Ransomware is an operational-resilience problem as much as a malware problem. Track confirmed attacks, enabling vulnerabilities, extortion activity and the controls that influence containment and recovery.
Reported exploitation of Cisco firewall-management flaws links administrative-system compromise with credential theft and Qilin ransomware deployment, raising the priority of patch validation.
Segmentation limited the operational impact, but the breached standalone system still held sensitive information about targets of active federal investigations.
A reported Black Kite analysis places many known incidents in the mid-market, but the percentage is unverified and should prompt supplier-specific resilience reviews.
U.S. Bank is investigating a LockBit claim involving stolen data, putting a major financial institution under extortion pressure while the alleged compromise remains under review.
Medium-sized organizations accounted for 73% of the ransomware incidents in a Black Kite analysis covering January 2023 through June 2026. Cybersecurity Dive reported that the study examined 13,336…
CISA, the FBI and HHS updated guidance on Medusa ransomware, saying the operation has impacted more than 500 victims across multiple sectors. The advisory reflects the persistence of…
A previously patched Windows privilege-escalation flaw is now showing up in ransomware attacks, turning an old patch gap into an active enterprise risk.
Dozens of organizations in the United States and Canada were targeted by criminals posing as help-desk staff through Microsoft Teams, according to Sophos research reported by Cybersecurity Dive.…
Huntress observed a rapid campaign against SonicWall virtual-private-network and firewall accounts that compromised 30 customer organizations in less than two days. Researchers recorded 92 affected user accounts during…
New NCSC guidance focuses on the first hours, recovery programme and secure rebuild after a severe cyber incident, with an emphasis on minimum viable operations.
PTC updated its advisory with new indicators of compromise as attacks against vulnerable Windchill and FlexPLM environments continued through July.
A ransomware event reached fairlife production-related systems, forcing a temporary shutdown of US operations while incident response and recovery began.
Researchers documented an intrusion in which an LLM agent adapted its actions in real time, harvested credentials, moved laterally and encrypted production configuration data.
Europol and international partners announced coordinated action against SocGholish, Amadey and StealC infrastructure used to steal information and enable further cybercrime. Europol published the underlying report or notice on 2026-06-24, placing the event within
A ransomware incident forced Mackay Sugar to suspend mill operations, creating a visible operational impact during the production season. SecurityWeek published the underlying report or notice on 2026-06-15,…
Europol said an international operation dismantled the AudiA6 cryptocurrency laundering service, which allegedly processed about €336 million connected to ransomware groups. Europol published the underlying report or notice on 2026-06-11, placing the event within
The event shows how cyber incidents can interrupt real services, production and recovery work beyond the IT department.
The event shows how cyber incidents can interrupt real services, production and recovery work beyond the IT department.
The event shows how cyber incidents can interrupt real services, production and recovery work beyond the IT department.
The event shows how cyber incidents can interrupt real services, production and recovery work beyond the IT department.
The event shows how cyber incidents can interrupt real services, production and recovery work beyond the IT department.
On May 2, 2026, BleepingComputer reported that cpanel flaw is fueling mass sorry ransomware attacks. The account describes a concrete security, privacy or fraud consequence rather than a…
Trigona affiliates are using a custom exfiltration tool designed to move valuable files quickly while avoiding detections tied to common utilities.
Kyber ransomware is experimenting with post-quantum encryption while targeting both Windows servers and VMware ESXi environments in the same campaign.
Software vulnerability exploitation now begins 31% of breaches, while ransomware appears in 48%, sharpening the need to reduce exposed attack paths.
Exploitation of public-facing applications rose 44% as AI accelerates reconnaissance, credential theft and ransomware operations.
