U.S. federal investigators have linked executives at ransomware negotiation firms to the ShinyHunters hacking group, which has extorted over $70 million in 2026. ShinyHunters recently breached the FBI recruitment website, stealing sensitive personnel data. Arrests include a Dutch hacker and a Canadian cybersecurity executive charged with extortion-related offenses. Evidence suggests some executives had advance knowledge of breaches and may have helped operate ShinyHunters' extortion website. The investigation also uncovered a murder-for-hire plot linked to the group. The ShinyHunters extortion site pressured victims to pay ransoms under threat of data publication.
The United Kingdom has imposed economic sanctions on Cryptomus, a cryptocurrency payment platform linked to facilitating illicit transactions benefiting Russian entities, including ransomware, narcotics, darknet markets, and other cybercrime services. Cryptomus, also known as Heleket, has processed billions in transactions associated with various criminal activities. The sanctions freeze Cryptomus assets in the UK and prohibit British companies from doing business with it. This action follows prior Canadian fines and targets the broader infrastructure supporting Russia's wartime economy. Cryptomus has circumvented previous penalties by rebranding and continuing operations without KYC controls. The sanctions represent a significant enforcement step by a Five Eyes country against a cryptocurrency operation incorporated within another Five Eyes jurisdiction.
Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware response, was arrested in the United States on suspicion of involvement with the ShinyHunters hacking group. The group recently targeted FBI systems, including the FBI jobs website, allegedly obtaining sensitive information. The FBI attributes the breach to a contractor's failure to patch vulnerable Oracle PeopleSoft software. This arrest is part of an ongoing FBI effort to dismantle the ShinyHunters network, with other key suspects arrested in the Netherlands and Jordan. Dubrovsky faces charges related to conspiracy to extort and interference with commerce by threats. The ShinyHunters group had claimed responsibility for the FBI hack and appeared defiant before their Tor-based site became inaccessible.
The FBI arrested Edward Dubrovsky, co-founder of a Canadian cybersecurity firm specializing in ransomware negotiation, on charges related to assisting the ShinyHunters hacking group. ShinyHunters is known for using phishing and stolen credentials to steal data from software-as-a-service companies and extorting victims by threatening to publish stolen data. Dubrovsky faces charges including conspiracy to threaten confidentiality with intent to extort and interference with commerce by threats. The investigation has centralized in the FBI's Eastern District of Texas, the hub for ShinyHunters-related cases. Dubrovsky authored a book on ransomware negotiation strategies. The case is ongoing with several documents sealed, and further charges against other ransomware negotiation firms may follow.
Ransomware threat actors are shifting tactics away from encrypting data to extorting victims through data theft and demonstrating access by hijacking Active Directory environments. The PAYLOAD campaign exemplifies this trend by using malicious Group Policy Objects to display ransom notes and lock screens without encrypting files. This shift is driven by the increasing difficulty attackers face in collecting ransom payments due to widespread backup practices and the complexity of decrypting large-scale infections. Instead, attackers steal confidential data and threaten publication, which can cause reputational damage and regulatory penalties. Data exfiltration is also harder to detect than encryption-based attacks, making it a more attractive method for extortion. Businesses are advised to maintain strong cyber hygiene, including regular backups, patch management, endpoint protection, and access control to mitigate these evolving extortion threats.
German authorities have arrested a Russian national suspected to be a core member of the Qilin ransomware group following extradition from Japan. This arrest targets a key individual allegedly involved in ransomware operations attributed to Qilin.
IDC Frontier's IDCF Cloud service in Japan suffered a ransomware attack on October 7, 2026, causing an outage in its East Japan Region 1 data center cluster. The attack disrupted services for 495 companies and local governments, leading to the shutdown of impacted systems and disabling of customer management console access. The threat actor claimed to have encrypted large volumes of data and virtual machine resources. IDC Frontier is investigating the attack, isolating affected systems, and verifying security before restoring access. A related outage at Nissui Corporation's logistics subsidiary due to suspected unauthorized access is under investigation, but a connection to the IDCF Cloud attack is unclear. Recent trends indicate increasing cybersecurity incidents targeting Japanese entities, with attackers exploiting access control and authentication weaknesses, possibly accelerated by AI tools. No patch or fix information is available as this is a ransomware incident affecting a cloud service.
