A Ransomware Gang’s Sloppy Encryption Code Is Accidentally Saving Victims’ Data
Check Point researchers found that the latest build of HYFLOCK ransomware only encrypts the first 4KB of larger files, letting victims recover partial content from Office documents despite...
Old Synology NAS Flaws Resurface as C3RB3R Ransomware Locks Up Home and Business Storage
Security researchers say a ransomware strain tracked as C3RB3R is encrypting files on Synology network storage devices by exploiting vulnerabilities the vendor patched back in 2024. Synology is...
Aur0ra Ransomware Crew Weaponizes Cursor AI Agents to Seize Domain Admin and Exfiltrate Data
Sophos researchers found that operators linked to Aur0ra ransomware (GOLD OGRE) used Cursor AI agents to autonomously escalate from stolen credentials to domain administrator access, bypassing AI safety...
Ransomware Gangs Lean on Generative AI to Outrun Signature-Based Defenses
New Zscaler research shows ransomware operators increasingly using generative AI to write custom malware, craft near-flawless phishing lures, and sift stolen data faster than ever. The trend is...
ClickFix Campaign Deploys Stealthy Python Tunnels Ahead of Ransomware Attacks
A investigated Windows intrusion used ClickFix social engineering, DLL sideloading and encrypted Python tunnels to establish durable remote access. Researchers stopped the attack before encryption, but its tooling...
New Ransomware Brand Galago Claims Ties to the Panzer Group, but Proof Is Thin So Far
A newly spotted ransomware operation calling itself Galago has surfaced with claimed links to the more established Panzer group, including an alleged 105GB theft from an Icelandic healthcare...
Extradited Ryuk Ransomware Conspirator Sentenced to Federal Prison in Oregon Case
Karen Vardanyan, an Armenian national extradited from Ukraine, has been sentenced to 24 months in federal prison and ordered to pay more than $1.2 million in restitution for...
Feral Wolf Ransomware Exploits Confluence and Exposed 1C Systems to Breach Networks
Feral Wolf ransomware operators are chaining known Confluence flaws, weak database credentials, and exposed 1C management services to penetrate Russian organizations. The intrusions combine custom backdoors, credential theft,...