ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

News

32 stories in the last 30d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 445AI research 437Advisory 364Exploit / PoC 362AI safety & security 359AI industry 324Industry 282Research 266Threat actor 237Policy & legal 184Malware 176Tools 166Data breach 164Phishing & fraud 133
SeverityAllcritical 166high 748medium 875low 274info 2138

Ransomware group claims attack on Missouri’s Cedar County Memorial Hospital after IT outage

Ransomware group claims attack on Cedar County Memorial Hospital in Missouri, forcing IT shutdown that disrupted EHRs and diverted emergency patients.

Cedar County Memorial Hospital in El Dorado Springs, Missouri shut down its IT networks on August 14 after a disruption left its electronic health record system, patient portal, and internet access unavailable. A ransomware group subsequently claimed responsibility for the attack. Diagnostic imaging was also disrupted, preventing transmission of images to radiologists, and the emergency department partially diverted trauma and critical patients.

DataBreaches.net · 11h agoRansomware

Silent Ransom Group Hacked Greenberg Traurig; Who notifies the 126k Affected?

Silent Ransom Group listed law firm Greenberg Traurig on its leak site, with roughly 126,000 individuals affected by the breach.

Silent Ransom Group (SRG) added prominent law firm Greenberg Traurig to its leak site of attacked and leaked victims. DataBreaches.net reports exclusive details indicating approximately 126,000 people were affected and raises questions over who is notifying them. SRG's leak site previously carried 64 law firm listings, including Troutman Pepper Locke, reported breached on August 21.

DataBreaches.net · 1d agoRansomware

PLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers

Guardicore Labs uncovers the PLEASE_READ_ME ransomware campaign targeting MySQL servers, using double extortion and publishing stolen victim data.

Guardicore Labs at Akamai uncovered an opportunistic ransomware campaign dubbed PLEASE_READ_ME that targets MySQL servers. The attackers employ double extortion, publishing stolen data to pressure victims into paying. The campaign is devastating internet-facing MySQL deployments, making exposed database servers the primary at-risk population.

Akamai Blog · 7d agoRansomware in the wild

Florida water agency latest to confirm cyber incident as feds warn of nation

A ransomware gang hit Florida's St. Johns River Water Management District as CISA warned of IRGC-linked CyberAv3ngers attacks on exposed Unitronics water-sector PLCs.

The St. Johns River Water Management District, which oversees Florida drinking-water supply planning, confirmed suspicious activity in its IT environment and said containment measures were implemented; a ransomware gang claimed the attack and shared samples of stolen data. Separately, CISA, FBI, NSA, EPA and Israel's INCD warned that IRGC-affiliated CyberAv3ngers are actively compromising Israeli-made Unitronics Vision Series PLCs in the water sector using default credentials since at least November 22. The group, motivated by opposition to Israel-linked products, defaces controller interfaces and could cause deeper cyber-physical effects. Shadowserver found at least 539 Unitronics PLC instances still exposed online, and CNN reported fewer than 10 US water facilities faced recent attacks.

The Record · 7d agoRansomware in the wild 3 sources

Rhysida Publishes Berlin Government Data After €2m Extortion Demand Refused

Rhysida published 5.7 TB of Berlin state government data, including sensitive CBRN emergency plans, after the state refused a €2m ransom demand.

The Rhysida ransomware gang leaked roughly 5.7 TB — about 1.4 million files — stolen from Berlin's state network after the government declined to pay 30 bitcoins (about €2m) by the September 4 deadline. The dump reportedly includes sensitive state emergency plans for terrorist attacks and CBRN disaster scenarios in a folder titled 'AG CBRN-Rahmenplanung', plus personnel files, absence lists, payroll data, and home addresses, potentially affecting tens of thousands of people. Berlin says there are no indications the state network remains compromised and will notify affected individuals on a risk-based basis after forensic analysis.

