ThreatVectr

Ransomware — Page 5

A federal government building's security entrance with warning notices about a cybersecurity breach, alongside dark web marketplace listings displayed on an inv
Ransomware

US firearms agency ATF confirms 'major incident' as Qilin ransomware gang lists it as a victim

The Bureau of Alcohol, Tobacco, Firearms and Explosives says a standalone system was breached. Qilin added ATF to its dark web leak site the same day.

3 min read
Illustration: A dark computer screen displaying a blinking cursor and encryption-
Ransomware

Ransomware group Helix claims attack on US energy testing firm AmSpec

A criminal gang called Helix has listed AmSpec on its dark-web leak site, claiming to have broken into the company. AmSpec has not confirmed any incident, and the claim remains unverified.

3 min read
A map of critical infrastructure across the United States—hospitals, power plants, banks, defense facilities—with 500 location markers indicating Medusa ransomw
Ransomware

Medusa ransomware has hit 500 critical infrastructure targets, US agencies warn

A fresh CISA advisory says the gang's victim count has jumped from 300 to over 500, with hospitals, defence suppliers and banks all in the firing line.

4 min read
A phishing email displayed on a computer screen claiming to offer ransomware file deletion services, with a demand for $60,000 visible, alongside legitimate ran
Ransomware

The Ransomware Scavengers: 'Ransom Busters' Emails Victims Demanding Up to $60,000

A new outfit is contacting companies already hit by ransomware and offering, for a fee, to wipe their stolen files from the attackers' servers.

4 min read
A dimly lit screen showing fake ransomware recovery interface overlaid with banking and money transfer forms, representing the dual scam of posing as a rescuer
Ransomware

Fake 'Ransom Busters' Service Is Actually a Ransomware Insider Running a Side Scam

A criminal pretending to rescue hack victims is really a ransomware affiliate trying to pocket ransom money before his own gang gets it.

4 min read
Dark computer monitor displaying a marketplace listing interface with redacted company information and encrypted transaction details visible in the glow
Ransomware

Ransomware group Interlock claims attack on Connell Enterprises LLC

A criminal group has listed a US business on its dark-web pressure site. The company has not confirmed anything, and the claim cannot be independently verified.

3 min read
Ransomware gang dark-web listing page displaying stolen Shell engineering documents preview, with file thumbnails showing CAD drawings and project specification
Ransomware

Shell probes possible data theft as Clop ransomware crew names it in engineering software raid

The gang claims 89GB of drawings and project files, part of a wider spree hitting PTC Windchill and FlexPLM systems.

4 min read
A network diagram on a screen showing compromised VPN access points and failed encryption processes, ransomware code partially displayed with error messages, re
Ransomware

Akira gang reboots into Safe Mode to blind security tools, then fumbles the ransom

The hackers walked in through a SonicWall VPN with no second login step, but their own ransomware ran out of memory before it could lock a single file.

4 min read
Government office buildings in Bogotá with police and emergency vehicles outside, while a computer screen inside shows encrypted files and ransomware lock messa
Ransomware

Ransomware Hit Colombia's Justice Ministry Five Days Before a New President Took Office

Files were encrypted, services went down, and ColCERT had warned about exactly this kind of attack the day before. What happened, and why Colombia keeps ending up in the crosshairs.

4 min read
Blockchain network visualization with ransomware extortion demands embedded as smart contracts, Session chat integration visible, and distributed network nodes
Ransomware

DeadLock Ransomware Moves Its Extortion Kit onto the Blockchain

The gang is stitching together Session chat and Polygon smart contracts so takedowns don't stick. Microsoft calls it a resilience play. Ransomware learning from crypto scams is a more accurate description.

3 min read
A network administrator's station showing N-able remote management tool interface with a critical vulnerability notification banner, ransomware encryption progr
Ransomware

Old Medusa Hand, New Locker: Storm-1175 Rolls Out StormEncryptor via N-central Flaw

Microsoft says a China-linked crew is exploiting a critical bug in N-able's remote management tool to plant a fresh ransomware strain, sometimes within days of breaking in.

4 min read
A network operations center with rows of monitors displaying threat alerts and geographic heat maps, red indicators pulsing across continents as analysts in the
Ransomware

US and Korean agencies warn about Gunra, a fast-growing ransomware gang built from leaked Conti code

The FBI, CISA and Korea's National Police Agency say Gunra has hit hospitals, utilities and manufacturers across five continents since April 2025.

4 min read
A network rack in a corporate server room showing a SonicWall appliance with its indicator lights glowing, surrounded by layers of other security hardware, cabl
Ransomware

Ransomware crews are now breaking into SonicWall VPN boxes through two July flaws

CISA says gangs are exploiting a maximum-severity SonicWall SMA1000 bug patched in mid-July. Around 380 appliances are still sitting online.

3 min read
A dark-themed computer screen displaying a minimalist dark-web marketplace interface with red warning symbols and profile listings, with keyboard and mouse in s
Ransomware

Ransomware group Orion claims attack on Morris Group International

A criminal gang has listed the British professional-services firm on its dark-web pressure site. The company has not confirmed anything, and the claim is unverified.

2 min read
A serious courtroom or official government setting with European architecture visible through windows, papers and case files spread across a wooden table, stern
Ransomware

Ransom Cartel Boss Gets 16 Years After $6.7M Extortion Spree

Belarusian national Maksim Silnikau built and ran the ransomware crew from 2021 to 2023, hitting at least 18 companies before Spanish police caught him and Poland handed him over.

4 min read
© 2026 Threat Vectr