Do Son A widespread Synology NAS ransomware wave targets exposed devices via patched DSM vulnerabilities. Update firmware immediately to prevent encryption.
ransomware
Hackers reduced the GMO Internet ransom demand from $50M to $1M and leaked victim files after the Japanese conglomerate ignored multiple bug warnings.
A Hive ransomware affiliate who also used Nefilim ransomware got 70 months in prison. A co-conspirator remains at large with an $11M reward.
A suspected initial access broker behind FortiGate GlobalProtect attacks exposed 70,000+ credentials. See how k0t operates and how to defend.
A new StopRansomware advisory warns SafePay ransomware has hit 600+ victims via VPN logins and edge flaws. See its tactics and key defenses.
Discover the MonsterCloud ransomware decryption fraud. Learn how Zohar Pinhasi allegedly deceived clients by secretly paying hackers for data recovery keys.
Explore the devastating SoftBank IDCF Cloud ransomware attack. Read the hackers' humiliating note revealing the massive East Japan Region 1 outage.
Trump Mobile data breach: BYOD leaks Trump Mobile customer data for 3,615 people, including Trump allies, via an infostealer and no MFA.
A new DragonForce backdoor hides in Microsoft Teams TURN relays and falls back to MQTT. See how it works and how defenders can spot it.
Microsoft ties a JADEPUFFER Azure attack to Storm-3168, the agentic ransomware actor that tried to delete 100+ storage accounts in seven minutes.
Zimperium zLabs discovered Mantax Otax Android malware, a fierce Indonesian mobile ransomware integrating spyware to hijack, record, and extort victims.
Cisco Talos warns of Cisco FMC vulnerabilities actively exploited in the wild. Attackers chain CVE-2026-20079 and CVE-2026-20316 to deploy ransomware.
Recent Node.js malware attacks target global firms. Attackers deploy Node.js malware using trusted runtimes and smart contracts to evade detection.
The Aurora ransomware group targets VMware ESXi systems. Discover how the Aurora ransomware ESXi campaign abuses Cursor Agent for hands-on attacks.
PaperCut confirms a NG/MF vulnerability exploited in the wild. Restrict server access now and apply the emergency patch for versions 25 and 26.
The Clop web shell targets PTC Windchill via CVE-2026-12569, stealing credentials and engineering data in a mass-extortion campaign.
StopAndProtect malware turns hacked WordPress sites into a botnet for ransomware and data theft. Check Point exposed 5,000+ victims.
Zscaler details the C2Looper backdoor, a Rust backdoor tied to ransomware that uses GitHub for C2 and likely spreads through ClickFix lures.
DeadLock ransomware uses blockchain nodes and Session chat. Learn how the DeadLock ransomware encryptor targets networks worldwide.
CISA and five agencies warn that Gunra ransomware is hitting critical infrastructure with double extortion. A Linux flaw may let victims recover free.
HostDzire suffered a critical ransomware attack on its VMware infrastructure, encrypting virtual disks and causing total data loss for affected VPS users.
GenieLocker ransomware hits Russia's manufacturing sector on Windows, Linux, and ESXi. Linked to the Toy Ghouls group, it leaves no ransom note.