Fake Tech Support Spam Deploys Customized Havoc C2 Across OrganizationsThe Hacker News·Mar 3, 17:15 UTC · Mar 3, 2026Ransomware57
All gas, no brakes: Time to come to AI churchCisco Talos·Feb 5, 19:00 UTC · Feb 5, 2026Ransomware in the wild60
CISA confirms exploitation of VMware ESXi flaw by ransomware attackersHelp Net Security·Feb 5, 00:00 UTC · Feb 5, 2026Ransomware in the wildCVE-2025-22225CVE-2025-22224CVE-2025-2222660
CVE-2025-22225 in VMware ESXi now used in active ransomware attacksSecurity Affairs·Feb 4, 22:02 UTC · Feb 4, 2026Ransomware in the wildCVE-2025-22225CVE-2025-22226CVE-2025-2222460
Chinese-speaking hackers exploited ESXi zeroSecurity Affairs·Jan 9, 00:06 UTC · Jan 9, 2026Ransomware in the wildCVE-2025-22226CVE-2025-22224CVE-2025-2222560
For the first time, a RomCom payload has been observed being distributed via SocGholish.Security Affairs·Nov 26, 20:16 UTC · Nov 26, 2025Ransomware57
SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware HackersThe Hacker News·Sep 15, 00:00 UTC · Sep 15, 2025Ransomware in the wildCVE-2024-4076660
Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon’s Reach to Linux and macOSThe Hacker News·Aug 15, 00:00 UTC · Aug 15, 2025Ransomware57
Charon Ransomware targets Middle East with APT attack methodsSecurity Affairs·Aug 13, 08:43 UTC · Aug 13, 2025Ransomware57
Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched SystemsThe Hacker News·Jul 28, 15:57 UTC · Jul 28, 2025Ransomware in the wildCVE-2025-49706CVE-2025-4970460
Hackers Exploit Apache HTTP Server Flaw to Deploy Linuxsys Cryptocurrency MinerThe Hacker News·Jul 21, 06:31 UTC · Jul 21, 2025RansomwareCVE-2021-41773CVE-2024-36401CVE-2023-22527+5 CVEs60
FIN7, FIN8, and Others Use Ragnar Loader for Persistent Access and Ransomware OperationsThe Hacker News·Mar 8, 11:50 UTC · Mar 8, 2025Ransomware60
Iranian APT UNC1860 Linked to MOIS Facilitates Cyber Intrusions in Middle EastThe Hacker News·Sep 20, 12:44 UTC · Sep 20, 2024RansomwareCVE-2019-060460
Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and GolangThe Hacker News·Jan 30, 07:39 UTC · Jan 30, 2024Ransomware157
Hackers Weaponize Windows Flaw to Deploy CryptoThe Hacker News·Jan 15, 00:00 UTC · Jan 15, 2024RansomwareCVE-2023-3602560
Analysis of Cuba ransomware gang activity and toolingKaspersky Securelist·Sep 11, 10:00 UTC · Sep 11, 2023RansomwareCVE-2021-31207CVE-2021-34473CVE-2021-34523+8 CVEs60
Alert: Juniper Firewalls, Openfire, and Apache RocketMQ Under Attack from New ExploitsThe Hacker News·Sep 6, 07:46 UTC · Sep 6, 2023Ransomware in the wildCVE-2023-36844CVE-2023-36845CVE-2023-36846+3 CVEs60
UNRAVELING EternalBlue: inside the WannaCry’s enablerSecurity Affairs·Sep 1, 14:43 UTC · Sep 1, 2023Ransomware57
FIN8 Group Using Modified Sardonic Backdoor for BlackCat Ransomware AttacksThe Hacker News·Jul 19, 03:25 UTC · Jul 19, 2023Ransomware57
Quarterly Report: Incident Response Trends in Q1 2023Cisco Talos·Apr 26, 12:00 UTC · Apr 26, 2023Ransomware57
Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware ExploitThe Hacker News·Apr 15, 00:00 UTC · Apr 15, 2023Ransomware in the wildCVE-2023-28252CVE-2022-24521CVE-2022-37969+6 CVEs60
Kaspersky crimeware report: uncommon infection methodsKaspersky Securelist·Apr 13, 08:00 UTC · Apr 13, 2023Ransomware57
Security tools showcased at Black Hat USA 2021The Record·Jan 18, 00:00 UTC · Jan 18, 2023Ransomware57
2022 Top Five Immediate Threats in Geopolitical ContextThe Hacker News·Dec 28, 16:24 UTC · Dec 28, 2022Ransomware160
Crimeware and financial cyberthreats in 2023Kaspersky Securelist·Nov 22, 08:00 UTC · Nov 22, 2022Ransomware60
A cracked copy of Brute Ratel post-exploitation tool leaked on hacking forumsSecurity Affairs·Sep 29, 09:54 UTC · Sep 29, 2022Ransomware57
Google Uncovers 'Initial Access Broker' Working with Conti Ransomware GangThe Hacker News·Jul 21, 13:32 UTC · Jul 21, 2022RansomwareCVE-2021-4044460
AvosLocker Ransomware Variant Using New Trick to Disable Antivirus ProtectionThe Hacker News·May 3, 05:50 UTC · May 3, 2022RansomwareCVE-2021-40539CVE-2021-4422860
The TTPs of Conti's initial access brokerHelp Net Security·Mar 18, 00:00 UTC · Mar 18, 2022RansomwareCVE-2021-4044460
Windows MSHTML 0-Day Exploited to Deploy Cobalt Strike Beacon in Targeted AttacksThe Hacker News·Nov 12, 15:17 UTC · Nov 12, 2021RansomwareCVE-2021-4044460
Elastic expands its threat prevention capabilities to stop advanced threats at the endpointHelp Net Security·Oct 28, 11:42 UTC · Oct 28, 2021Ransomware57
Elastic's enhancements optimize search experiences for customersHelp Net Security·Oct 28, 11:41 UTC · Oct 28, 2021Ransomware57
IT threat evolution Q2 2021Kaspersky Securelist·Aug 12, 10:12 UTC · Aug 12, 2021RansomwareCVE-2018-0802CVE-2021-1732CVE-2021-28310+2 CVEs60
IT threat evolution Q1 2021Kaspersky Securelist·May 31, 07:32 UTC · May 31, 2021Ransomware in the wildCVE-2021-26855CVE-2021-26857CVE-2021-26858+1 CVEs60
Experts linked ransomware attacks to ChinaSecurity Affairs·Jan 5, 17:48 UTC · Jan 5, 2021RansomwareCVE-2017-021360
Looking at Big Threats Using Code SimilarityKaspersky Securelist·Jun 9, 10:00 UTC · Jun 9, 2020Ransomware57
Threat Roundup for December 13 to December 20Cisco Talos·Dec 20, 18:07 UTC · Dec 20, 2019Ransomware57