◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
54 articles tagged with #ransomware
Recent intelligence confirms a surge in double-extortion attacks by Chaos and M3rx, targeting US-based healthcare and legal entities. These groups are leveraging stolen data to force rapid ransom payments.
The emerging Krybit ransomware group has intensified its operations, successfully breaching and leaking data from an Indian construction firm. This incident highlights a growing trend of sector-specific targeting.
Industrial sectors face a record-high wave of ransomware attacks in late 2026, with the Qilin group emerging as a dominant threat. Security experts warn that IT/OT convergence is significantly expanding the attack surface for critical infrastructure.
Recent intelligence indicates a surge in nation-state actors masking espionage operations as ransomware attacks. This shift complicates attribution and allows groups to bypass traditional security controls.
As of September 30, 2026, the Chaos and M3rx ransomware groups have launched targeted double-extortion campaigns against US-based organizations, threatening the release of hundreds of gigabytes of sensitive data.
A new ransomware operation dubbed Galago has surfaced, showing operational ties to the established Panzer extortion group. Security researchers are monitoring the group's dark leak site as it begins targeting organizations globally.
Industrial organizations are currently facing a record-breaking wave of ransomware attacks, with the Qilin threat group accounting for a significant portion of the activity as of late September 2026.
Global ransomware incidents hit record highs in late September 2026, with groups like Emperador and SafePay aggressively targeting critical infrastructure and financial services using double-extortion tactics.
Ransomware activity has reached record highs in late 2026, with new campaigns by Emperador and SafePay targeting critical sectors. Over 1,000 organizations were impacted in August alone.
Emerging threat actor Panzer has rapidly expanded its operations in September 2026, targeting international organizations across multiple sectors. The group utilizes custom encryption and a dedicated leak site.
Microsoft has identified a prolific ransomware affiliate, Storm 2570, orchestrating attacks using Qilin, DragonForce, Anubis, and BERT ransomware. The group utilizes consistent credential theft and remote access tools.
Security researchers have identified a surge in autonomous, AI-orchestrated malware development by the threat actor JADEPUFFER. This shift marks a transition from manual exploitation to agentic ransomware.
The MedusaLocker ransomware group has claimed responsibility for a recent breach of the Bulgarian organization Abv, resulting in the exfiltration of hundreds of sensitive emails.
New intelligence reveals a record-breaking month for ransomware, with 1,073 organizations hit in August 2026. Meanwhile, inter-group warfare between actors like ShinyHunters and Clop is reshaping the landscape.
Recent intelligence confirms a sustained surge in ransomware activity throughout September 2026. Notable incidents include the ShinyHunters breach of Final statement re PSA and MedusaLocker's targeting of Bulgarian entity Abv.
Global ransomware activity reached record highs in late 2026, with groups like Qilin and ShinyHunters aggressively targeting diverse sectors. Recent incidents include attacks on US and Bulgarian entities.
In a rare display of inter-gang hostility, the prolific extortion group ShinyHunters has claimed a successful breach of the Clop ransomware infrastructure. This development marks a significant shift in the 2026 threat landscape as criminal syndicates begin targeting one another.
In a rare display of inter-group hostility, the prolific extortion group ShinyHunters has successfully breached the infrastructure of the Clop ransomware gang. This development marks a significant shift in the 2026 threat landscape as cybercriminal syndicates increasingly target one another.
The prolific cyber extortion group ShinyHunters has reportedly compromised the infrastructure of the rival Clop ransomware gang. This development occurs as 2026 ransomware activity hits record highs.
Microsoft Threat Intelligence reports a significant uptick in Storm-2570 activity, highlighting the evolving tradecraft of RaaS affiliates. This comes as global ransomware incidents reach record levels in late 2026.
Ransomware activity hit a record high in August 2026 with over 1,000 victims reported. Simultaneously, the threat landscape is shifting as major groups like ShinyHunters engage in inter-gang cyber warfare.
Recent intelligence confirms a surge in ransomware activity as groups Secp0 and Qilin target major firms in the US and Japan. These attacks highlight the persistent threat of double extortion tactics.
Check Point has issued an urgent warning regarding a zero-day vulnerability in its Quantum Security Gateways being actively exploited by ransomware actors. The flaw allows unauthorized access to admin panels.
Recent intelligence confirms a spike in double-extortion activity as LockBit 5.0 targets Ethiopian banking infrastructure and the Termite group compromises a major U.S. mortgage firm.
Recent intelligence updates from federal agencies highlight a surge in double-extortion attacks by Gunra and Medusa ransomware groups. These RaaS operations are actively targeting healthcare and manufacturing.
The Emperador ransomware group has claimed responsibility for a significant data breach against U.S.-based BAYMER. This incident highlights the ongoing threat of double-extortion tactics in 2026.
The emerging ransomware group Emperador has claimed responsibility for a significant data breach against BAYMER, marking a surge in aggressive double-extortion campaigns throughout September 2026.