Infosecurity Magazine · 8d agoRansomware

Berlin investigates new data leak after hackers publish stolen login credentials

Berlin investigates a fresh leak after Rhysida hackers published stolen login credentials; the city refuses to pay the ransom demand.

Berlin confirmed hackers published additional stolen data, including login credentials, from a mid-August cyberattack on two city ministries responsible for urban development/housing and transport/climate. The Rhysida ransomware group claimed the breach in late August, saying it stole 5.79 TB of data including contracts, emails, passwords and classified information; Berlin acknowledged an extortion demand but refused to pay. Berlin's data protection regulator said the leak includes personal data on public employees and possibly residents, such as names, addresses, dates of birth and bank information. Germany's BSI separately linked the campaign to the TerminalFix fake-CAPTCHA technique and the LoremIpsumLoader/AxolotLoader malware tied to financially motivated Rhysida-associated hackers, days before Berlin's Sept. 20 election.

The Record · 8d agoRansomware in the wild

Berlin Ransomware Leak Exposes State Secrets

Rhysida ransomware leaked 5.79 TB of Berlin state government data on the dark web after the city refused a 30 Bitcoin ransom.

The Rhysida ransomware group published 5.79 TB (about 1.44 million files) of Berlin state administration data on its leak site on August 28, 2026, after the city-state refused a 30 Bitcoin ransom. The claimed dataset includes personal data on 12,076 individuals, over 5,000 personnel files, payroll records, plaintext credentials for systems like PAYONE and Z_ADMIN, Bundesrat committee protocols, and documents allegedly containing state secrets. Leaked material reportedly covers national defense emergency plans, federal secret communication channels, a CBRN threat planning folder, and vulnerability analyses of Berlin's water supply. Berlin's government has activated a central crisis unit to review the leaked data and notify affected citizens and businesses.

Security Affairs · 8d agoRansomware

AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit

Unit 42 says a human attacker used AI agents to execute a full ransomware intrusion in under 10 hours, leaving the victim an 80-page security audit.

Palo Alto Networks Unit 42 incident responders report a human ransomware operator used frontier AI models and agentic attack frameworks to breach an enterprise in under 10 hours, work that normally takes human operators around two weeks. AI agents performed reconnaissance, breached a public API endpoint to tunnel into the network, scraped code repositories for hard-coded tokens and service passwords, then used them to steal master administrative credentials from the secret-management system for root access. Specialist pivot agents validated access to cloud, identity, CI/CD, container and SaaS environments, and the attacker hijacked CI/CD workflows to steal cloud keys and turn the victim's cloud AI services into post-compromise infrastructure. The agents left an 80-page audit detailing dozens of exploited findings.

The Register · Security · 13d agoRansomware in the wild

Nutex Health Says Patient Data Stolen, Hackers Threaten Leak

The Gentlemen ransomware gang claims breach of US healthcare provider Nutex Health, exfiltrating patient and employee data and threatening publication.

Nutex Health disclosed in an SEC 8-K filing that an unauthorized third party accessed and exfiltrated patient, employee, credentialed provider, business, and financial data from company servers, and threatened to publish it. The Gentlemen ransomware group listed Nutex on its leak site; a class action was filed August 27 and Edelson Lechtzin LLP is separately investigating. Nutex operates over 27 facilities in 12 states and served nearly 100,000 patients in the first half of 2026, with no material operational impact identified so far.

Infosecurity Magazine · 13d agoRansomware

Healthcare facilities operator Nutex says patient, employee data stolen in August incident

The Gentlemen ransomware gang claims the theft of patient and employee data from healthcare operator Nutex Health, which disclosed the extortion in SEC filings.

Nutex Health said in an 8-K filing that intruders broke into its servers and exfiltrated patient, employee, provider and confidential financial data, and that it is being extorted with threats to publish the information. A Texas class action was filed after the company's August 24 disclosure, and Nutex cannot yet estimate the incident's impact. The Gentlemen ransomware-as-a-service gang, active since September 2025 and believed Russia-based, listed Nutex on its leak site; Dragos ranked it third among groups attacking industrial organizations in Q2 2026 with 125 claimed attacks.

