Ransomware Attacks News

481 stories · Updated every 5 minutes · Page 3 of 13

1. Police Target KillSec Ransomware Group with Arrests and Seizures

   Infosecurity Magazine · 02 Oct 2026, 14:50 IST · High severity

   Investigators have disrupted the operations of ransomware group KillSec and arrested several key suspects

2. OTX Threat: Warlock Ransomware Attackers Hit Water and Telecom Operators

   AlienVault OTX · 01 Oct 2026, 21:07 IST · Critical severity

   The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four...

3. Alleged KillSec Ransomware Mastermind a 16-Year-Old

   darkreading · 02 Oct 2026, 03:07 IST · High severity

   Law enforcement from multiple countries collaborated to disrupt a cybercrime operation that has claimed some 500 victims worldwide in the past two years.

4. KillSec Ransomware Group Dismantled, 16-Year-Old Suspected Admin Arrested

   HackRead · 02 Oct 2026, 01:27 IST · High severity

   An international police operation has disrupted the KillSec ransomware group, with three suspects arrested, five servers seized and…

5. Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers

   The Hacker News · 01 Oct 2026, 22:25 IST · High severity

   Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The...

6. Police disrupt KillSec ransomware, arrest suspected teenage leader

   The Record by Recorded Future · 01 Oct 2026, 21:25 IST · High severity

   European police said raids against the KillSec ransomware-as-a-service operation included the arrest of a high-profile teen suspect.

7. Police dismantle KillSec ransomware gang allegedly led by 16-year-old

   BleepingComputer · 01 Oct 2026, 19:55 IST · High severity

   An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator.

8. Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader

   SecurityWeek · 01 Oct 2026, 19:47 IST · High severity

   Police took control of KillSec’s leak site and secured at least 110 terabytes of data stolen from victims. The post Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader appeared first on SecurityWeek .

9. 16-year-old suspected leader of KillSec ransomware group arrested

   Help Net Security · 01 Oct 2026, 19:29 IST · High severity

   A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide. Seizure notice (Source: Eurojust) According to Eurojust, KillSec has been active...

10. Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization

    Flashpoint · 01 Oct 2026, 18:59 IST · Critical severity

    Blogs Blog Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization Flashpoint was awarded U.S. 12,705,360 for its Ransomware Risk model, which rates how closely new vulnerabilities match those...

11. Warlock Ransomware Hits Large Spanish, Portuguese Orgs

    darkreading · 01 Oct 2026, 18:30 IST · High severity

    A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places.

12. Inside DragonForce: How a Ransomware Cartel’s Payload Actually Runs

    Seqrite Blog · 01 Oct 2026, 18:09 IST · High severity

    A technical walkthrough from runtime preparation and network-share discovery to concurrent file encryption DragonForce is a Ransomware-as-a-Service (RaaS) operation that first surfaced in mid-to-late 2023. It initially presented itself...

13. Trusted data resiliency anchors Oracle’s ransomware defense strategy

    SiliconANGLE · 01 Oct 2026, 02:49 IST · High severity

    For enterprises, data resiliency ultimately comes down to an ability for useful work to continue. The definition sounds simple, yet making sure that data in critical systems is fully protected and accessible as rapidly as possible is a...

14. Global Group Ransomware Abuses WinMerge to Deploy Encryptor

    HackRead · 30 Sep 2026, 21:14 IST · High severity

    Cofense researchers reveal how Global Group uses payment-themed phishing, malicious ISO files and WinMerge to deploy ransomware and extort large enterprises.

15. Should South Africa ban ransomware payments?

    TechCentral · 29 Sep 2026, 22:31 IST · High severity

    The CEO who paid his attackers now wants ransoms outlawed. Information security expert Dominic White urges caution.

16. Japan's Keio confirms ransomware attack disrupted business systems

    BleepingComputer · 29 Sep 2026, 02:26 IST · Critical severity

    Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems.

17. OTX Threat: Galago Ransomware Emerges With Shared Infrastructure Ties to Panzer

    AlienVault OTX · 24 Sep 2026, 18:10 IST · High severity

    Galago is a newly identified ransomware operation that emerged in September 2026, claiming operational partnership with the Panzer ransomware group. The connection is suggested through shared infrastructure, specifically matching...

18. Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

    Microsoft Security Blog · 24 Sep 2026, 21:30 IST · Critical severity

    In this article Who is Storm-2570? Storm-2570 attack chain: From initial foothold to impact What Storm-2570 activity means for defenders Mitigation and protection guidance Microsoft Defender detections Hunting queries Activity...

19. Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims

    Infosecurity Magazine · 24 Sep 2026, 20:30 IST · High severity

    Ransom notes by n0n ransomware claim to take double extortion to a new level of danger for victims

20. Ukrainian ransomware developer jailed for nearly 13 years

    Graham Cluley · 24 Sep 2026, 18:12 IST · High severity

    A court in Zurich has sentenced a Ukrainian man to 12 years and nine months in prison, and banned him from Switzerland for ten years, for developing ransomware that blackmailed companies around the world. Read more in my article on the...

21. CISA: Ransomware gangs now exploiting critical TeamCity flaw

    BleepingComputer · 24 Sep 2026, 16:12 IST · High severity

    Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July.

