Ransomware

The Digital Parasite: How Attacker Tradecraft Evolved in 2026

Picus Labs found evasion, persistence and command-and-control techniques in eight of its 2026 top ten malware behaviors. What defenders can take from the data.

Rhysida Published Berlin's Stolen Data. The Incident Is Only Starting

Berlin's stolen government data has been released after an extortion deadline expired. The next phase is credential rotation, exposure analysis, victim notification, and long-term fraud monitoring.

Why Managed File Transfer Tools Keep Becoming Mass-Breach Machines

MOVEit, GoAnywhere, Cleo, Accellion — the same extortion playbook keeps working on enterprise file-transfer software. Here's the structural reason why, and what to do about it.

Initial Access Brokers: The Middlemen Selling Your Network to Ransomware Gangs

IABs breach networks and sell the keys on forums like Exploit and XSS for a few hundred to over $100,000. Here's how the market prices, verifies, and moves access.

JADEPUFFER: Inside the First Documented Agentic Ransomware Attack

Sysdig caught an LLM agent breaking into a Langflow server, pivoting to a production database, and extorting the victim — with no human at the keyboard between steps. Here's what actually happened, and what's still unproven.

FortiBleed's Ransomware Pipeline: What SOCRadar's INC Ransom and Lynx Attribution Actually Proves

SOCRadar says the FortiBleed credential campaign feeds directly into INC Ransom and Lynx ransomware operations, with 430,000 FortiGate devices targeted. Here's what's confirmed, what's one vendor's assessment, and what it means for your firewall.

AI-Built Browser Ransomware Abuses Chrome File Access

Check Point analyzed a DeepSeek-attributed ransomware sample that should not work from a browser tab. Most of it was fiction — except for one detail that mapped to a real Chromium API. No malware install required.

Operation Endgame Hits SocGholish: FakeUpdates Takedown

Operation Endgame's June 2026 action against SocGholish shows why fake browser updates, compromised WordPress sites, and criminal loader infrastructure still matter to defenders.

Prinz Eugen Ransomware Encrypts Your Newest Files First

A new Go-based ransomware family prioritizes recently modified files, uses RDP and legitimate remote-management tooling, and leaves no ransom note on disk. Here's what to hunt and harden.

How Europol Is Catching Cybercriminals in 2026

Europol does not usually kick down the door. It makes cybercrime investigations cross-border, evidence-rich, and harder for offenders to escape.

Ransomware Doesn't Need to Encrypt Anymore — And That's the Point

22% of ransomware incidents in 2026 involve no encryption at all. The threat model has shifted from disruption to silent exfiltration — and most defenses haven't caught up.

$10 Million Ransom, Four Days of Peace, and Then the Login Page Changed

ShinyHunters breached Canvas LMS, stole 275 million students' data, took the ransom — and attacked again four days later. Here's who they are and why arrests haven't stopped them.

Ransomware Backup Strategy: Why 93% Who Pay Still Lose Data

93% of ransomware victims who pay still discover data theft. Only 29% use multi-layer backup protection. Learn immutability, validation, and org readiness strategies.

Zero Trust vs. Real Attacks: Which Threats Does It Actually Stop?

Discover which real-world cyberattacks Zero Trust prevents—and which ones it doesn't. Analyzed through 2025-2026 breach data including ransomware campaigns, insider threats, supply chain compromises, and social engineering attacks.

Cybersecurity in 2025: Holiday Season Security Guide and Year-End Threats

Cybersecurity threats heading into 2025: AI-powered attacks, ransomware trends, and quantum threats — with practical security measures for the holiday season and beyond.