The Record · 14d agoRansomware

Berlin refuses to be blackmailed after network breach

Rhysida extorts Berlin's state government after stealing 5.79 TB across 1.44 million files, demanding roughly 2 million euros in bitcoin.

Berlin's state government confirmed an extortion attempt after data theft from its administrative network between August 7 and 12, with affected departments disconnected only on August 14. The Rhysida ransomware gang lists 5.79 TB across 1.44 million files on its leak site, including HR files, contracts, 148 IBANs, personal data on 12,076 individuals, and plaintext credentials from internal systems including Berlin's leadership. Der Spiegel reports a 30 bitcoin demand of about 2 million euros; officials say the city will not pay and investigators include the State Criminal Police Office and federal agencies. Forensics revealed additional leaks in the Senate Department for Mobility, Transport, Climate Protection and the Environment, while the Berlin House of Representatives election environment is reported secure.

Help Net Security · 14d agoRansomware in the wild

Berlin says it won’t pay ransom after hackers steal government data

Berlin refuses ransom as Rhysida ransomware group claims theft of 5.79 TB of government data ahead of September 20 elections.

The Rhysida ransomware group claimed responsibility for stealing 5.79 TB of data from Berlin's government network, including 46,500 contracts, emails, phone numbers, passwords and classified information, and listed it for auction starting at 30 bitcoin (~$2.3 million). Berlin discovered the breach in mid-August, disconnected two ministries from the state network on August 14, and refused to pay the ransom; authorities have not officially attributed the attack. Data is believed taken between August 7 and 12, and district services such as housing benefit processing were disrupted. Officials said election infrastructure is protected ahead of the September 20 House of Representatives vote, and state IT provider ITDZ Berlin was unaffected.

The Record · 15d agoRansomware

Pharmaceutical giant McKesson warns of 'service degradation' following cyberattack

Pharmaceutical giant McKesson disclosed a cyberattack on a third-party application that exfiltrated customer data, claimed by ShinyHunters.

McKesson reported a cybersecurity incident involving an unnamed third-party application, with attackers exfiltrating data tied to its oncology and surgical business units. The company filed with the SEC, offered credit monitoring, and said it had received reasonable assurance the attackers were no longer inside its systems. The ShinyHunters group claimed responsibility and threatened leaks; McKesson reported $106 billion in revenue last quarter and distributes about one-third of North American prescriptions.

The Record · 15d agoRansomware in the wild

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora ransomware operators used Cursor AI running Claude Sonnet to plan and execute intrusions against dozens of organizations in nine countries.

CloudSEK and Gambit Security analyzed exposed infrastructure tied to the Russian-speaking Aurora (Aur0ra) group, revealing months of activity against more than 20 organizations across nine countries between April and July 2026, with 33 victims listed by Ransomware.Live. The operator used the Cursor agentic coding assistant to plan attacks in Russian, including an AD CS exploitation plan, and Gambit observed Cursor Agent (running Anthropic's Claude Sonnet) performing hands-on exploitation tasks such as Nmap scanning, NetExec enumeration, NTLM relay, and certificate attacks against 10 targets. Attacks begin with email bombing plus IT help desk vishing via Xray-core, followed by SMB/LDAP/WinRM/RDP lateral movement, log clearing, Defender disabling, and exfiltration; the Windows and Linux/ESXi encryptors are built from a single Zig codebase, with shadow copy deletion and VM-killing before encryption.

The Hacker News · 15d agoRansomware in the wild1

Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

Rhysida ransomware hit Berlin's state government weeks before the September 20 election, claiming 5.79 TB stolen; officials refused the ransom.