22. US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks

    SecurityWeek · 24 Sep 2026, 14:08 IST · Critical severity

    Karen Vardanyan has also been ordered to pay over $1.2 million in restitution to victims. The post US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks appeared first on SecurityWeek .

23. Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million

    The Record by Recorded Future · 23 Sep 2026, 21:00 IST · High severity

    An Armenian national and member of the Ryuk ransomware gang was sentenced to two years in federal prison for his role in launching attacks.

24. Ransomware Attacks Reach Record High for 2026

    Infosecurity Magazine · 23 Sep 2026, 17:30 IST · Critical severity

    A total of 1073 firms fell victim to ransomware attacks globally in August, with the industrial sector the most affected, according to new NCC data

25. Ryuk ransomware member sentenced to 24 months in prison

    BleepingComputer · 23 Sep 2026, 13:50 IST · Critical severity

    An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks.

26. ‘Cyber criminal groups suffer from the same security weaknesses they routinely exploit’: ShinyHunters claims it hacked Clop ransomware rival

    IT Pro · 22 Sep 2026, 15:27 IST · High severity

    Nicole Kobie first started writing for ITPro in 2007. As a freelance journalist covering technology and business, Nicole's work includes bylines in New Scientist, Wired, PC Pro and many more. Nicole the author of a book about the...

27. OTX Threat: The Tale of Two INC Ransom Notes: A Ransomware Timeline

    AlienVault OTX · 21 Sep 2026, 22:05 IST · High severity

    In late August, an organization was compromised by INC ransomware across at least 175 endpoints. The attack timeline spanned from early to late August with a 17-day gap, suggesting involvement of an initial access broker and a separate...

28. ShinyHunters Hacks and Defaces Clop Ransomware Leak Site

    HackRead · 19 Sep 2026, 23:54 IST · High severity

    ShinyHunters hacked and defaced Clop's ransomware leak site, replacing its content with ShinyHunters branding as its own onion site goes offline.

29. Clop Ransomware Responds to ShinyHunters Amid Eight-Figure Demands

    HackRead · 21 Sep 2026, 22:37 IST · High severity

    Clop responds to ShinyHunters after its leak site takeover as the group demands an eight-figure payment, interest and a public apology in their escalating feud.

30. Cybercrime civil war brewing? ShinyHunters reportedly hacks Cl0p ransomware gang and threatens further damage

    TechRadar · 21 Sep 2026, 21:35 IST · High severity

    Cybercrime civil war brewing? ShinyHunters reportedly hacks Cl0p ransomware gang and threatens further damage

31. OTX Threat: PAYLOAD ransomware attacks through Active Directory GPO

    AlienVault OTX · 21 Sep 2026, 17:24 IST · Critical severity

    In April 2026, a manufacturing organization in the Middle East suffered a ransomware attack where threat actors with domain admin privileges weaponized Active Directory Group Policy Objects to achieve domain-wide impact without...

32. ShinyHunters cybercrime gang takes over Cl0p ransomware site, demands extortion payment

    The Record by Recorded Future · 21 Sep 2026, 19:30 IST · High severity

    The ShinyHunters extortion group hijacked the dark web leak site of the prolific Cl0p ransomware gang, according to material posted on the site over the weekend.

33. ShinyHunters Claim Hack of Rival Ransomware Gang Clop

    Infosecurity Magazine · 21 Sep 2026, 18:00 IST · High severity

    ShinyHunters has claimed responsibility for hacking the Clop ransomware group, defacing its leak site and alleging theft of key operational data

34. ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

    BleepingComputer · 19 Sep 2026, 19:18 IST · High severity

    The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service.

35. Settra ransomware variant deployed in recent attacks

    Cybersecurity Dive - Latest News · 18 Sep 2026, 21:02 IST · High severity

    Security researchers warned that hackers are using VPN credentials for initial access and deploying RMM tools.

36. In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw

    SecurityWeek · 18 Sep 2026, 19:55 IST · High severity

    Noteworthy stories that might have slipped under the radar: Mandiant's 2026 AI risk report, PhantomRaven malware used by bug bounty hunter, WordPress plugin bug exploited. The post In Other News: Ransomware Developer Sentenced,...

37. OTX Threat: Private HTS programs that spread ransomware

    AlienVault OTX · 18 Sep 2026, 18:50 IST · High severity

    Fraudulent organizations in Korea are exploiting private Home Trading System (HTS) software to distribute ransomware to victims. The unauthorized HTS program called 'UBP Asset' impersonates the legitimate Swiss financial institution...

38. New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing

    Infosecurity Magazine · 18 Sep 2026, 19:00 IST · High severity

    Huntress researchers highlighted a new ransomware variant, named Settra, and the post-compromise techniques used in two recent attacks

39. SA organisations under pressure to protect against ransomware onslaught

    · 18 Sep 2026, 15:47 IST · High severity

    Sophos SA unpacks findings of its State of Ransomware in South Africa 2026 research.

40. OTX Threat: Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM

    AlienVault OTX · 17 Sep 2026, 21:49 IST · High severity

    Settra is a ransomware variant first observed in June 2026 that targets organizations through VPNs or compromised credentials. Two incidents were investigated in July and September 2026, affecting the consumer services, retail, and...