ThreatHuntersJournal
RansomwareThe Hacker News·5 days ago

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

A threat actor calling itself Ransom Busters is contacting ransomware victims via email, claiming to have compromised ransomware operators' servers and offering to delete stolen data for fees between $20,000 and $60,000. The group presents itself as a recovery service, though security researchers flagged this approach as highly suspicious and anomalous. This represents a novel extortion vector where attackers exploit victims' vulnerability following ransomware incidents.

RansomwareCheck Point Research·5 days ago

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Check Point Research has identified a large-scale operation targeting thousands of WordPress sites using a ransomware family called StopAndProtect, which employs a ClickFix social-engineering technique to trick victims into executing malicious PowerShell commands. The attack chain involves multiple stages of downloaders, suggesting a sophisticated distribution infrastructure behind the campaign.

RansomwareDark Reading·5 days ago

'Ransom Busters': Ransomware Actor Poses as Incident-Recovery Service

A ransomware affiliate is impersonating legitimate incident-recovery services to contact victims, exploiting trust during their most vulnerable moments. The tactic aims to intercept and divert ransom payments rather than provide genuine assistance, representing a novel social-engineering angle within the ransomware threat landscape.

RansomwareInfosecurity Magazine·5 days ago

Three-quarters of Ransomware Attacks Target Mid-Market Firms

Mid-market organizations have become the primary target for ransomware attacks, accounting for three-quarters of incidents according to Black Kite research. Manufacturers within this segment face particularly elevated risk, making mid-market firms an attractive target for threat actors seeking to balance operational disruption with payment likelihood.

RansomwareTenable·6 days ago

Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities

Cybercrime group Storm-0501 has evolved beyond traditional endpoint ransomware to target Azure cloud environments directly, systematically disabling security controls like resource locks and backups to hijack entire cloud tenants. Tenable One Cloud Exposure uses AI-powered threat detection to map Storm-0501's tactics across the attack chain and correlate fragmented Azure activity logs into actionable threat stories for rapid containment. The shift to cloud-native ransomware demands cloud detection and response capabilities that can trace lateral movement, identify initial breach points, and guide immediate defensive actions like credential revocation and policy restoration.

RansomwareCheck Point Research·6 days ago

17th August – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were […] The post 17th August – Threat Intelligence Report appeared first on Check Point Research.

RansomwareThe Register·1 week ago

The backup Microsoft never promised you

SPONSORED FEATURE: Your M365 and Azure data might not be as safe as you think from ransomware; time for a reality check

RansomwareCheck Point Research·1 week ago

The State of Ransomware Q2 2026

For the past year, the ransomware conversation has centered on concentration: a handful of dominant RaaS operations controlling most of the damage, and a shrinking pool of active groups fighting over the same territory. The State of Ransomware Q2 2026 report from Check Point Research shows that picture starting to shift. The leaders are still winning, but […] The post The State of Ransomware Q2 2026 appeared first on Check Point Research.

RansomwareInfosecurity Magazine·1 week ago

Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure

Gunra ransomware actors are leveraging Fortinet vulnerabilities to compromise critical infrastructure while employing stealth tactics to exfiltrate large volumes of data from Microsoft services. US and Korean government agencies have jointly warned of this threat activity, highlighting the use of legitimate cloud services in data theft operations.

Threat actor: Gunra
RansomwareHuntress Blog·1 week ago

Akira Hits Safe Mode: Ransomware Rebooting Around EDR

An Akira ransomware affiliate attempted to evade endpoint detection and response tools by rebooting into Safe Mode to disable EDR and Windows Defender, but the technique backfired when the ransomware itself failed to execute in that environment. Huntress has documented the complete attack chain showing how this evasion tactic ultimately hindered the attacker's own encryption capabilities. The incident highlights the double-edged nature of Safe Mode abuse, where defensive measures can inadvertently impede malicious payloads.

Threat actor: Akira
RansomwareDark Reading·1 week ago

Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA

The Gunra ransomware gang is actively exploiting known Fortinet vulnerabilities and leveraging leaked Conti code to compromise critical infrastructure targets while circumventing multi-factor authentication. The group's success against defended environments suggests that unpatched firewall and VPN appliances remain a significant attack surface, even when MFA protections are in place.

Threat actor: Gunra
RansomwareInfosecurity Magazine·1 week ago

Suisan City, California, Responds to Cyber Incident Amid Wave of US Local Government Attacks

Suisan City, California, has fallen victim to a cyber incident that has disrupted police and fire response services, adding to a growing wave of attacks targeting US local government entities. The attack is part of a broader pattern, with at least two other local authorities experiencing cyber incidents within the same week.

RansomwareMicrosoft Security Blog·1 week ago

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

DeadLock is an emerging financially motivated ransomware operation that leverages Rust-based encryption alongside decentralized infrastructure to manage victim communications, negotiations, and data leak operations. The group employs double extortion tactics to pressure victims into paying ransom demands, combining encryption with threats of public data disclosure.

Load more