Berlin's government confirmed an August cyberattack on its administrative network, with data exfiltrated between August 7 and August 12 and departments isolated on August 17. The Rhysida group claimed responsibility on August 28, alleging theft of 5.79 TB and 1.44 million files including personal data on 12,076 individuals, payroll files, plaintext credentials, and vulnerability analyses of Berlin's water supply. Officials said election systems were not affected and refused to pay; Rhysida has claimed roughly 280 victims since 2023, entering via VPNs without MFA, Zerologon, or phishing.

Security Affairs · 17d agoRansomware in the wild

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin refuses ransom demands after Rhysida claimed stealing 5.79 TB from the city-state network, including mobility department data on 12,076 individuals.

Berlin's state government confirmed an extortion attempt following the August compromise of its state administrative network and said it will not pay. Forensics found data exfiltrated from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and 12, 2026; Rhysida's leak site claims 5.79 TB, 1.44 million files, and personal data on 12,076 individuals. State criminal police, prosecutors, and federal authorities are investigating, and officials say the September 20 Abgeordnetenhaus election environment remains unaffected. Separately, Manchester Airports Group confirmed theft of customer data including emails, phone numbers, and vehicle registrations across three airports.

The Hacker News · 18d agoRansomware in the wildCVE-2020-1472

ATF confirms cyberattack hit system containing info on its investigation targets

Qilin ransomware group claimed breaching the ATF, exposing data on investigation targets; the agency says a standalone system was hit with no mission impact.

The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a cyberattack on a standalone system holding information about targets of ATF investigations, designated a major incident, with no impact on case management, lab, or eForms systems. Qilin, a Russian-speaking affiliate-based ransomware group, claimed responsibility, though ATF declined to confirm involvement or the root cause. Qilin has claimed hundreds of victims across 60+ countries since 2022 and partners with Scattered Spider and Moonstone Sleet.

CyberScoop · 18d agoRansomware in the wild

ATF declares ‘major incident’ as ransomware gang claims hack

The ATF declared a major cybersecurity incident and notified Congress after a ransomware gang claimed responsibility for hacking the federal agency.

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) formally declared a major incident involving its cybersecurity and notified Congress, according to the agency. A ransomware gang has publicly claimed responsibility for the attack. ATF is the latest in a series of US federal agencies in recent years to report a major cyber incident, though the gang's identity and the scope of data affected were not specified in initial reporting.

TechCrunch · Security · 19d agoRansomware

ATF responds to 'major' cybersecurity incident after ransomware gang's claims

The ATF is responding to a major cybersecurity incident claimed by a ransomware gang, with the US Justice Department investigating the breach.

The US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) acknowledged a 'major' cybersecurity incident after a ransomware gang claimed responsibility for an attack. The US Justice Department is investigating the breach. Available reporting provides limited technical detail, and the scope of data theft and operational impact remains unclear.

The Register · Security · 19d agoRansomware

DOJ firearms agency says hackers breached system containing investigation targets

ATF confirmed a cyberattack on a standalone system containing investigation target data, calling it a major incident; Qilin listed ATF on its leak site.

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyberattack on a standalone computer system containing information about targets of ATF investigations, with no connection to case management, laboratory, or eForms systems. The agency designated the breach a major incident and immediately terminated connections, initiating incident response and forensics. The Qilin ransomware gang added ATF to its leak site without providing stolen data samples. Qilin was the second most active ransomware gang in July 2026 with 127 reported attacks, and has previously hit Kuala Lumpur International Airport, Asahi, and Palau's government.

The Record · 19d agoRansomware in the wild

GentleKiller targets more than 400 security processes across 48 products

ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.

