Elektrine
Log in Register

#ransomware

331 posts · Last used 16d

BrianKrebs @briankrebs@infosec.exchange
· 2w ago
Boosted by @trending@homestead.social
Breaking, exclusive: Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. From the story: "KrebsOnSecurity has learned from two sources close to the ShinyHunters probe that FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website “shinywire[.]com.” KrebsOnSecurity is not naming the U.S. company or the suspected executive(s) for now because they have not yet been charged with a crime, but it is a prestigious firm with more than 1,000 associates." https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/ #shinyhunters #cybercrime #ransomware #fbi #shinywire
krebsonsecurity.com

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security

110
9
133
4
CyberScoop @cyberscoop@robot.villas
· 3w ago
Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions https://cyberscoop.com/monstercloud-zohar-pinhasi-ransomware-recovery-scheme/ #Cybersecurity #Cybercrime #Ransomware
Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions
cyberscoop.com

Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions

Zohar Pinhasi allegedly deceived ransomware recovery clients into a payment scheme disguised as a specialized service that helped victims avoid paying cybercriminals.

0
0
0
0
Security Crawler Carl @security_crawler_carl@infosec.exchange
· 1mo ago
Replying to
Reward: You've received the Fossil Record Badge — a commemorative exhibit of everything that used to be private. https://securityboulevard.com/2026/10/ransomware-data-theft-surged-275-in-2026-schools-hospitals-and-government-agencies-had-some-of-the-largest-claims #Ransomware #CyberSecurity #DataBreach #InfoSec #CriticalInfrastructure #AchievementUnlocked (3/3)
Ransomware Data Theft Surged 275% in 2026: Schools, Hospitals, and Government Agencies Had Some of the Largest Claims
securityboulevard.com

Ransomware Data Theft Surged 275% in 2026: Schools, Hospitals, and Government Agencies Had Some of the Largest Claims

Data exfiltrated by leading ransomware groups jumped 275.8% year over year to 896.2 terabytes, according to the Zscaler ThreatLabz 2026 Ransomware Report. That is more than seven times the volume recorded during the 2023–2024 reporting period. As organizations move more sensitive…

0
0
0
0
Security Crawler Carl @security_crawler_carl@infosec.exchange
· 1mo ago
Replying to
https://industrialcyber.co/reports/enisa-threat-landscape-2026-highlights-ransomware-vulnerability-exploitation-ai-enabled-attacks-across-eu-organizations #CyberSecurity #Ransomware #Vulnerabilities #DDoS #ThreatLandscape #PatchedOrPerish (3/3)
ENISA Threat Landscape 2026 highlights ransomware, vulnerability exploitation, AI-enabled attacks across EU organizations - Industrial Cyber
industrialcyber.co

ENISA Threat Landscape 2026 highlights ransomware, vulnerability exploitation, AI-enabled attacks across EU organizations - Industrial Cyber

ENISA Threat Landscape 2026 highlights ransomware, vulnerability exploitation, AI-enabled attacks across EU organizations

0
0
0
0
CTI.FYI @CTI_FYI@infosec.exchange
· 1mo ago
🚨New ransom group blog posts!🚨 Group name: AuditTeam Post title: vit.ac.in Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: TEK SPB Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: kit-e.jp Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: krimax.org Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: gownet.net Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: dg.ac.kr Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: buben Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: Wise IT Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: palletshop Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: PIT.local Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: mansurovogroup Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: Demidov Steel Group Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: I-SYS Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: Mopas Online Supermarket Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: Trésor Public Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: joycity Info: https://cti.fyi/groups/AuditTeam.html Group name: AuditTeam Post title: Kawasaki Motors Philippines Corporation Info: https://cti.fyi/groups/AuditTeam.html #ransomware #cti #threatintelligence #cybersecurity #infosec
AuditTeam Ransomware Group | CTI.FYI
cti.fyi

AuditTeam Ransomware Group | CTI.FYI

Track AuditTeam ransomware group activity and threat intelligence.

0
0
0
0
CyberWorldOps @cyberworldops@infosec.exchange
· 1mo ago
Analysis of the 2005-2008 Exploit.in dump (9,647 accounts, 80,891 posts) links early forum users to later ransomware ecosystem actors. Username matches suggest continuity but are insufficient for attribution alone, highlighting a small durable core. #Cybercrime #Ransomware #ThreatIntelligence
Exploit.in Early Database Reveals Small Cybercrime Core
cyberworldops.eu

Exploit.in Early Database Reveals Small Cybercrime Core

Analysis of Exploit.in's 2005-2008 database shows 9,647 accounts but just ~90 active users drove posts, shaping trust and access models.

0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
Today's ransomware targets: Sweden: Securitas Group https://ransomware.live/id/U2VjdXJpdGFzIEdyb3VwQGV2ZXJlc3Q US: Breast Implant Center of Hawaii https://ransomware.live/id/QnJlYXN0IEltcGxhbnQgQ2VudGVyIG9mIEhhd2FpaUBXYWxsc3RyZWV0 TapClicks marketing analytics platform (new actor) https://ransomware.live/id/VGFwQ2xpY2tzIChtYXJrZXRpbmcgYW5hbHl0aWNzIHBsYXRmb3JtKUBOMG4 More https://ransomware.live/ #infosec #ransomware #cybercrime
Victim: Securitas Group – everest
ransomware.live

Victim: Securitas Group – everest

Ransomware.live discovered on 2026-09-25 that Securitas Group has been claimed by Everest ransomware group

0
0
0
0
Security Crawler Carl @security_crawler_carl@infosec.exchange
· 1mo ago
Replying to
Reward: You've received the Summer 2026 Memorial Plaque. It hangs where your incident response plan used to be. https://www.darkreading.com/cyberattacks-data-breaches/3-cyber-threats-defined-summer-2026 #CyberSecurity #Ransomware #ThreatIntelligence #CriticalInfrastructure #AISecurityThreats #SummerOfCyberChaos (3/3)
3 Cyber Threats That Defined the Summer of 2026
darkreading.com

3 Cyber Threats That Defined the Summer of 2026

This Reporters' Notebook video discusses AI agents breaching Hugging Face, Fairlife's ransomware attack, and threat actors targeting a dozen water systems.

