ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “multi-extortion”

23 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 10
SeverityAllcritical 9high 0medium 0low 0info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Ransomware negotiation tactics have turned into a business process

Intel 471's Dave Ross details ransomware negotiation tactics, with demands typically set at 1-5% of annual revenue and specialized criminal service roles.

In a Help Net Security video, Intel 471 Senior Director Dave Ross explains how ransomware groups research a victim's revenue and insurance coverage, run test decryptions to prove they hold a working key, and set demands at roughly 1% to 5% of annual revenue. He describes negotiation dynamics with shifting deadlines and a criminal service economy supplying language skills, data review, and legal analysis. Multi-extortion methods include data theft, DDoS attacks, and direct contact with customers and journalists.

Help Net Security · 8d agoRansomware

Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!

Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.

Risky Business News, citing Google Threat Intelligence Group (GTIG), reports that cybercriminals are shifting from encrypting ransomware to data theft extortion. Law firms Goodwin Procter and WilmerHale paid Silent Ransom (Luna Moth) ransoms of $10 million and $18 million respectively; GTIG says the group often completes contact-to-extortion in a single day, now sometimes compromising systems in person posing as IT staff. BlackFile, now calling itself Redact, used high-volume vishing to steal credentials and pivot through OneDrive, SharePoint and other SaaS apps, collecting more than $10 million between February and mid-May with an average ransom of $750,000, including attempted attacks on Wall Street hedge funds and private equity firms. The piece argues governments should keep pressure on encrypting ransomware gangs while lower-impact extortion absorbs criminal energy.

Risky Business News · Aug 13, 2026Threat actor1

The GTA VI leaks are breaking the internet. Security researchers have seen this before.

A hacker or insider leaked GTA VI gameplay footage before launch, triggering Take-Two DMCA subpoenas against Discord, Google, Microsoft and X.

The persona "CyberLeek" published stolen Grand Theft Auto VI gameplay footage and a manifesto, in what experts call a familiar data extortion playbook with monetization via watermarks, crypto wallets and a memecoin. Take-Two Interactive obtained DMCA subpoenas against Discord, Microsoft and X, and sent copyright notices to Google, treating the case like an insider threat investigation. GTA VI is projected to earn $3.3–5.2 billion in launch-week sales, raising financial and reputational stakes. Related leak websites went offline after the subpoenas.

CyberScoop · 21d agoData breach

Berlin refuses to be blackmailed after network breach

Rhysida extorts Berlin's state government after stealing 5.79 TB across 1.44 million files, demanding roughly 2 million euros in bitcoin.

Berlin's state government confirmed an extortion attempt after data theft from its administrative network between August 7 and 12, with affected departments disconnected only on August 14. The Rhysida ransomware gang lists 5.79 TB across 1.44 million files on its leak site, including HR files, contracts, 148 IBANs, personal data on 12,076 individuals, and plaintext credentials from internal systems including Berlin's leadership. Der Spiegel reports a 30 bitcoin demand of about 2 million euros; officials say the city will not pay and investigators include the State Criminal Police Office and federal agencies. Forensics revealed additional leaks in the Senate Department for Mobility, Transport, Climate Protection and the Environment, while the Berlin House of Representatives election environment is reported secure.

Help Net Security · 15d agoRansomware in the wild

Researchers Confirm ExfilSquad’s Access to Sensitive Data Across 13 Organizations

Researchers confirmed extortion group ExfilSquad holds stolen sensitive data from at least 13 organizations, publishing leaked datasets via torrents.

Security researchers verified that the extortion group ExfilSquad possesses sensitive data stolen from at least 13 victim organizations. The group distributed the leaked datasets publicly through torrents rather than a traditional leak site. Independent verification of the stolen data lends credibility to the group's extortion claims against its victims.

Infosecurity Magazine · Aug 14, 2026Ransomware

Extortion crews have their eyes on high-value AI data, Google warns

Google's Mandiant warns extortion crews now steal proprietary AI models, prompts, and research for ransom, while threat actors automate attacks with agentic AI.