ESET analyzed the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework, confirmed through an internal data leak from May 2026. The framework has at least eight variants impersonating legitimate security products and abusing vulnerable or malicious kernel drivers, targeting more than 400 process names across 48 security products. Gentlemen emerged in late 2025, became one of the five most active ransomware gangs in Q1 2026, offers affiliates a 90% ransom share, and practices double extortion using Go-based and C-based ESXi encryptors. The suite also reuses outside tools including HexKiller, ThrottleBlood, and HavocKiller, unified by a shared evasion layer that mimics well-known security vendors.

Help Net Security · 22d agoRansomware in the wild

Change Healthcare Cyber

Change Healthcare's ransomware attack disrupted US healthcare payments and exposed data of roughly 190 million people.

Infosecurity Magazine covers the cyberattack on Change Healthcare, the UnitedHealth Group subsidiary hit by ALPHV/BlackCat ransomware. The attack disrupted US pharmacy and payment processing services and led to the exposure of data belonging to about 190 million individuals. It ranks among the largest healthcare sector cyber incidents on record.

Infosecurity Magazine · 27d agoRansomware in the wild

San Francisco 49ers Ransomware

Ransomware attackers hit the San Francisco 49ers, adding the NFL franchise to the growing list of sports organizations targeted.

Infosecurity Magazine reports a ransomware attack on the San Francisco 49ers. The headline confirms the NFL organization was targeted by ransomware operators. The article text was unavailable, so the responsible gang, encryption scope, and extortion details are unconfirmed. The incident reflects continued ransomware pressure on sports and entertainment organizations.

Infosecurity Magazine · 27d agoRansomware in the wild

Medusa ransomware gang has hit over 500 organizations, CISA warns

FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.

An updated joint advisory from CISA, FBI, and HHS states Medusa ransomware has affected more than 500 organizations, spanning healthcare, defense, manufacturing, government, IT, financial services, education, insurance, and legal sectors. Since early 2023 Medusa has operated a ransomware-as-a-service affiliate model and buys access from initial access brokers for $100 to $1 million. Affiliates gain entry via phishing and unpatched internet-facing software, exploiting newly disclosed flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust within 24 hours. The group runs double extortion, giving victims 48 hours before leak-site publication, with $10,000 in cryptocurrency buying a one-day delay.

Help Net Security · 27d agoRansomware in the wild

Columbus Ransomware Attack Exposes

A ransomware attack on the City of Columbus exposed sensitive data, underscoring ransomware risks to municipal governments.

Infosecurity Magazine reports a ransomware attack against Columbus that led to exposed data. The headline indicates the incident resulted in information disclosure beyond the initial compromise. Full article text was unavailable, so the responsible gang and affected data volumes are unconfirmed. The incident highlights ransomware exposure for city governments and resident personal data.

Infosecurity Magazine · 27d agoRansomware in the wild

More than 200 victims of Medusa ransomware identified over the last year, CISA says

CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.

CISA and the FBI updated their March 2025 advisory, stating Medusa actors had hit more than 500 victims as of April 2026, up from 300 in 2025, with a focus on healthcare and critical infrastructure. The agencies say Medusa rapidly adopts newly announced exploits, sometimes using them up to a week before public vulnerability disclosure, but does not develop its own zero-days, preferring access obtained from unknown sources. The gang moved to an affiliate model in 2023, offers up to $1 million for exclusive initial access brokers, and uses credential stealers plus legitimate remote access tools including AnyDesk, Atera, ConnectWise and Splashtop. No new victims have appeared on its leak site since April, after the shutdown of the University of Mississippi Medical Center drew significant law enforcement attention.

The Record · 28d agoRansomware in the wild1

Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics

CISA, FBI, and HHS updated their Medusa ransomware advisory, reporting over 500 victims and detailing the gang's access-broker and exploit tactics.

