◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
28 articles tagged with #Double Extortion
Encrygma analysts have identified a critical spike in ransomware operations and RCE vulnerability exploitation as of October 10, 2026. Organizations are urged to prioritize patching CVE-2026-107406 immediately.
New intelligence reports confirm that ransomware activity reached a 2026 peak in August with 1,073 incidents. Threat actors continue to leverage double-extortion tactics, with groups like Aurora remaining active.
The Aurora and SafePay ransomware syndicates have intensified their operations, with both groups posting new victim claims on their respective leak sites as of October 5, 2026.
The newly identified ransomware group 'N0n' has claimed its second victim as of October 5, 2026. This activity follows the group's emergence in late September, signaling a rapid expansion in operations.
The emerging 'Audit Team' ransomware group has intensified its operations, recording a spike in victim claims in early October 2026. The group continues to leverage double-extortion tactics to pressure organizations.
The Warlock ransomware group is actively exploiting a chain of Microsoft SharePoint zero-day vulnerabilities to compromise water utilities and telecom providers. This campaign marks a significant escalation in targeting critical infrastructure across multiple continents.
The China-linked Warlock group has launched a series of high-impact attacks against water utilities and telecom providers. The campaign leverages a sophisticated chain of zero-day vulnerabilities known as ToolShell.
Recent intelligence confirms a surge in ransomware activity as groups like ThreeAM and Morpheus target healthcare and industrial sectors, utilizing aggressive double-extortion tactics to pressure victims.
New intelligence confirms ThreeAM and Morpheus ransomware groups have targeted critical healthcare and industrial sectors in Colombia and Taiwan, utilizing aggressive double-extortion tactics.
As of October 2, 2026, the ThreeAM and Morpheus ransomware groups have targeted critical infrastructure in Colombia and Taiwan, respectively, utilizing double extortion tactics to pressure victims.
The emerging Krybit ransomware group has intensified its operations, successfully breaching and leaking data from an Indian construction firm. This incident highlights a growing trend of sector-specific targeting.
Recent intelligence confirms a surge in double-extortion attacks by Chaos and M3rx, targeting US-based healthcare and legal entities. These groups are leveraging stolen data to force rapid ransom payments.
As of September 30, 2026, the Chaos and M3rx ransomware groups have launched targeted double-extortion campaigns against US-based organizations, threatening the release of hundreds of gigabytes of sensitive data.
Global ransomware incidents hit record highs in late September 2026, with groups like Emperador and SafePay aggressively targeting critical infrastructure and financial services using double-extortion tactics.
Ransomware activity has reached record highs in late 2026, with new campaigns by Emperador and SafePay targeting critical sectors. Over 1,000 organizations were impacted in August alone.
Emerging threat actor Panzer has rapidly expanded its operations in September 2026, targeting international organizations across multiple sectors. The group utilizes custom encryption and a dedicated leak site.
Microsoft has identified a prolific ransomware affiliate, Storm 2570, orchestrating attacks using Qilin, DragonForce, Anubis, and BERT ransomware. The group utilizes consistent credential theft and remote access tools.
New intelligence reveals a record-breaking month for ransomware, with 1,073 organizations hit in August 2026. Meanwhile, inter-group warfare between actors like ShinyHunters and Clop is reshaping the landscape.
Recent intelligence confirms a sustained surge in ransomware activity throughout September 2026. Notable incidents include the ShinyHunters breach of Final statement re PSA and MedusaLocker's targeting of Bulgarian entity Abv.
Global ransomware activity reached record highs in late 2026, with groups like Qilin and ShinyHunters aggressively targeting diverse sectors. Recent incidents include attacks on US and Bulgarian entities.
Microsoft Threat Intelligence reports a significant uptick in Storm-2570 activity, highlighting the evolving tradecraft of RaaS affiliates. This comes as global ransomware incidents reach record levels in late 2026.
Recent intelligence confirms a surge in ransomware activity as groups Secp0 and Qilin target major firms in the US and Japan. These attacks highlight the persistent threat of double extortion tactics.
Recent intelligence confirms a spike in double-extortion activity as LockBit 5.0 targets Ethiopian banking infrastructure and the Termite group compromises a major U.S. mortgage firm.
Recent intelligence updates from federal agencies highlight a surge in double-extortion attacks by Gunra and Medusa ransomware groups. These RaaS operations are actively targeting healthcare and manufacturing.
The Emperador ransomware group has claimed responsibility for a significant data breach against U.S.-based BAYMER. This incident highlights the ongoing threat of double-extortion tactics in 2026.
The emerging ransomware group Emperador has claimed responsibility for a significant data breach against BAYMER, marking a surge in aggressive double-extortion campaigns throughout September 2026.
The Emperador ransomware group has successfully compromised Czech technology firm SEVENOAKS s.r.o. The attackers are currently threatening to leak 3.3 GB of sensitive exfiltrated data.
The Emperador ransomware group has claimed a new victim, Czech technology firm SEVENOAKS s.r.o., threatening to leak 3.3 GB of sensitive data. This incident highlights the ongoing surge in double-extortion tactics targeting European industrial and technology sectors.