Google's AI Threat Tracker details intrusions in which extortion crews exfiltrated healthcare drug research and a proprietary AI model, and stole an AI media company's source code, prompts, skills, model scripts, and secrets, threatening leaks unless paid. TeamPCP (UNC6780), behind large open-source supply chain attacks on PyPI, npm, and Docker Hub since March, used a malicious GitHub Actions workflow to exfiltrate a company's proprietary AI repository. Mandiant also observed a fully autonomous multi-agent credential-harvesting cloud intrusion completed in under six hours, and a China-linked espionage group using Gemini to build a dynamic automated penetration-testing framework.

The Register · Security · 8d agoThreat actor in the wild 2 sources1

Weekly Update 517: Cyber Ransoms

Troy Hunt's weekly commentary argues much ransomware is simple extortion by young actors who struggle to monetize ransoms.

In Weekly Update 517, Troy Hunt comments on the current ransomware landscape, noting many attacks involve pure extortion rather than actual malware. He observes that many actors are young and earn large sums but face practical difficulties spending ransom proceeds. The piece is opinion commentary rather than a new incident disclosure.

Troy Hunt · 29d agoIndustry

Man gets 15 years for extorting women with AI-generated porn videos

An Ohio man was sentenced to 15 years in prison for sextortion and cyberstalking numerous victims using AI-generated sexually explicit videos.

An Ohio man received a 15-year prison sentence for multiple cybercrimes. The offenses included sextortion and cyberstalking of numerous victims, with AI-generated sexually explicit content used against the victims. The case illustrates criminal justice outcomes for offenders using AI-generated imagery in extortion schemes.

BleepingComputer · 7d agoPolicy & legal

INTERPOL crackdown on West African crime rings uncovers troubling new trend

INTERPOL's Operation Jackal IV arrested 58 suspects across 22 countries targeting Black Axe-linked West African fraud networks, flagging a rising trend of sextortion against minors.

Operation Jackal IV (November 2025 to June 2026) coordinated arrests across 22 countries against West African organized crime groups such as Black Axe, which INTERPOL links to a large share of global cyber-enabled fraud. Johannesburg raids on a romance and investment scam syndicate targeting retirees yielded $2.67 million seized, 257 bank accounts frozen and 39 arrests, while Argentina exposed a 196-member Crime-as-a-Service network with 17 arrests. Romanian police dismantled a call-center investment scam with roughly €143 million stolen and laundered, and INTERPOL warned these groups increasingly sextort minors as young as 14 and procure Crime-as-a-Service via the dark web.

Help Net Security · 22d agoThreat actor

Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks

ShinyHunters exploited an Oracle PeopleSoft zero-day to steal data and extort roughly 100 organizations, including the Council of Europe, for up to $2.3M.

Between May and early June 2026, the ShinyHunters group exploited a critical zero-day in Oracle PeopleSoft across about 100 organizations and 300 instances worldwide, per reports cited by The Register. Stolen records included employee and student personal data, payroll, tax, financial and health information, plus immigration and passport documents. AgentCypher.ai estimates extortion demands of $400,000 to $2.3 million per victim, typically in Bitcoin; the Council of Europe refused to pay. The article uses the incident to argue for Zero Trust, supply-chain risk management, rapid patching, encrypted distributed backups and defined recovery-time objectives.

Cyber Security News · 4d agoData breach in the wild1

Harley-Davidson Alleged Breach – CL0P Ransomware Adds Motorcycle Maker to the List

CL0P ransomware group listed Harley-Davidson on its extortion leak site, claiming a compromise; the motorcycle maker has not confirmed any breach.