A joint advisory update from CISA, the FBI, and HHS expands the March 2025 Medusa guidance, drawing on a year of FBI investigations. The ransomware-as-a-service group's known victim tally grew from more than 300 to more than 500 between March 2025 and April 2026, with the Healthcare and Public Health sector frequently hit. Medusa pays access brokers $100 to $1 million, has exploited flaws such as Fortra GoAnywhere and BeyondTrust vulnerabilities, and leverages newly announced exploits within 24 hours, sometimes a week before public disclosure. The group uses living-off-the-land techniques, remote monitoring and management software, and RDP for lateral movement, and has been linked to actors including Microsoft-tracked Storm-1175 and North Korean hackers targeting healthcare.

CyberScoop · 28d agoRansomware in the wild

17th August – Threat Intelligence Report

Colombia's Ministry of Justice suffered a ransomware attack disrupting drug-monitoring and legal public services, per Check Point's 17 August 2026 threat intelligence report.

Check Point Research's weekly threat intelligence bulletin for 17 August 2026 leads with a ransomware attack on Colombia's Ministry of Justice. The attack affected part of the ministry's technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were impacted; the bulletin also aggregates other cyber research and attack discoveries from the week.

Check Point Research · 29d agoRansomware

Threat Assessment: Ryuk Ransomware

Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.

A joint CISA, FBI, and HHS alert on October 28, 2020 warned of an imminent threat to U.S. healthcare from operators deploying Trickbot and Ryuk ransomware. Universal Health Services reported a Ryuk attack that disrupted all U.S. UHS sites for weeks, with similar incidents at hospitals in Oregon and New York. Ryuk typically arrives after Trickbot or BazaLoader infections delivered via malicious email, and operators enumerate networks with PowerShell and WMI before encryption. The Trickbot Anchor_DNS module performs DNS tunneling for C2, using connectivity checks to benign domains like ipinfo.io and checkip.amazonaws.com.

Palo Alto Unit 42 · 29d agoRansomware in the wild

Threat Brief: Maze Ransomware

Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.

Palo Alto Networks detected an uptick in Maze ransomware samples across finance, healthcare, government, and other sectors. Maze, a variant of ChaCha ransomware first seen in May 2019, is distributed via weaponized Word/Excel attachments and the Spelevo exploit kit leveraging CVE-2018-15982 and CVE-2018-4878, and has used CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer). Operators establish a foothold, escalate privileges, move laterally, and exfiltrate files before encryption for extortion leverage.

Palo Alto Unit 42 · 29d agoRansomware in the wildCVE-2018-15982CVE-2018-4878CVE-2019-11510+1 CVEs

Threat Assessment: Egregor Ransomware

Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.

Since September 2020, Unit 42 observed Egregor ransomware attacks across the U.S., Europe, Asia-Pacific, and Latin America, coinciding with the Maze team's shutdown announcement. Egregor, a variant of the Sekhmet family, uses commodity malware such as Qakbot, IcedID, and Ursnif for initial access, followed by scripts that modify firewalls, enable RDP, and deploy Cobalt Strike for reconnaissance and exfiltration. A PowerShell script uninstalls the McAfee agent and downloads the Egregor DLL via BITS, executed with the -passegregor10 key. Victims face a three-day ransom deadline before exfiltrated data is published on the Egregor Hall of Shame leak site.

Palo Alto Unit 42 · 29d agoRansomware in the wild

Akira Ransomware Uses Safe Mode to Bypass EDR

An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.

Huntress reports an Akira affiliate gained access on August 4 via an MFA-less SonicWall VPN, enumerated Active Directory, archived file shares with WinRAR, and exfiltrated data to an attacker S3 bucket. The attacker rebooted the host into Safe Mode with Networking and preloaded AnyDesk into the Safe Mode service registry, disabling EDR and Defender's real-time protection for roughly ten minutes. The encryptor failed about 13 seconds after launch with out-of-virtual-memory errors caused by Safe Mode's stripped-down environment, and Defender later removed akira.exe after reboot. Huntress says this is the first observed Safe Mode abuse by Akira, following precedents by Snatch and AvosLocker, and provides detection guidance.

Security Affairs · 29d agoRansomware in the wild