Additional Entities Targeted by DarkSide Affiliate, TAG-21; Links to WellMess and Sliver InfrastructureRecorded Future·Jul 15, 00:00 UTC · Jul 15, 2025Ransomware57
Cybercrime Groups Increasingly Adopting Sliver Command-andThe Hacker News·Aug 27, 03:07 UTC · Aug 27, 2022Ransomware57
Head Mare hacktivists: attacks on companies in Russia and BelarusKaspersky Securelist·Sep 2, 10:00 UTC · Sep 2, 2024RansomwareCVE-2023-38831160
North Korean Group Collaborates with Play Ransomware in Significant Cyber AttackThe Hacker News·Nov 4, 05:55 UTC · Nov 4, 2024Ransomware57
North Korean Hackers Collaborate with Play RansomwareInfosecurity Magazine·Oct 31, 13:00 UTC · Oct 31, 2024Ransomware57
Avos ransomware group expands with new attack arsenalCisco Talos·Jun 21, 11:58 UTC · Jun 21, 2022RansomwareCVE-2021-44228CVE-2021-45046CVE-2021-45105+1 CVEs60
Hackers Exploiting SimpleHelp RMM Flaws for Persistent Access and RansomwareThe Hacker News·Feb 7, 05:20 UTC · Feb 7, 2025RansomwareCVE-2024-57726CVE-2024-57727CVE-2024-5772860
North Korean hackers pave the way for Play ransomwareHelp Net Security·Oct 31, 00:00 UTC · Oct 31, 2024Ransomware57
Head Mare hacktivist group targets Russia and BelarusSecurity Affairs·Sep 4, 14:22 UTC · Sep 4, 2024RansomwareCVE-2023-3883160
TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal InfrastructureThe Hacker News·Feb 9, 08:37 UTC · Feb 9, 2026RansomwareCVE-2025-55182CVE-2025-29927160
Adversary Infrastructure Report 2020: A Defender’s ViewRecorded Future·Jan 2, 00:00 UTC · Jan 2, 2026Ransomware57
ToolShell bug used by Chinese attackers against governments in Africa, South AmericaThe Record·Oct 22, 19:04 UTC · Oct 22, 2025RansomwareCVE-2025-53770CVE-2025-4970660
2024 Malicious Infrastructure Insights: Key Trends and ThreatsRecorded Future·Aug 20, 00:00 UTC · Aug 20, 2025Ransomware57
Private US companies targeted by Stonefly APTHelp Net Security·Oct 3, 00:00 UTC · Oct 3, 2024Ransomware57
Andariel Hacking Group Shifts Focus to Financial Attacks on U.S. OrganizationsThe Hacker News·Oct 2, 10:30 UTC · Oct 2, 2024Ransomware57
Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming PatternThe Hacker News·May 24, 05:01 UTC · May 24, 2024Ransomware57
FBI and CISA published a new advisory on AvosLocker ransomwareSecurity Affairs·Oct 13, 10:55 UTC · Oct 13, 2023Ransomware57
ShadowSyndicate Investigation Reveals RaaS TiesInfosecurity Magazine·Sep 26, 16:30 UTC · Sep 26, 2023Ransomware57
Novel Open Source Supply Chain Attacks Target Banking SectorInfosecurity Magazine·Jul 24, 12:00 UTC · Jul 24, 2023Ransomware57
Buhti ransomware op uses rebranded LockBit and Babuk payloadsSecurity Affairs·May 27, 10:56 UTC · May 27, 2023RansomwareCVE-2023-27350CVE-2022-4798660
New EX-22 Tool Empowers Hackers with Stealthy Ransomware Attacks on EnterprisesThe Hacker News·Mar 1, 03:56 UTC · Mar 1, 2023Ransomware57
Quarterly Report: Incident Response Trends in Q3 2022Cisco Talos·Oct 25, 12:00 UTC · Oct 25, 2022RansomwareCVE-2020-147260
ThreatsCisco Talos·Sep 9, 18:46 UTC · Sep 9, 2022Ransomware in the wildCVE-2025-20333CVE-2025-20362CVE-2024-457760
New 'Quantum' Builder Lets Attackers Easily Create Malicious Windows ShortcutsThe Hacker News·Jun 25, 04:05 UTC · Jun 25, 2022Ransomware57
State-Backed Hackers Using Ransomware as a Decoy for Cyber Espionage AttacksThe Hacker News·Jun 25, 04:04 UTC · Jun 25, 2022Ransomware57
Talos Threat SpotlightsCisco Talos·Apr 14, 00:00 UTC · Apr 14, 2022Ransomware in the wildCVE-2024-4577160