The CL0P ransomware operation added Harley-Davidson to its public extortion portal, a listing highlighted by the ransomNews monitoring account on September 10, 2026. Harley-Davidson has not confirmed any compromise, and the initial access method, affected business unit, timing, and volume of stolen data remain unknown, with no sample files or technical indicators published. The article stresses that leak-site listings alone do not confirm a breach and can serve as negotiation pressure in double-extortion schemes. If verified, stolen data could fuel downstream phishing, BEC, credential-stuffing, and invoice fraud targeting dealers, suppliers, and customers.

Cyber Security News · 5d agoRansomware

Ransomware attackers are zeroing in on mid-market companies

Black Kite found mid-market firms were 73% of disclosed ransomware victims in North America and Europe from January 2023 to June 2026.

Black Kite analyzed 13,336 publicly disclosed ransomware and data-extortion incidents with known revenue between January 2023 and June 2026, finding mid-market companies (annual revenue $10M-$1B) accounted for 73% of victims in North America and Europe, consistently between 72% and 75%. Manufacturing was the most affected sector, followed by professional, scientific, and technical services and construction. Of more than 120,000 assessed mid-market organizations, 54.7% had at least one significant patch-management issue on a public-facing system, over a quarter had a known-exploited vulnerability, and nearly one-third had stealer-log credential findings.

Help Net Security · 23d agoRansomware

ExfilSquad Targets New Victims, Shares Data via Torrents

Extortion group ExfilSquad lists 13 new US, UK and Swedish victims and now distributes stolen data via peer-to-peer torrents.

ExfilSquad, a data-theft extortion collective that emerged in mid-2026, announced 13 new victims in the US, UK and Sweden with an August 5, 2026 negotiation deadline. The group skips ransomware, instead stealing data and threatening publication on a dark web leak site. Resecurity says its TTPs center on exploiting misconfigured Microsoft Dataverse, Power Pages, case management and CRM portals. The group now distributes stolen data through per-victim torrent trackers and web seeds, making leaks hard to contain.

Security Affairs · Aug 11, 2026Threat actor in the wild

Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams

INTERPOL's Operation Jackal IV made 58 arrests across 22 countries, disrupting Black Axe-linked networks laundering scam, BEC and sextortion proceeds.

INTERPOL's Operation Jackal IV (November 2025–June 2026) involved 22 countries and led to 58 arrests and 263 suspects identified tied to West African organized crime networks such as Black Axe. Key actions included 39 arrests in South Africa with $2.67 million seized and 257 bank accounts frozen, 17 arrests in Argentina against a crime-as-a-service laundering network, and a Romanian call-center investment scam with estimated global losses around €143 million. The operation also flagged rising sextortion of minors as young as 14 by these networks.

Security Affairs · 21d agoThreat actor

Active Ransomware Groups Surge

The number of active ransomware groups has surged, expanding the threat landscape as more crews run independent extortion operations.

Infosecurity Magazine reports that the count of active ransomware groups has surged according to recent tracking data. More independently operating crews increase the number of extortion operations defenders must monitor. The available information did not name the specific groups contributing to the increase.

Infosecurity Magazine · 28d agoRansomware

McKesson copes with fallout from data theft extortion attack

McKesson discloses a data theft extortion attack by ShinyHunters affecting oncology and medical-surgical customers, with a reported $55 million demand.

McKesson disclosed that attackers gained access to some of its third-party applications and stole data associated with a subset of customers in its oncology, multispecialty, and medical-surgical business units; the intrusion ran for four days from August 21 and was discovered August 25. ShinyHunters claimed responsibility and listed McKesson on its data-leak site, reportedly demanding more than $55 million with a September 1 deadline. Flashpoint analysts say the group typically uses social engineering and identity weaknesses with valid credentials to access cloud-hosted environments, making the intrusion hard to detect. McKesson, which distributes about one-third of pharmaceuticals used in North America with $403.4 billion in annual revenue, says operations continue and it has reasonable assurance of no ongoing unauthorized activity.

CyberScoop · 16d agoData breach in the wild

US disrupts Xinbi Guarantee marketplace fueling the cyber scam economy

US Treasury sanctions and DOJ seizures take down Xinbi Guarantee, a Telegram marketplace that processed $24B+ for cyber scams, freezing $52.8M.

