Updated logoUPDATED

Ransomware Attacks News

481 stories · Updated every 5 minutes · Page 5 of 13

  2. Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

    The Hacker News · · High severity

    Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit...

  5. Tricky 'SynkLoader' Multitool May Herald Ransomware

    darkreading · · High severity

    An advanced, multilingual malware family brings back a trick from yesteryear — screen hijacking — for effective password theft, along with a slew of novel features.

  9. The State of Ransomware Q2 2026

    Checkpoint Research · · High severity

    For the past year, the ransomware conversation has centered on concentration: a handful of dominant RaaS operations controlling most of the damage, and a shrinking pool of active groups fighting over the same territory. The State of...

  10. Gunra ransomware: what you need to know

    Graham Cluley · · High severity

    The ransomware gang Gunra has been creating havoc - exploiting unpatched VPNs and firewalls to steal data, encrypt systems, and extort victims across healthcare, finance, manufacturing, and more. Read more in my article on the Fortra blog.

  12. ATF Confirms Cyber Incident After Ransomware Group Claims Attack

    SecurityWeek · · High severity

    The Bureau of Alcohol, Tobacco, Firearms and Explosives has described it as a ‘major incident’ and it’s conducting an investigation with the DOJ. The post ATF Confirms Cyber Incident After Ransomware Group Claims Attack appeared first...

  13. 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

    Microsoft Security Blog · · High severity

    In this article What is device isolation? Case study: QNET Attack chain overview MITRE ATT&CK techniques observed References Learn more Microsoft Defender’s attack disruption now includes device isolation, a new response action that...

  15. River Bank Says Hackers Deleted Data Stolen in Ransomware Attack

    SecurityWeek · · Critical severity

    The bank holding company was hacked in June, but the investigation into the incident continues. The post River Bank Says Hackers Deleted Data Stolen in Ransomware Attack appeared first on SecurityWeek .

  16. Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks

    SecurityWeek · · Critical severity

    The INC Ransomware gang has been targeting vulnerable SMA1000 appliances for root access and lateral movement. The post Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks appeared first on SecurityWeek .

  17. OTX Threat: Toy Ghouls’ new toy: the GenieLocker ransomware

    AlienVault OTX · · High severity

    GenieLocker is a new ransomware family active since March 2026, targeting organizations in the Russian Federation, primarily in manufacturing. Attributed to the financially motivated Toy Ghouls group (also known as Bearlyfy, Labubu, and...

  19. Microsoft Teams vishing attacks lead to Chaos ransomware attacks

    BleepingComputer · · Critical severity

    Threat actors are impersonating IT support staff in Microsoft Teams calls to gain remote access to corporate devices and deploy Chaos ransomware in attacks targeting North American organizations.

  20. US bank places trust in ransomware crew that promised to delete its data

    The Register · · High severity

    Would you trust a ransomware extortionist to delete the data they stole? One bank certainly wants you to. Well over a month into a ransomware cleanup job, River Financial Corporation tells regulators that it “took steps to attempt to...

  21. Ransomware report: VPNs in the crosshairs, AI attacks

    CSO Online Security · · Critical severity

    Ransomware attacks were up year over year in June for the fourth consecutive month, according to the NCC Group, though attacks increased just 3% in Q2 2026 versus the previous quarter. VPNs and other network edge devices continue to be...

  22. Coca-Cola Confirms Data Theft as Fairlife Ransomware Attack Escalates

    TechRepublic · · Critical severity

    Coca-Cola has confirmed data was stolen in the ransomware attack on Fairlife after the Anubis gang published allegedly stolen files, escalating the incident. The post Coca-Cola Confirms Data Theft as Fairlife Ransomware Attack Escalates...

  23. Coca-Cola confirms hackers stole data in Fairlife ransomware attack

    Help Net Security · · Critical severity

    Coca-Cola has confirmed that the ransomware attack on its dairy subsidiary Fairlife involved the theft of company data, weeks after the incident temporarily halted production at its US facilities. Fairlife is a Coca-Cola-owned dairy...

  24. New ransomware targets AI model weights and can't even collect the ransom

    VentureBeat · · High severity

    The same attacker broke into the same internet-facing Langflow server twice, and the second time brought ransomware built to destroy trained AI models. Sysdig's Threat Research Team documented the first campaign on July 1 and the second...

  27. PTC Windchill Vulnerability Exploited in Ransomware Campaign

    SecurityWeek · · High severity

    The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication. The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek .

  28. Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack

    SecurityWeek · · Critical severity

    The Anubis cybercrime group has taken credit for the attack and is threatening to leak data. The post Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack appeared first on SecurityWeek .

  29. Ransomware Groups Increasingly Deploy EDR Kill Techniques

    Infosecurity Magazine · · Critical severity

    Halcyon’s latest quarterly ransomware report showed that while ransomware attacks are declining, obfuscation techniques are getting harder to fight against

  31. Ransomware Is More Disruptive And Recovery Readiness Matters More Than Ever

    Cyber Defense Magazine · · High severity

    Ransomware continues to evolve at a rapid pace, and it is challenging the most common cybersecurity assumptions. Recent findings have revealed a shift in attacker strategy. The post Ransomware Is More Disruptive And Recovery Readiness...

  33. Ransomware Attacks Targeting Universities on the Rise

    Infosecurity Magazine · · Critical severity

    Comparitech’s analysis of incidents in the first half of 2026 finds that the emergence of The Gentlemen ransomware has resulted in surge in attacks against higher education

  35. Ransomware gangs go after EMEA healthcare’s supply chain

    Help Net Security · · Critical severity

    A ransomware attack against a hospital makes headlines, while attacks on the rest of the ecosystem around it tend to stay quiet despite doing damage that can be just as bad. Flare researcher Assaf Morag analyzed ransomware leak-site...

  37. Ransomware in 2026: More groups, more victims, no slowdown

    Help Net Security · · High severity

    Ransomware activity followed a recognizable pattern during the previous four years. Each year was defined by a dominant actor, its collapse, or a major supply chain incident. Black Kite’s 2026 Ransomware Report documents a more...

  40. Swiss train maker tells ransomware crooks to get off at the next stop

    The Register · · High severity

    Swiss rail manufacturer Stadler Rail says it refused a CHF 10 million ($12.3 million) ransom demand after the Everest ransomware gang compromised one of its suppliers. Stadler will not pay, and based on its account of events, the...

Get these stories the moment they break

Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.

Join Updated free

Tech news by section

Tech news by region

Trending topics