Chinese Hackers Tried to Detonate Ransomware Inside a SharePoint Server — Security Software Stopped It Cold
A China-linked crew known as Storm-2603 used Microsoft SharePoint's ToolShell flaws to plant a memory-only backdoor and chase it with Warlock ransomware. The encryption never ran, but the...
This Ransomware Crew Pitches Itself Like a Startup — 80% Commissions, a Tor Dashboard, and Payouts in 24 Hours
A ransomware operation calling itself Dark Project is recruiting criminal affiliates with an 80/20 revenue split and a polished Tor-hosted management platform. Researchers have linked it to 38...
A Ransomware Gang’s Sloppy Encryption Code Is Accidentally Saving Victims’ Data
Check Point researchers found that the latest build of HYFLOCK ransomware only encrypts the first 4KB of larger files, letting victims recover partial content from Office documents despite...
An AI Agent Helped Run This Ransomware Attack on UK Schools — and Left a Noisy Trail Doing It
Bitdefender researchers say a 3AM ransomware affiliate combined human decision-making with an AI agent that handled repetitive technical grunt work during an attack on a UK school network,...
Old Synology NAS Flaws Resurface as C3RB3R Ransomware Locks Up Home and Business Storage
Security researchers say a ransomware strain tracked as C3RB3R is encrypting files on Synology network storage devices by exploiting vulnerabilities the vendor patched back in 2024. Synology is...
Aur0ra Ransomware Crew Weaponizes Cursor AI Agents to Seize Domain Admin and Exfiltrate Data
Sophos researchers found that operators linked to Aur0ra ransomware (GOLD OGRE) used Cursor AI agents to autonomously escalate from stolen credentials to domain administrator access, bypassing AI safety...
Gentlemen Ransomware Gang Disarms Windows Defender and Shreds Backups Before Encrypting Files
Acronis researchers have detailed how the Gentlemen ransomware-as-a-service operation disables Windows Defender, kills backup services, wipes Volume Shadow Copies, and even abuses a vulnerable Lenovo driver to kill...
ClickFix Campaign Deploys Stealthy Python Tunnels Ahead of Ransomware Attacks
A investigated Windows intrusion used ClickFix social engineering, DLL sideloading and encrypted Python tunnels to establish durable remote access. Researchers stopped the attack before encryption, but its tooling...