Do Son FortiGuard uncovered Chaos-C++, a dangerous new ransomware strain. It deletes file content over 1.3 GB and uses clipboard hijacking to steal Bitcoin during payments.
ransomware
Microsoft Threat Intelligence details how APTs abuse Teams and Entra ID integration for recon, vishing, and C2. Attackers use RMM tools and spoofed accounts to breach enterprise environments.
Rapid7 identified the Crimson Collective using TruffleHog to find leaked AWS IAM keys. The group achieves Admin access to steal data from RDS/S3 and extort victims.
CYFIRMA uncovered Yurei Ransomware, a sophisticated Go-based double-extortion threat that uses ChaCha20 encryption, anti-forensic wipes, and disguises itself as WindowsUpdate.exe to propagate over SMB.
The "Trinity of Chaos" alliance (Lapsus$, Scattered Spider, ShinyHunters) launched a DLS, listing 39 firms, including Google and Cisco, and claiming 1.5 billion stolen records.
Ransomware groups are hijacking legitimate RATs like AnyDesk and Splashtop to gain stealthy persistence, spread laterally, and disable antivirus software in enterprise networks.
XWorm V6.0 has resurfaced with 35+ plugins, including ransomware functionality. The modular RAT uses stealth injection and obfuscated PowerShell to bypass AMSI.
Russian-speaking Lunar Spider group is using the sophisticated Latrodectus V2 loader and a FakeCaptcha lure to gain initial access for ransomware operations.
LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.
Zscaler ThreatLabz has uncovered a new backdoor malware, YiBackdoor, that shares extensive code with IcedID and Latrodectus and is being tested for ransomware ops.
After nearly two years of silence, Zloader (a.k.a. Terdot, DELoader, or Silent Night) has returned with new...
AhnLab has uncovered Kawa4096, a Go-based ransomware targeting Windows, Linux, and VMware ESXi. The malware uses advanced crypto and covert backup deletion.
A new report from Black Lotus Labs reveals SystemBC, a malware-powered proxy network. The botnet compromises VPS systems and fuels global ransomware attacks.
A new malware loader, CountLoader, is linked to Russian ransomware groups. The malware uses phishing lures impersonating the Ukrainian National Police to deliver payloads.
AhnLab has uncovered BlackLock, a Go-based ransomware targeting Windows, Linux, and VMware ESXi. The malware uses advanced crypto and covert backup deletion.
Sophos uncovers GOLD SALEM, a new ransomware group exploiting SharePoint flaws. The group uses EDR evasion and legitimate tools to attack global targets.
EclecticIQ reports on how ShinyHunters is expanding with AI-driven voice phishing, supply chain compromises, and insider recruitment, blurring lines with APTs.
A new report reveals CyberVolk ransomware, a pro-Russian strain that encrypts data with an unrecoverable flaw. Its decryption key is useless, making recovery impossible.
Australian authorities issue an urgent alert on a critical SonicWall SSL VPN flaw actively exploited by Akira ransomware, urging immediate patching.
A new report reveals The Gentlemen ransomware group is using legitimate drivers and Group Policy to bypass defenses and deploy highly tailored malware.
A new report reveals TAG-150, a sophisticated new threat actor with evolving malware and a resilient multi-tiered infrastructure, including a new RAT called CastleRAT.
A hacker group is extorting an art platform with a new threat: if the ransom isn't paid, they will feed the stolen artworks to AI training models.