Do Son A six-day RansomHub attack exploited RDP, used Atera/Splashtop RMM, Mimikatz, and Rclone to breach an enterprise, exfiltrate data, and deploy ransomware.
RansomHub
Qilin ransomware is rapidly dominating the RaaS landscape, as rivals like RansomHub and LockBit face collapse, internal chaos, and public defacements by "XOXO from Prague."
UNC3944 resurfaces as Scattered Spider, linked to DragonForce and RansomHub in new retail attacks. Mandiant warns of social engineering escalation.
Intrinsec reveals shared infrastructure between Eye Pyramid C2 and ransomware groups like Rhysida and Vice Society in new threat intelligence report.
eSentire TRU discovers a campaign combining SocGholish malware with RansomHub affiliates, using fake updates and Python backdoors to compromise networks.
Learn how UAC-0006 Espionage is linked to Russian cyber operations targeting Ukraine through financial and psychological warfare.
Explore the new Betruger backdoor used by RansomHub affiliates in ransomware attacks. Discover its unique functionalities.
Discover the concerning collaboration between Scattered Spider and RansomHub, resulting in a dangerous escalation of ransomware activities.
Explore the sophisticated tactics of RansomHub ransomware and their use of EDRKillShifter. Discover how this tool enables them to evade detection and disable antivirus solutions.
Discover the latest developments in the activities of the threat actor known as CosmicBeetle and its new custom ransomware tool, ScRansom.
Learn about the reported data breach and ransomware attack on Prasarana Malaysia Berhad's systems and how the company is responding to ensure passenger service remains unaffected.
Sophos researchers uncover EDRKillShifter: a powerful tool that bypasses security measures. Find out how to defend against this emerging threat.
A new ransomware-as-a-service (RaaS) called RansomHub has emerged, targeting Windows, Linux, and ESXi operating systems
RansomHub attackers gained initial access by exploiting the Zerologon vulnerability (CVE-2020-1472), which grants domain administrator privileges