ThreatVectr

Ransomware — Page 4

Illustration: a dimly lit server rack in a data centre, one blade server pulled halfway out
Ransomware

ShinyHunters defaces Cl0p's leak site and claims it grabbed the gang's Tor keys

The extortion crew says it walked out with source code, server logs, and the private keys that identify Cl0p's dark-web address. The fight traces back to a stolen Oracle exploit.

4 min read
Illustration: A dimly lit medical office reception desk at night, empty waiting room chairs visible in the background
Ransomware

Ransomware Group Emperador Claims Attack on Alabama Women's Health Clinic

A fast-moving criminal group listed an Alabama reproductive-health practice on its dark-web site, claiming thousands of employee and patient documents. The practice has not confirmed anything.

3 min read
A courtroom setting with ransomware malware code projected on a screen behind the defendant's area, stolen company data files arranged on evidence tables
Ransomware

Ukrainian Conti Ransomware Member Gets Four Years for Extorting 12 Companies

Oleksii Lytvynenko admitted joining the gang in 2021, coding a malware loader, and holding stolen data from a dozen victims for ransom.

3 min read
A school office setting with computers and filing systems representing student records, with a dark web marketplace or ransom demand notice displayed on a separ
Ransomware

Interlock Ransomware Group Claims Attack on Springfield Public Schools

A criminal ransomware gang has listed a Massachusetts school district on its dark-web pressure site, alleging it stole student records, medical information and staff data. The district has not confirmed any incident.

3 min read
A corporate office dealing with incident recovery—multiple workstations being restored, IT technicians coordinating, backup systems and recovery documentation v
Ransomware

The Ransom Is Usually the Smallest Bill After a Ransomware Attack

Downtime, recovery work and legal fees can dwarf the payment itself. Backup and disaster recovery planning changes the maths.

3 min read
An office supply warehouse or storage facility with shelves of products, computer monitors showing warning messages on desks in the foreground, and red alert in
Ransomware

Ransomware group 'thegentlemen' claims attack on Sharp Office

A criminal gang has listed Australian office-supplies company Sharp Office on its dark-web site, claiming to have hit the 90-year-old supplier. The company has not confirmed anything, and the claim is unverified.

3 min read
A corporate network map with AI-driven attack pathways spreading rapidly through nodes in real-time, system compromises represented as cascading failures compre
Ransomware

AI-Assisted Ransomware Gang Tore Through a Corporate Network in Under 10 Hours

Unit 42 researchers watched attackers use AI agents to do in a single working day what normally takes criminal crews two weeks. The case is a signal, not an outlier.

4 min read
An MSP's operations center displaying backup systems, antivirus consoles, and ransomware detection tools all monitored simultaneously with a checklist overlay v
Ransomware

Six things MSPs should actually test before the next ransomware hit

Acronis lays out a practical checklist for managed service providers, moving the conversation past backups and antivirus to the full arc of prevention, detection and recovery.

4 min read
Berlin's government building entrance photographed from street level at dusk, official flags hanging limply, security cameras visible on the facade
Ransomware

Rhysida gang claims theft of 5.79TB from Berlin's city government

The ransomware crew says it took 1.44 million files, including water-supply security assessments and plaintext passwords. Berlin's mayor says the city will not pay.

3 min read
A hacker's workstation showing an AI code assistant interface on one monitor and a network intrusion diagram on another, Russian-language system prompts visible
Ransomware

Aurora ransomware crew caught using Cursor AI to break into networks

Researchers at CloudSEK and Gambit Security independently tie a Russian-speaking gang to at least 10 intrusions built with help from an AI coding assistant backed by SpaceX.

4 min read
A dark web marketplace listing page showing company data file counts and terabyte measurements, medical device schematics pixelated in background, extortion dem
Ransomware

Ransomware group falcon claims attack on Globus Medical

A criminal group has listed the US medical-device maker on its dark-web extortion site, claiming nearly 3 terabytes of sensitive company data. Globus Medical has not publicly confirmed any incident.

3 min read
An Australian independent bookshop interior with empty shelves and a 'Out of Stock' sign prominent, a notice about supply disruption on the counter, holiday dec
Ransomware

Cyber attack on Australian book distributor leaves bookshops empty-handed before Christmas

A suspected ransomware attack on Alliance Distribution Services has disrupted book supply across Australia for six weeks, hitting independent bookshops and Hachette authors at the worst possible time.

4 min read
A federal government building's security entrance with warning notices about a cybersecurity breach, alongside dark web marketplace listings displayed on an inv
Ransomware

US firearms agency ATF confirms 'major incident' as Qilin ransomware gang lists it as a victim

The Bureau of Alcohol, Tobacco, Firearms and Explosives says a standalone system was breached. Qilin added ATF to its dark web leak site the same day.

3 min read
Illustration: A dark computer screen displaying a blinking cursor and encryption-
Ransomware

Ransomware group Helix claims attack on US energy testing firm AmSpec

A criminal gang called Helix has listed AmSpec on its dark-web leak site, claiming to have broken into the company. AmSpec has not confirmed any incident, and the claim remains unverified.

3 min read
A map of critical infrastructure across the United States—hospitals, power plants, banks, defense facilities—with 500 location markers indicating Medusa ransomw
Ransomware

Medusa ransomware has hit 500 critical infrastructure targets, US agencies warn

A fresh CISA advisory says the gang's victim count has jumped from 300 to over 500, with hospitals, defence suppliers and banks all in the firing line.

4 min read
© 2026 Threat Vectr