A sophisticated ransomware campaign has targeted a major manufacturing firm in the Middle East, utilizing malicious Active Directory Group Policy Objects (GPOs) to deploy the PAYLOAD ransomware strain.
The Emperador ransomware group has successfully compromised Czech technology firm SEVENOAKS s.r.o. The attackers are currently threatening to leak 3.3 GB of sensitive exfiltrated data.
The Emperador ransomware group has claimed a new victim, Czech technology firm SEVENOAKS s.r.o., threatening to leak 3.3 GB of sensitive data. This incident highlights the ongoing surge in double-extortion tactics targeting European industrial and technology sectors.
Ransomware operators are actively exploiting a critical RCE vulnerability in VMware vCenter Server. The campaign, which began in mid-August, has already impacted hundreds of organizations globally.
In a rare display of inter-group cyber warfare, the ShinyHunters extortion gang has successfully breached the Clop ransomware leak site. The attack, occurring on September 18, 2026, involved server defacement and data theft as retaliation for ongoing feuds.
Recent intelligence confirms a wave of ransomware activity, with groups like Emperador and TheGentlemen targeting international entities. These attacks highlight a persistent threat to data integrity.
Recent intelligence confirms the Qilin ransomware group remains a dominant threat, with over 1,400 victims recorded since late 2025. The group continues to leverage aggressive double-extortion tactics.
The cybercriminal group 'Toy Ghouls' has intensified its campaign against Russian organizations, utilizing a sophisticated blend of custom backdoors and legacy ransomware code to ensure persistent access.
August 2026 saw a record-breaking 997 global ransomware attacks, with critical infrastructure sectors like utilities and healthcare facing the brunt of the surge. Security agencies are now prioritizing OT resilience as nation-state actors increasingly target industrial control systems.
The Qilin ransomware group has intensified its global campaign, targeting major entities in France and Malaysia. With over 1,400 victims recorded, the group continues to dominate the threat landscape.
The aggressive ransomware group 'TheGentlemen' has surged in activity, claiming 475 victims globally. Recent intelligence confirms a targeted attack on AIMS Group LLC in the UAE, highlighting the group's high-frequency extortion model.
The Gentlemen ransomware group has solidified its position as a top-tier threat actor, utilizing double-extortion tactics to compromise over 800 organizations across 86 countries since mid-2025.
The International Meteor Organization reported a critical disruption to its digital infrastructure on September 16, 2026. This incident follows a broader trend of rapid-deployment ransomware operations targeting critical sectors.
A massive credential harvesting campaign targeting FortiGate firewalls has been linked to the INC and Lynx ransomware operations. Attackers are leveraging administrative access to facilitate full-chain intrusions.
A massive credential harvesting campaign targeting FortiGate firewalls has provided INC and Lynx ransomware operators with administrative access to hundreds of global networks, enabling rapid deployment.
August 2026 saw a record-breaking 997 global ransomware attacks, with a significant focus on utility and healthcare infrastructure. Analysts warn that the rapid digitization of OT systems is outpacing current security defenses.
A massive credential harvesting campaign dubbed 'FortiBleed' has compromised hundreds of thousands of FortiGate firewalls. Threat actors INC and Lynx are actively leveraging this access to facilitate ransomware attacks.
The Barracuda ransomware group has claimed responsibility for a breach of Turkish telecommunications provider i2i-systems, exfiltrating 693GB of sensitive data including proprietary source code.
The Barracuda ransomware group has launched a major attack on Turkish telecommunications firm i2i-systems, exfiltrating over 693 GB of sensitive data including critical source code. This incident highlights a growing trend of aggressive double-extortion tactics targeting infrastructure providers.
As global utility attacks hit record highs in August 2026, the U.S. Department of Energy and California are launching aggressive new initiatives to secure critical infrastructure against AI-driven threats.
Recent intelligence confirms a spike in ransomware activity, with the Barracuda group targeting telecommunications and Qilin striking French organizations. Meanwhile, the Hyadina family has evolved to bypass endpoint security using malicious drivers.
The Barracuda ransomware group has exfiltrated over 693 GB of data from Turkish telecommunications firm i2i-systems. This incident follows a broader trend of daily ransomware attacks impacting critical infrastructure.
The Barracuda ransomware group has successfully exfiltrated over 693 GB of data from Turkish telecommunications firm i2i-systems. This incident highlights the persistent threat of ransomware-led data extortion.
August 2026 saw a record 997 global ransomware attacks, prompting urgent new AI-driven defense mandates in California and collaborative OT security efforts across the energy and utility sectors.
Recent intelligence indicates a significant uptick in ransomware activity, with groups like ShinyHunters targeting major firms. Analysts observe a shift toward aggressive double-extortion tactics.
The Barracuda ransomware group has successfully exfiltrated over 693 GB of sensitive data from Turkish telecommunications firm i2i-systems. This incident highlights the persistent threat of double-extortion tactics.
Cyware's weekly threat intelligence briefing for August 29 to September 4, 2026 covers the week's increase in AI-driven automation across malware and attack campaigns, alongside state-linked activity, ransomware and rapidly exploited vulnerabilities.