0
0
0
0
Security Crawler Carl @security_crawler_carl@infosec.exchange
· 1mo ago
Replying to
Reward: You've received a laminated Storm-2570 Awareness Certificate. It does not stop ransomware. https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments #Ransomware #ThreatIntelligence #Storm2570 #CyberSecurity #APT #FollowTheTrail (3/3)
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments | Microsoft Security Blog
microsoft.com

Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments | Microsoft Security Blog

Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment.

0
0
0
0
CTI.FYI @CTI_FYI@infosec.exchange
· 1mo ago
🚨New ransom group blog posts!🚨 Group name: Spirals Post title: Armada Credit Bureau Info: https://cti.fyi/groups/Spirals.html Group name: Spirals Post title: ASYAD GROUP Info: https://cti.fyi/groups/Spirals.html Group name: N0n Post title: FinSoft (Kolibri retail back-office software) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: AFRICA-TECH (IT services / document processing) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: Fanatics (global sports commerce platform) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: United Federation of Teachers Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: AstraZeneca Türkiye Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: BeLi Teacher / FSC education centers (AWS) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: Argentem Creek Partners (investment firm) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: Ministry of Education — Argentina Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: PayPal support operations (Transcom WorldWide) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: STOKR (digital securities platform) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: Vietnamese betting operator (GC789 network / Boundless TE) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: Konnatus (usucapião legal services) Info: https://cti.fyi/groups/N0n.html Group name: N0n Post title: Inter (Venezuela's largest internet provider) Info: https://cti.fyi/groups/N0n.html #ransomware #cti #threatintelligence #cybersecurity #infosec
Spirals Ransomware Group | CTI.FYI
cti.fyi

Spirals Ransomware Group | CTI.FYI

Track Spirals ransomware group activity and threat intelligence.

0
0
0
0
CTI.FYI @CTI_FYI@infosec.exchange
· 1mo ago
🚨New ransom group blog posts!🚨 Group name: pear Post title: Indroj Medical Group Inc. Info: https://cti.fyi/groups/pear.html Group name: pear Post title: Martin Lawrence Galleries Info: https://cti.fyi/groups/pear.html Group name: pear Post title: Westside GI Info: https://cti.fyi/groups/pear.html #ransomware #cti #threatintelligence #cybersecurity #infosec
pear Ransomware Syndicate | CTI.FYI
cti.fyi

pear Ransomware Syndicate | CTI.FYI

Track pear ransomware syndicate. 122 victim disclosures, operational status, tactics (TTPs), targeted sectors, and dark web infrastructure.

0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
More reason to have an offline backup on standby. Infosecurity-Magazine: Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims https://www.infosecurity-magazine.com/news/ransomware-gang-uses-backup/ @dannyjpalmer@infosec.exchange #infosec #ransomware
Emerging Ransomware Gang Uses Backup Destruction Threats
infosecurity-magazine.com

Emerging Ransomware Gang Uses Backup Destruction Threats

Ransom notes by n0n ransomware claim to take double extortion to a new level of danger for victims

1
0
1
0
Cloud 🤖 @cloud@infosec.exchange
· 1mo ago
🤖 CISA: ransomware gangs now exploiting CVE-2026-63077, a critical JetBrains TeamCity auth-bypass flaw patched in July. Active exploitation confirmed, added to CISA KEV. Admins urged to patch immediately. 🔗 https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/ #CVE #Ransomware #CyberSec
CISA: Ransomware gangs now exploiting critical TeamCity flaw
bleepingcomputer.com

CISA: Ransomware gangs now exploiting critical TeamCity flaw

​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July.

0
0
0
0
AA @AAKL@infosec.exchange
· 1mo ago
Today's ransomware targets include the Merrimack County https://ransomware.live/id/VGhlIE1lcnJpbWFjayBDb3VudHlAQm9vYmEgUHJvamVjdA Claimed by the same gang: Washington County https://ransomware.live/id/V2FzaGluZ3RvbiBDb3VudHlAQm9vYmEgUHJvamVjdA Also in the US: Kirkland & Ellis law firm https://ransomware.live/id/S0lSS0xBTkQtQU5ELUVMTElTLkxMUEBjbG9w Columbia Banking System https://ransomware.live/id/Q09MVU1CSUFCQU5LLkNPTShVTVBRVUFCQU5LLkNPTSlAY2xvcA More https://ransomware.live/ #infosec #ransomware
Victim: The Merrimack County – Booba Project
ransomware.live

Victim: The Merrimack County – Booba Project

Ransomware.live discovered on 2026-09-23 that The Merrimack County has been claimed by Booba Project ransomware group

0
0
0
0