Unit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
34
- Mentions · 7d2
- Mentions · 30d7
- All mentions15
- First seenAug 12, 2026
- Last mentioned2d ago
Timeline
15 articles · newest firstAustralia’s ASD issued more than 4,400 cyber warnings in a year
Victim reports helped disrupt an August 2025 Akira campaign linked to a known SonicWall flaw.
52
Nord Security counts 2,894 ransomware attacks in third quarter
The July–September total is up 50% year over year and 8.6% from the prior quarter, led by The Gentlemen and Qilin.
62
Roundup cites infostealers, malicious packages and ClickFix as rising malware trends
Immersive says Lumma Stealer, StealC and RisePro now account for 75% of stolen credentials sold for initial access.
34
Ransomware has a new target. Is your backup ready?
ALPHV, BlackMatter, and Gunra have wiped backups before encryption to raise ransom pressure.
46
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Huntress mapped an Akira ransomware intrusion that used RDP, LSASS dumping, GOST tunneling, and RClone.
55
The First 24 Hours: What Happens When Ransomware Lands
Huntress describes the first day after ransomware is discovered, citing a 14-day median dwell time and rapid Akira theft.
51
Network Segmentation Failures Are Expanding the Corporate Attack Surface
Forescout finds nearly half of OT and medical segments also hold IT or IoT, widening lateral movement.
56
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Black Kite reports manufacturing ransomware incidents up 40% in 2026, with new gang The Gentlemen responsible for 12% of attacks.
55
Attackers exploit zero-days in consistently besieged SonicWall product
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
82
Risky Bulletin: Russia starts blocking DoH and DoT
Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.
40
Employee benefits platform Paylogix says hackers stole financial and health
Akira ransomware gang stole financial, health, and passport data on tens of thousands of people from benefits administrator Paylogix in November.
65
Akira Ransomware Uses Safe Mode to Bypass EDR
An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.
74
Akira Affiliate Crashes Ransomware After Attempting EDR Evasion
Huntress documented an Akira ransomware affiliate attack that failed after its anti-EDR tool crashed legitimate software and stopped encryption before completion.
45
Akira Hits Safe Mode: Ransomware Rebooting Around EDR
Huntress documents an Akira ransomware affiliate rebooting endpoints into Windows Safe Mode to evade EDR and Defender, though Safe Mode broke the ransomware.
50
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
Appears with
- Huntressorganization · 7
- Akiramalware · 5
- CISAorganization · 4
- Huntressvendor · 4
- Qilinthreat actor · 3
- Akiraorganization · 3
- The Gentlementhreat actor · 3
- FBIorganization · 3
- SonicWallvendor · 3
- BlackCatthreat actor · 2
- Microsoftvendor · 2
- Noname057(16)threat actor · 2
- ALPHVthreat actor · 2
- Akira ransomwaremalware · 2
- LockBitthreat actor · 2
- Inc Ransomthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.