Zohar Pinhasi, owner of MonsterCloud, was charged with defrauding ransomware victims by falsely claiming to decrypt data without paying attackers. Instead, he paid ransoms to obtain decryption keys and charged victims a substantial markup for remediation services. The scheme involved paying over $8 million in ransoms while charging clients over $19 million. He faces wire fraud charges and potential lengthy prison sentences.
The CEO of MonsterCloud, a ransomware remediation company, has been charged with defrauding ransomware victims by secretly paying attackers for decryptors while falsely claiming to use proprietary technology to recover encrypted data.
Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay ransom. Attackers use compromised credentials to access and destroy backups, including those stored offsite or in disaster recovery locations, if these share access controls. This trend highlights the need for isolated, immutable backups with strict access controls and regular restore testing to ensure recovery capability.
A core member of the Qilin ransomware group was arrested in Japan and extradited to Germany to face hacking charges related to ransomware attacks. Qilin, active since August 2022, is a prolific ransomware-as-a-service operation responsible for hundreds of attacks worldwide, causing significant financial and operational damage. The group has targeted various sectors including healthcare, logistics, and manufacturing, and exploited vulnerabilities such as CVE-2026-50751 in Check Point products. The arrest marks a law enforcement success against this ransomware gang.
Advantest, a Japanese chip testing company, disclosed a data breach months after a ransomware attack in February 2026. Hackers stole personally identifiable information (PII) including names, dates of birth, contact details, Social Security numbers, passport and driver’s license numbers, and medical and financial information. The company has not indicated public misuse of the data but warned of increased risk of identity theft or fraud. Notifications indicate that over 500 California residents and smaller numbers in Massachusetts and Vermont were affected. No ransomware group has claimed responsibility for the attack.
Advantest Corporation experienced a ransomware attack earlier this year that resulted in the exposure of personally identifiable information of affected individuals. The company has notified those impacted by this data breach.
The Akira ransomware attack involved an adversary gaining initial access via Remote Desktop Protocol (RDP), disabling antivirus protections on the compromised endpoint, exfiltrating data using Rclone, and maintaining persistence with a GOST tunneling tool before deploying the ransomware payload. Key indicators of compromise include specific SHA256 hashes of malicious binaries and a command and control (C2) server IP address. This attack demonstrates tactics such as antivirus evasion, data exfiltration, and persistence mechanisms.
A former core infrastructure engineer at an industrial company in New Jersey was sentenced to 32 months in prison for locking over 3,000 devices on his employer's network in a ransomware-style extortion attempt. The attacker used administrator privileges to change passwords, delete domain admin accounts, and shut down servers and workstations. He demanded a ransom of 20 bitcoins and claimed backups were deleted to prevent recovery. The attack was discovered when password reset notifications were received and domain admin accounts were found deleted, denying access to the network.
A Russian-speaking affiliate of the Gentlemen ransomware group, known as Azazel, operated a sophisticated ransomware and data exfiltration campaign targeting over two dozen organizations across six countries. Azazel exploited stolen CI/CD secrets, GitLab variable stores, and git history to gain initial access, and used novel techniques such as leveraging an AI coding assistant with a reverse shell over MCP as a command and control channel. The operation involved more than 50TB of dedicated bare-metal infrastructure and approximately 6TB of stolen data. Azazel ran an independent leak site to publish victim data and collect ransom payments, bypassing the main ransomware-as-a-service operator. The investigation uncovered active exfiltration during the analysis and detailed victim notification was conducted prior to public disclosure.
The Azazel affiliate of the Gentlemen ransomware group compromised over two dozen organizations across six countries by exploiting CI/CD secrets from GitLab and deeply compromising an AI platform using SSRF, credential decryption, and continuous data exfiltration. Azazel operated an independent leak site called LEAKNED to publish stolen data and manage extortion proceeds. This campaign is notable for the first documented criminal use of AI assistant tooling via the Model Context Protocol (MCP) as a command-and-control channel. The attacker infrastructure included three nodes with over 50TB storage capacity, transferring approximately 6TB of victim data. Affected sectors include logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent organizations.
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]
An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. [...]
KillSec was a ransomware group active since around 2024, responsible for roughly 1,000 suspected attacks worldwide. The group used software vulnerabilities and weakly protected entry points, especially cloud storage, to steal sensitive data from victims. Police have shut down KillSec's leak site, seized at least 110 terabytes of stolen data, and arrested several alleged members, including a 16-year-old suspected leader. The group's infrastructure, including five core servers, was taken over by law enforcement, and its domains now redirect to seizure notices. The investigation is ongoing with international cooperation and support from cybersecurity firms.