Ransomware Attacks News

479 stories · Updated every 5 minutes · Page 2 of 12

1. Two groups account for a third of UK ransomware attacks

   IT Pro · 12 Oct 2026, 15:14 IST · Critical severity

   Two groups account for a third of UK ransomware attacks

2. Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups

   Infosecurity Magazine · 12 Oct 2026, 14:45 IST · High severity

   ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May

3. Settra Ransomware Is the Last Thing That Happens

   TechSpective · 11 Oct 2026, 19:50 IST · Critical severity

   When most of us picture a ransomware attack, we picture the moment the screens go dark. Files won’t open, a ransom note shows up on the desktop, and somebody has to decide whether to pay. That’s pretty much how I […] The post Settra...

4. FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

   HackRead · 10 Oct 2026, 16:35 IST · High severity

   FBI arrests Cypfer co-founder Edward Dubrovsky, now associated with CyberSteward, in the ShinyHunters investigation into the FBI jobs…

5. FBI Arrests Founder of Ransomware Negotiation Firm

   Krebs on Security · 10 Oct 2026, 05:47 IST · High severity

   Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of...

6. Feds Say Ransomware Expert’s Miracle Cure Was Just Paying the Hackers

   Gizmodo · 09 Oct 2026, 23:40 IST · High severity

   An indictment says Zohar Pinhasi's MonsterCloud billed ransomware victims millions for a decryptor it did not have, then paid the attackers a fraction of that fee.

7. Ransomware consultant said he would decrypt data, is accused of paying ransoms instead

   Computerworld · 09 Oct 2026, 21:18 IST · High severity

   The owner of a ransomware remediation company is facing trial for defrauding customers. Zohar Pinhasi, also known as “Zack Silver” and “Zack Green,” has been arraigned in New York on wire fraud charges for allegedly defrauding clients...

8. Germany arrests alleged core Qilin ransomware member after extradition

   BleepingComputer · 09 Oct 2026, 21:08 IST · High severity

   Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month.

9. Q3 2026 Sets New Record for Ransomware Attacks

   Infosecurity Magazine · 09 Oct 2026, 17:30 IST · Critical severity

   Comparitech observed 2627 claimed ransomware attacks in Q3, with critical sectors like finance, technology, education and healthcare experiencing significant increases

10. Ransomware attack disrupts Japan's IDCF Cloud used by govt clients

    BleepingComputer · 09 Oct 2026, 01:39 IST · Critical severity

    IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part of the country.

11. ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories

    The Hacker News · 08 Oct 2026, 23:28 IST · High severity

    The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion.

12. DOJ charges ransomware recovery CEO for secretly paying hackers

    The Record by Recorded Future · 08 Oct 2026, 22:30 IST · High severity

    The owner of a ransomware recovery firm was hit with wire fraud charges for allegedly making secret ransom payments while overcharging the victims of attacks.

13. Global cyber attacks up 48% as ransomware and phishing climb, Check Point finds

    IT Security Guru · 08 Oct 2026, 19:12 IST · High severity

    Organisations worldwide faced an average of 2,803 cyber attacks per week in September 2026, up 16% on August and 48% on the same month last year, according to new data from Check Point Research. The figures point to sustained growth...

14. Ransomware recovery firm claimed it could decrypt files, but may have just paid hackers and pocketed the difference

    TechSpot · 08 Oct 2026, 17:34 IST · High severity

    The United States Department of Justice has charged Zohar Pinhasi, 50, also known as "Zack Silver" and "Zack Green," with fraud. He ran a Florida-based company called MonsterCloud that told ransomware victims not to pay attackers...

15. No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers

    IT Security Guru · 08 Oct 2026, 15:43 IST · Critical severity

    Incident responders rarely get to watch an attack from the beginning. More often, security tooling arrives after the damage is done, either as part of the response or because a rollout was still underway when the attackers struck. That...

16. Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme

    SecurityWeek · 08 Oct 2026, 14:57 IST · High severity

    Zohar Pinhasi was paying ransoms to obtain decryption keys and then charging victims substantially more for remediation. The post Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme appeared first on SecurityWeek .

17. Cheapskates wouldn't pay for security help, got hit by ransomware, and went bust months later

    The Register · 08 Oct 2026, 13:45 IST · High severity

    Welcome back to PWNED, the weekly column where we highlight some of the lowlights in corporate security. This week, we’ll talk about two scenarios, one that ended in tragedy and another that shows the power of a good defense over...

