Browsing: Ransomware

An Akira ransomware affiliate broke into a company through an MFA-less SonicWall VPN on August 4, stole credentials and file shares, and then rebooted the compromised host into Safe Mode with Networking to kill the security tools before launching the encryptor. The plan worked on the EDR. It did not work on the ransomware.

Six US and South Korean government agencies jointly warned Monday that Gunra, a ransomware-as-a-service operation built on leaked code from the notorious Conti gang, has struck at least 51 organizations across the Americas, Europe, the Middle East, Africa, and the Asia-Pacific — breaching hospitals, government agencies, and financial institutions by exploiting unpatched Fortinet firewall products…

Table of contents Phase 1: Govern and identify — inventory, ownership and response authority Phase 2: Harden and prevent — patching, MFA and secure remote access Phase 3: Detect and contain — behavioral protection, EDR and segmentation Phase 4: Roll back and recover — immutable backups and tested restores Phase 5: Improve — training, exercises…

Dragos has published its industrial ransomware analysis for the second quarter of 2026, recording 1,140 incidents affecting industrial organisations worldwide.

A ransomware gang best known for skipping encryption altogether and going straight for the data has found its newest target: the software that manufacturers and retailers use to design everything from jet engines to jeans. Cl0p, the extortion crew behind the 2023 MOVEit Transfer campaign that hit more than 2,700 organizations, is now exploiting a…

Health Sciences Centre Winnipeg is investigating a ransomware incident affecting certain facility maintenance systems, including HVAC and door access. 

Ransomware attacks against South African organisations are becoming faster and more coordinated, leaving companies with significantly less time to detect and contain breaches before they result in datatheft and extortion.

Shutting down endpoint detection and response (EDR) tools before encryption begins has become standard operating procedure across the ransomware ecosystem, analysis of attacks by researchers at Halcyon has warned.

Microsoft says China-linked, financially motivated threat actor Storm-1175 has begun using a new ransomware strain called StormEncryptor. The group previously relied on Medusa ransomware. StormEncryptor is written in C++ and encrypts files and adds the .encrypted extension, then leaves a !!!README_FIRST!!!.txt ransom note in each scanned directory. The change suggests an evolution in the group’s…

Ransomware protection is a coordinated set of controls that reduces the likelihood of compromise, detects and contains malicious activity, protects recovery infrastructure and restores operations when an attack succeeds. It spans identity security, vulnerability and patch management, endpoint protection, EDR or XDR, incident response, targeted rollback, immutable backup and disaster recovery. No single control covers…