses as Game Cheats to Steal Data SmartLoader, Malware

GitHub Malware Campaign: SmartLoader Poses as Game Cheats to Steal Data

Do Son August 13, 2025

The AhnLab SEcurity intelligence Center (ASEC) has uncovered a large-scale malware distribution campaign leveraging GitHub to spread...

SVF Botnet: New Python DDoS Threat Leverages Discord for Stealthy C&C on Linux Servers Linux Botnet Discord C2

SVF Botnet: New Python DDoS Threat Leverages Discord for Stealthy C&C on Linux Servers

Do Son July 22, 2025

In a recent analysis, AhnLab’s Security Intelligence Center (ASEC) has uncovered an emerging threat targeting misconfigured and...

Kimsuky’s PebbleDash Campaign: PowerShell Attacks & RDP Bypass Tactics Kimsuky Group PebbleDash Malware

Kimsuky’s PebbleDash Campaign: PowerShell Attacks & RDP Bypass Tactics

Do Son April 25, 2025

A recent report by the AhnLab Security intelligence Center (ASEC) has uncovered the latest tactics employed by...

ViperSoftX Malware: Arabic-Speaking Attackers Exploit PowerShell in New Cyberattack Campaign ViperSoftX malware South Korea cyberattack

ViperSoftX Malware: Arabic-Speaking Attackers Exploit PowerShell in New Cyberattack Campaign

Do Son April 13, 2025

AhnLab Security intelligence Center (ASEC) has revealed a cyberattack campaign where Arabic-speaking attackers are distributing ViperSoftX malware,...

Critical Alert 1 Active Exploit Detected Today