18. Ransomware recovery firm boss charged with secretly paying attackers and overcharging victims

    Help Net Security · 08 Oct 2026, 13:30 IST · High severity

    The owner of Florida-based ransomware remediation company MonsterCloud has been charged with fraud for allegedly paying ransomware gangs behind his clients’ backs and billing them far more than the ransom. Zohar Pinhasi (aka “Zack...

19. Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead

    The Register · 08 Oct 2026, 07:59 IST · High severity

    The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms – and seemingly got away with it for years. The Feds allege...

20. Ransomware recovery CEO charged over secret ransom payments

    BleepingComputer · 08 Oct 2026, 04:34 IST · High severity

    The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data.

21. Ransomware has a new target. Is your backup ready?

    BleepingComputer · 07 Oct 2026, 19:31 IST · High severity

    Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that...

22. Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany

    SecurityWeek · 07 Oct 2026, 19:17 IST · High severity

    The individual was detained in May and has been extradited to Germany to face hacking charges. The post Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany appeared first on SecurityWeek .

23. Advantest Discloses Data Breach Months After Ransomware Attack

    SecurityWeek · 07 Oct 2026, 18:07 IST · Critical severity

    The Japanese chip testing giant said hackers stole personal information from its servers in the February 2026 cyberattack. The post Advantest Discloses Data Breach Months After Ransomware Attack appeared first on SecurityWeek .

24. Advantest confirms personal information stolen in ransomware attack

    BleepingComputer · 07 Oct 2026, 15:57 IST · Critical severity

    Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data.

25. OTX Threat: Akira Ransomware Attack Investigation

    AlienVault OTX · 07 Oct 2026, 15:15 IST · Critical severity

    In September, an organization experienced an Akira ransomware attack, with investigation revealing the threat actor's tactics and tools. The attacker gained access through Remote Desktop Protocol, subsequently disabling antivirus...

26. Osaka Metropolitan University cancels classes after suspected ransomware attack

    The Record by Recorded Future · 06 Oct 2026, 20:22 IST · Critical severity

    Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable.

27. Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds

    Infosecurity Magazine · 06 Oct 2026, 14:00 IST · High severity

    An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims

28. University of Illinois Chicago affected by ransomware attack on medical school

    The Record by Recorded Future · 05 Oct 2026, 21:00 IST · Critical severity

    A ransomware attack that affected the University of Illinois Chicago (UIC) College of Medicine resulted in the theft of some information from its servers.

29. ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

    The Hacker News · 05 Oct 2026, 19:50 IST · Critical severity

    None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation,...

30. Ransomware gang threatens to dump more South African client data

    TechCentral · 05 Oct 2026, 15:36 IST · High severity

    The Gentlemen, the group behind the MIP Holdings breach, has added three more South African organisations to its leak site.

31. Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

    The Hacker News · 03 Oct 2026, 20:06 IST · Critical severity

    The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries....

32. N0n ransomware: what you need to know

    Graham Cluley · 03 Oct 2026, 13:59 IST · High severity

    N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then,...

33. Warlock ransomware breach SharePoint in water, telecom operator attacks

    BleepingComputer · 03 Oct 2026, 00:03 IST · High severity

    The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access.

34. 'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries

    The Record by Recorded Future · 02 Oct 2026, 19:35 IST · Critical severity

    The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team.

35. Mississippi mayor says ransomware incident led city to shut down systems

    The Record by Recorded Future · 02 Oct 2026, 19:36 IST · High severity

    Government services were temporarily disrupted by ransomware in Vicksburg, Mississippi. Mayor Willis Thompson said the FBI and other authorities are investigating.

36. Teen suspected of running KillSec ransomware group as cops seize servers, arrest three

    The Register · 02 Oct 2026, 17:13 IST · High severity

    Police suspect a 16-year-old was the main operator of KillSec, a ransomware group linked to around 1,000 suspected attacks worldwide. Authorities announced on Thursday that an international operation had seized the group's...

37. Police take down dangerous KillSec ransomware gang — and find out it's being run by a teenager

    TechRadar · 02 Oct 2026, 16:45 IST · High severity

    Police take down dangerous KillSec ransomware gang — and find out it's being run by a teenager

38. 16-year-old boy arrested for masterminding KillSec ransomware group

    IT Pro · 02 Oct 2026, 16:37 IST · High severity

    16-year-old boy arrested for masterminding KillSec ransomware group

39. Police Target KillSec Ransomware Group with Arrests and Seizures

    Infosecurity Magazine · 02 Oct 2026, 14:50 IST · High severity

    Investigators have disrupted the operations of ransomware group KillSec and arrested several key suspects

40. OTX Threat: Warlock Ransomware Attackers Hit Water and Telecom Operators

    AlienVault OTX · 01 Oct 2026, 21:07 IST · Critical severity

    The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four...