Do Son Haozi, a Chinese Phishing-as-a-Service platform, is back, offering no-code phishing kits and full support. Learn how this service enables easy cybercrime.
ransomware
A new ransomware strain, Lyrix, targets Windows systems with strong encryption, anti-analysis, and data destruction techniques. Learn how to protect your data.
The DOJ, with international partners, seized four domains providing crypting services to cybercriminals, hindering malware attacks in a global operation.
Threat actors are exploiting AI hype with fake software installers, delivering CyberLock ransomware, Lucky_Gh0$t, and the destructive Numero malware.
Attackers compromised an MSP's RMM tool (SimpleHelp) to deploy DragonForce ransomware across customer environments.
Iranian national Sina Gholinejad pleaded guilty for his role in the Robbinhood ransomware attacks targeting U.S. cities like Baltimore.
The alleged architect of the Qakbot malware empire, Rustam Rafailevich Gallyamov, has been indicted, facing charges and a $24M crypto seizure.
The U.S. Department of Justice charged 16 individuals for the $50M DanaBot malware operation, which infected over 300,000 computers worldwide.
Europol and Microsoft led Operation Endgame, a global takedown disrupting 300+ servers and 650 malicious domains linked to major ransomware malware strains.
Details on a zero-day vulnerability (CVE-2025-31324) in SAP NetWeaver that allows file uploads and its link to the Qilin ransomware group.
A trojanized KeePass installer is spreading malware! Learn how this sophisticated attack steals credentials and deploys Cobalt Strike.
Netskope Labs details a complex infection chain used by the DOGE Big Balls Ransomware, involving PowerShell scripts, exploits, and lateral movement tactics.
Agenda ransomware (Qilin) is back, now using the advanced NETXLOADER and SmokeLoader to enhance infiltration and evade detection. Targets global sectors.
A zero-day privilege escalation vulnerability (CVE-2025-29824) in Microsoft CLFS was exploited by Balloonfly (Play ransomware) before the official patch.
UNC3944 resurfaces as Scattered Spider, linked to DragonForce and RansomHub in new retail attacks. Mandiant warns of social engineering escalation.
CYFIRMA's analysis details Gunra Ransomware's sophisticated techniques, including evasion and data exfiltration, impacting global industries.
DragonForce ransomware cartel targets UK retailers with Conti-based payloads, RansomBay leaks, and phishing attacks, warns SentinelOne report.
The DOJ has indicted Yemeni national Rami Khaled Ahmed for allegedly masterminding the Black Kingdom ransomware attacks on US hospitals, schools, and businesses.
The UK's NCSC warns of a pervasive ransomware threat targeting all organizations. Learn key recommendations to enhance your cyber security and resilience.
Darktrace uncovers a SocGholish campaign using obfuscated loaders and legacy Windows exploits to harvest NTLM hashes and deliver ransomware payloads.
PRODAFT report details Nebulous Mantis (Cuba/STORM-0978), a Russian-speaking group using RomCom RAT for espionage and ransomware.
SentinelOne reveals real-world attacks from DPRK, ransomware groups, and Chinese APTs, exposing evolving threats facing cybersecurity vendors in 2025.