Search: “forensics”

8 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 29 Industry 27 Threat actor 22 Ransomware 8 AI safety & security 8 Data breach 8 Malware 8 Policy & legal 8 Research 5 Tools 5 Vulnerability 3 AI policy 2 AI industry 2 Phishing & fraud 1

SeverityAll critical 25 high 38 medium 21 low 1 info 53

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin refuses ransom demands after Rhysida claimed stealing 5.79 TB from the city-state network, including mobility department data on 12,076 individuals.

Berlin's state government confirmed an extortion attempt following the August compromise of its state administrative network and said it will not pay. Forensics found data exfiltrated from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and 12, 2026; Rhysida's leak site claims 5.79 TB, 1.44 million files, and personal data on 12,076 individuals. State criminal police, prosecutors, and federal authorities are investigating, and officials say the September 20 Abgeordnetenhaus election environment remains unaffected. Separately, Manchester Airports Group confirmed theft of customer data including emails, phone numbers, and vehicle registrations across three airports.

The Hacker NewsAug 28, 21:30 UTC · 19d agoRansomware in the wildCVE-2020-1472

Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

Rhysida ransomware hit Berlin's state government weeks before the September 20 election, claiming 5.79 TB stolen; officials refused the ransom.

Berlin's government confirmed an August cyberattack on its administrative network, with data exfiltrated between August 7 and August 12 and departments isolated on August 17. The Rhysida group claimed responsibility on August 28, alleging theft of 5.79 TB and 1.44 million files including personal data on 12,076 individuals, payroll files, plaintext credentials, and vulnerability analyses of Berlin's water supply. Officials said election systems were not affected and refused to pay; Rhysida has claimed roughly 280 victims since 2023, entering via VPNs without MFA, Zerologon, or phishing.

Security AffairsAug 29, 10:56 UTC · 18d agoRansomware in the wild

Harley-Davidson Alleged Breach – CL0P Ransomware Adds Motorcycle Maker to the List

CL0P ransomware group listed Harley-Davidson on its extortion leak site, claiming a compromise; the motorcycle maker has not confirmed any breach.

The CL0P ransomware operation added Harley-Davidson to its public extortion portal, a listing highlighted by the ransomNews monitoring account on September 10, 2026. Harley-Davidson has not confirmed any compromise, and the initial access method, affected business unit, timing, and volume of stolen data remain unknown, with no sample files or technical indicators published. The article stresses that leak-site listings alone do not confirm a breach and can serve as negotiation pressure in double-extortion schemes. If verified, stolen data could fuel downstream phishing, BEC, credential-stuffing, and invoice fraud targeting dealers, suppliers, and customers.

Cyber Security NewsSep 11, 07:26 UTC · 6d agoRansomware

Cyberattack encrypts systems at Bavarian municipal utility

Hackers encrypted the central IT network of Bavarian utility Stadtwerke Landsberg, disrupting office systems but not electricity or water services.

Stadtwerke Landsberg said hackers encrypted its central IT network overnight on Sept. 1, prompting disconnection from the internet, crisis-team activation and external forensic support. Essential electricity and water services were unaffected, but staff availability was limited and customer data such as names, addresses and bank details may have been accessed. No ransomware group was named and no extortion demand was confirmed. The attack follows a similar late-June encryption incident at a North Rhine-Westphalia municipal utility, and the BSI consistently ranks ransomware among Germany's most serious cyber threats.

The RecordSep 8, 12:00 UTC · 8d agoRansomware in the wild

Rhysida Publishes Berlin Government Data After €2m Extortion Demand Refused

Rhysida published 5.7 TB of Berlin state government data, including sensitive CBRN emergency plans, after the state refused a €2m ransom demand.

The Rhysida ransomware gang leaked roughly 5.7 TB — about 1.4 million files — stolen from Berlin's state network after the government declined to pay 30 bitcoins (about €2m) by the September 4 deadline. The dump reportedly includes sensitive state emergency plans for terrorist attacks and CBRN disaster scenarios in a folder titled 'AG CBRN-Rahmenplanung', plus personnel files, absence lists, payroll data, and home addresses, potentially affecting tens of thousands of people. Berlin says there are no indications the state network remains compromised and will notify affected individuals on a risk-based basis after forensic analysis.

Infosecurity MagazineSep 7, 12:00 UTC · 9d agoRansomware

Berlin refuses to be blackmailed after network breach

Rhysida extorts Berlin's state government after stealing 5.79 TB across 1.44 million files, demanding roughly 2 million euros in bitcoin.

Berlin's state government confirmed an extortion attempt after data theft from its administrative network between August 7 and 12, with affected departments disconnected only on August 14. The Rhysida ransomware gang lists 5.79 TB across 1.44 million files on its leak site, including HR files, contracts, 148 IBANs, personal data on 12,076 individuals, and plaintext credentials from internal systems including Berlin's leadership. Der Spiegel reports a 30 bitcoin demand of about 2 million euros; officials say the city will not pay and investigators include the State Criminal Police Office and federal agencies. Forensics revealed additional leaks in the Senate Department for Mobility, Transport, Climate Protection and the Environment, while the Berlin House of Representatives election environment is reported secure.

Help Net SecuritySep 1, 00:00 UTC · 16d agoRansomware in the wild

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora ransomware operators used Cursor AI running Claude Sonnet to plan and execute intrusions against dozens of organizations in nine countries.

CloudSEK and Gambit Security analyzed exposed infrastructure tied to the Russian-speaking Aurora (Aur0ra) group, revealing months of activity against more than 20 organizations across nine countries between April and July 2026, with 33 victims listed by Ransomware.Live. The operator used the Cursor agentic coding assistant to plan attacks in Russian, including an AD CS exploitation plan, and Gambit observed Cursor Agent (running Anthropic's Claude Sonnet) performing hands-on exploitation tasks such as Nmap scanning, NetExec enumeration, NTLM relay, and certificate attacks against 10 targets. Attacks begin with email bombing plus IT help desk vishing via Xray-core, followed by SMB/LDAP/WinRM/RDP lateral movement, log clearing, Defender disabling, and exfiltration; the Windows and Linux/ESXi encryptors are built from a single Zig codebase, with shadow copy deletion and VM-killing before encryption.

The Hacker NewsAug 31, 11:47 UTC · 16d agoRansomware in the wild1

DOJ firearms agency says hackers breached system containing investigation targets

ATF confirmed a cyberattack on a standalone system containing investigation target data, calling it a major incident; Qilin listed ATF on its leak site.

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyberattack on a standalone computer system containing information about targets of ATF investigations, with no connection to case management, laboratory, or eForms systems. The agency designated the breach a major incident and immediately terminated connections, initiating incident response and forensics. The Qilin ransomware gang added ATF to its leak site without providing stolen data samples. Qilin was the second most active ransomware gang in July 2026 with 127 reported attacks, and has previously hit Kuala Lumpur International Airport, Asahi, and Palau's government.

The RecordAug 27, 12:25 UTC · 20d agoRansomware in the wild