ThreatVectr

Ransomware — Page 6

Medical records and billing documents scattered across a dark background with digital overlay showing data transfer indicators and timestamps from September 202
Ransomware

PEAR ransomware crew claims 1.26 million-record breach at Georgia billing firm MCBS

Medical Computer Business Services says attackers roamed its network for four days in September 2025. A ransomware group now claims it stole 3.3 terabytes of patient and business data.

3 min read
Dark web marketplace interface in ruins with seized banners overlaid, LockBit's reputation metrics plummeting on charts, ransom payment flows cut off, server eq
Ransomware

How the FBI Took Down LockBit by Destroying the One Thing Criminals Can't Easily Replace: Trust

Operation Cronos didn't just seize servers. It turned LockBit's own website against its partners, shattered the group's reputation, and cut US ransom payments by 79 percent in the second half of 2024.

4 min read
A darkened office at 4 a
Ransomware

Your ransomware playbook is probably putting the wrong person in charge at 4 a.m.

A growing body of evidence shows that the real damage in ransomware incidents often comes not from the attack itself, but from who gets to decide whether to pull the plug on a business-critical system.

5 min read
Criminal operations control center aesthetic: multiple monitors displaying a sleek dashboard interface with malware building tools, victim management panels, an
Ransomware

DevMan Ransomware Runs a One-Stop Web Portal for Its Criminal Affiliates

Swiss researchers say the operation, tracked as Funky Mantis, gives partners a single dashboard to build malware, chase payments, and manage victims.

3 min read
A Windows desktop showing Chrome and Edge browser windows running invisibly in the background taskbar while a user works normally, command signals flowing throu
Ransomware

Chaos ransomware crew hides its remote control tool inside your own browser

A new backdoor called msaRAT launches Chrome or Edge in the background and pipes attacker commands through it, so no direct link to the criminal server ever appears on the network.

4 min read
A digital marketplace interface showing ransomware tools and attack kits available for subscription-based rental, displayed like a software-as-a-service storefr
Ransomware

What is ransomware-as-a-service? A plain-English guide

Ransomware-as-a-service lets criminals rent attack tools from developers, the same way businesses subscribe to software, making large-scale extortion attacks available to almost anyone.

5 min read
A computer screen progression showing files progressively locking, warning messages appearing, and a ransom note displayed, followed by encrypted storage indica
Ransomware

What is ransomware and how does an attack actually unfold?

Ransomware locks your files or systems until you pay criminals to restore access. Here is exactly how that happens, step by step.

5 min read
Illustration: Stadler Rail trains in a manufacturing facility, railway tracks visible, clear sky
Ransomware

Swiss Train Manufacturer Stadler Rail Rejects $12.3 Million Ransom Demand

Stadler Rail won't pay Everest ransomware after a supplier platform was breached; operations stayed intact.

3 min read
A dark web marketplace interface displaying a listed company name and terabyte-sized data package with a countdown timer and ransom demand message in the listin
Ransomware

Anubis Ransomware Group Claims Fairlife Attack, Threatens to Leak 1 TB of Data

Coca-Cola's milk brand has a week to pay an undisclosed ransom, or criminals say they will publish what they took.

3 min read
A dark web marketplace listing page displaying a credit union's name and claimed stolen files announcement, with criminal group branding and data package detail
Ransomware

DragonForce Claims Attack on One Community FCU, Alleges Member Data Stolen

A ransomware group has listed a US credit union on its dark-web site, claiming to hold internal files and member financial records. The credit union has not confirmed any incident.

3 min read
A global map visualization showing ransomware attack incident markers distributed across continents, with statistics and growth indicators displayed showing the
Ransomware

Ransomware Attacks Rose 25% in a Year. Artificial Intelligence Isn't the Main Driver.

A new report tracked 7,551 victims worldwide between April 2025 and March 2026. The growth came from more criminal groups, weaker targets, and supply-chain shortcuts, not fancy AI tools.

3 min read
Illustration: a dimly lit server room with a rack-mounted enterprise firewall appliance glowing red on its status LEDs
Ransomware

Qilin ransomware crew is breaking into Palo Alto VPNs through an unpatched flaw

Arctic Wolf says multiple Qilin affiliates are exploiting CVE-2026-0257 in Palo Alto Networks firewalls to encrypt whole networks. Over 167,000 VPN instances remain exposed online.

3 min read
Illustration: a dim server room with racks of GPU servers glowing faint amber
Ransomware

ENCFORGE: The Ransomware That Goes After AI Brains, Not Your Spreadsheets

Sysdig says the same crew that broke into a Langflow server earlier this month is back, and this time it encrypts model weights instead of office files.

3 min read
Illustration: a dim data centre aisle, rack-mounted servers glowing with cool blue status lights
Ransomware

AI-hunting ransomware 'EncForge' locks up model files as JadePuffer agent adapts on the fly

The autonomous attacker rewrote its own delivery script six times in five minutes before encrypting a Langflow server's machine-learning assets.

4 min read
Illustration: an empty airport departure hall at dusk
Ransomware

Armenia Grabs Russian Tourist at Yerevan Airport on U.S. REvil Warrant

Aleksandr Ermakov has sat in an Armenian detention center since June 28. His lawyers say the FBI has the wrong man.

3 min read
© 2026 Threat Vectr