60
60
60
60
60
60
60
60
60
60
60
Rhysida Publishes Berlin Government Data After €2m Extortion Demand Refused
Rhysida published 5.7 TB of Berlin state government data, including sensitive CBRN emergency plans, after the state refused a €2m ransom demand.
The Rhysida ransomware gang leaked roughly 5.7 TB — about 1.4 million files — stolen from Berlin's state network after the government declined to pay 30 bitcoins (about €2m) by the September 4 deadline. The dump reportedly includes sensitive state emergency plans for terrorist attacks and CBRN disaster scenarios in a folder titled 'AG CBRN-Rahmenplanung', plus personnel files, absence lists, payroll data, and home addresses, potentially affecting tens of thousands of people. Berlin says there are no indications the state network remains compromised and will notify affected individuals on a risk-based basis after forensic analysis.
78
Details emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
Google Threat Intelligence Group (tracking BlackFile as UNC6671, linked to The Com) reports the extortion group remains active, shifting focus to the financial sector and med tech organizations, with new Redact-brand extortion demands issued last week. The group impersonates IT support in voice-phishing attacks using hundreds of recruited callers, targets large firms in what researchers call big-game hunting, and processes an average of 1.5 new victims daily. Extortion demands start around $3 million and are typically negotiated below $1 million; Flashpoint observed infrastructure targeting Blackstone, Bain Capital, Moody's, CME, and Apollo, though compromise is unconfirmed. Mandiant has responded to more than two dozen BlackFile compromises since January, and victims face escalation tactics including swatting.
70
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60