KFC Appears on Gentlemen Ransomware Leak Site, but Breach Remains Unconfirmed
The Gentlemen ransomware operation has listed KFC as an alleged U.S. victim, but no public evidence currently confirms a compromise. The claim lacks file samples, a technical timeline,...
Warlock Ransomware Turns SharePoint Servers Into Gateways to Essential Services
A China-linked operator is exploiting on-premises SharePoint flaws to deploy Warlock ransomware across water, telecom, government and education organizations. Recent intrusions show how web shells, stolen machine keys,...
New Ransomware Brand Galago Claims Ties to the Panzer Group, but Proof Is Thin So Far
A newly spotted ransomware operation calling itself Galago has surfaced with claimed links to the more established Panzer group, including an alleged 105GB theft from an Icelandic healthcare...
Extradited Ryuk Ransomware Conspirator Sentenced to Federal Prison in Oregon Case
Karen Vardanyan, an Armenian national extradited from Ukraine, has been sentenced to 24 months in federal prison and ordered to pay more than $1.2 million in restitution for...
PAYLOAD Group Weaponizes Windows Group Policy to Take Down an Entire Domain Without Touching a Single File
A ransomware crew calling itself PAYLOAD breached a Middle Eastern manufacturer's Windows domain and disrupted it enterprise-wide using nothing but malicious Group Policy Objects — no encryption, no...
ENCFORGE Ransomware Targets the Models, Datasets and Vector Stores Behind AI
The JADEPUFFER threat actor has progressed from improvised database destruction to ENCFORGE, ransomware built to encrypt AI models, datasets and vector indexes. Defenders need runtime detection and recovery...
Feral Wolf Ransomware Exploits Confluence and Exposed 1C Systems to Breach Networks
Feral Wolf ransomware operators are chaining known Confluence flaws, weak database credentials, and exposed 1C management services to penetrate Russian organizations. The intrusions combine custom backdoors, credential theft,...
Attackers Are Quietly Cloning Domain Controllers’ Password Database — Then Deleting the Evidence
Incident responders at Huntress have documented a stealthy attack pattern in which intruders use Windows' own shadow-copy tooling to clone and steal the Active Directory password database, then...