The Treasury Department sanctioned the Chinese-language Telegram marketplace Xinbi Guarantee and two supporting firms, Anwen Technology (XinbiPay) and SafeW Technology, while the DOJ seized its Telegram channels and $52.8 million in USDT from 52 wallets. Blockchain intelligence firm Elliptic, which assisted the Secret Service, estimates Xinbi has processed at least $24 billion in transactions since 2022, making it the second-largest illicit online marketplace and a cornerstone of Southeast Asian cybercrime. Vendors sold money laundering, stolen personal data, deepfake technology, and other services for pig-butchering scams, with payments in Tether's USDT. The DOJ's Scam Center Task Force also dismantled 13 scam centers in Madagascar, arresting dozens of alleged leaders who were repatriated to China.

The Record · 7d agoPolicy & legal

Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials

AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.

Australian police charged two Western Australian men as principal participants in TeamPCP, which allegedly inserted malicious code into open-source software to steal credentials and sensitive data from government, academia, and private sector organizations worldwide. The campaign compromised more than 1,000 organizations, harvested over 500,000 credentials, and exfiltrated at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. Four malware families were deployed: CanisterWorm (cloud token harvesting), SANDCLOCK (AWS and Kubernetes credential theft), Mini Shai-Hulud (self-replicating npm/PyPI worm), and Miasma (credential-harvesting worm variant). Trojanized tools included Trivy, KICS, LiteLLM, and the Telnyx Python SDK, with exfiltration via GitHub repositories tpcp-docs and docs-tpcp.

Security Affairs · 20d agoThreat actor in the wild1

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

US DOJ and Treasury disrupt Xinbi Guarantee Telegram scam marketplace, sanctioning it and freezing $52.8M in USDT across 52 wallets.

The DOJ seized Xinbi Guarantee's Telegram channels and cryptocurrency wallets while OFAC sanctioned the marketplace, freezing $52.8 million in USDT from 52 wallets and bringing the Scam Center Strike Force's total restrained funds to roughly $938 million. Elliptic, which worked with the Secret Service, estimates Xinbi has processed $30 billion in transactions since around 2022, serving pig-butchering scam operators and links to North Korean hackers, Jin Bei Group, and Prince Group TCO. The strike force dismantled 13 scam compounds in Madagascar, seizing over 3,200 devices and interviewing roughly 400 arrestees, with about 30 Chinese compound leaders repatriated to China. After Tether froze funds, Xinbi began converting remaining USDT into the USDD stablecoin.

The Hacker News · 7d agoPolicy & legal

Interpol's Jackal IV Disrupts West African Crime Infrastructure

Interpol's Operation Jackal IV disrupted crime-as-a-service infrastructure in West Africa used by networks such as Black Axe.

Interpol coordinated Operation Jackal IV, an international law enforcement action targeting cybercrime infrastructure in West Africa. The operation focused on disrupting crime-as-a-service networks, including infrastructure supporting groups like Black Axe. Dark Reading's threat intelligence desk reported on the disruption of the criminal networks' operational capability.

Dark Reading · 21d agoPolicy & legal

Copyright scammers get Instagram accounts suspended and demand payment

Scammers file fake Instagram copyright complaints to suspend accounts, then demand ransom via Telegram; Meta restored some affected accounts.

Criminals impersonate rights holders to file fraudulent copyright complaints on Instagram, and repeated claims can trigger temporary account suspensions. They then move victims to Telegram and demand payment, often in cryptocurrency, to withdraw the complaint; one history account owner paid $50 and was targeted again immediately. Meta's automated system does not verify complainants before acting, and the Delhi High Court is examining whether platforms can legally suspend accounts over copyright claims. Meta acknowledged in court that 13 strike notices against one user were fraudulent, and after BBC review it restored affected content and added unspecified protections.

Malwarebytes Labs · 6d agoPhishing & fraud in the wild