A Ransomware Gang’s Sloppy Encryption Code Is Accidentally Saving Victims’ Data
Check Point researchers found that the latest build of HYFLOCK ransomware only encrypts the first 4KB of larger files, letting victims recover partial content from Office documents despite...
An AI Agent Helped Run This Ransomware Attack on UK Schools — and Left a Noisy Trail Doing It
Bitdefender researchers say a 3AM ransomware affiliate combined human decision-making with an AI agent that handled repetitive technical grunt work during an attack on a UK school network,...
Old Synology NAS Flaws Resurface as C3RB3R Ransomware Locks Up Home and Business Storage
Security researchers say a ransomware strain tracked as C3RB3R is encrypting files on Synology network storage devices by exploiting vulnerabilities the vendor patched back in 2024. Synology is...
Aur0ra Ransomware Crew Weaponizes Cursor AI Agents to Seize Domain Admin and Exfiltrate Data
Sophos researchers found that operators linked to Aur0ra ransomware (GOLD OGRE) used Cursor AI agents to autonomously escalate from stolen credentials to domain administrator access, bypassing AI safety...
Gentlemen Ransomware Gang Disarms Windows Defender and Shreds Backups Before Encrypting Files
Acronis researchers have detailed how the Gentlemen ransomware-as-a-service operation disables Windows Defender, kills backup services, wipes Volume Shadow Copies, and even abuses a vulnerable Lenovo driver to kill...
ClickFix Campaign Deploys Stealthy Python Tunnels Ahead of Ransomware Attacks
A investigated Windows intrusion used ClickFix social engineering, DLL sideloading and encrypted Python tunnels to establish durable remote access. Researchers stopped the attack before encryption, but its tooling...
Ransomware Crews Exploit GlobalProtect Bypass to Enter Networks Through Trusted VPNs
Multiple ransomware groups are exploiting CVE-2026-0257 to establish unauthorized GlobalProtect VPN sessions. Defenders should patch every affected component, invalidate active sessions, and investigate post-login activity for signs of...
Gentlemen Ransomware Gang Claims KFC Breach, but Evidence So Far Is Thin
A listing from the Gentlemen ransomware group names KFC's US operations as a victim, but the claim currently rests on branding and business descriptions rather than leaked files...