The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]
Oleksii Oleksiyovych Lytvynenko, a Ukrainian national involved in the Conti ransomware operation, was sentenced to four years in a US prison. He was arrested in Ireland in 2023 and extradited to the US in 2025. Lytvynenko pleaded guilty to wire fraud, admitting to developing malware loaders for Conti and possessing stolen victim data. The Conti ransomware gang operated between 2020 and 2022, extorting at least $150 million from victims across more than 30 countries. Lytvynenko remained active in ransomware attacks even after the Conti group disbanded until his arrest. This sentencing is part of broader law enforcement actions against ransomware affiliates.
A Ukrainian national has been sentenced to four years in prison for involvement in Conti ransomware attacks conducted between 2021 and 2022. The sentencing reflects law enforcement efforts to disrupt ransomware operations and hold individuals accountable for cybercrime activities.
Mantax Otax is a newly identified Android malware strain that combines ransomware and spyware functionalities. It encrypts files on infected devices, steals sensitive user data, and additionally spams and harasses victims. This multifaceted malware poses a significant threat to Android users by compromising both data confidentiality and user experience.
In June 2026, a new malware family named SloppyRAT was identified, likely used by ransomware-related threat actors to establish footholds for lateral movement. Delivered through multi-stage ClickFix infection chains, the malware features encrypted code blocks, EtherHiding for command-and-control resolution via Polygon JSON-RPC protocol, and multiple anti-analysis techniques including junk code and indirect system calls. SloppyRAT implements certificate pinning to prevent TLS traffic inspection and includes 47 built-in PowerShell-like commands for remote access. The infection chain uses finger.exe, IronPython, and deploys CastleLoader and CastleRAT components before installing SloppyRAT. Despite sophisticated capabilities, the codebase contains numerous software bugs affecting persistence mechanisms and other features, suggesting active development.
Two recently patched vulnerabilities in Cisco Secure Firewall Management Center (FMC) have been exploited by multiple threat clusters linked to ransomware and state-sponsored attacks. CVE-2026-20079 is a critical authentication bypass vulnerability with a CVSS score of 10.0, allowing unauthenticated remote root access. CVE-2026-20316 involves static credentials for a low-privileged account and has a CVSS score of 5.3 but can be combined with other flaws for privilege escalation. Exploitation has led to deployment of web shells, credential theft, reverse shells, proxies, and malware including Qilin ransomware and Cyclops Blink backdoor. Cisco has released hotfixes for both vulnerabilities and plans further hardening patches. The attacks highlight significant post-compromise activity by ransomware affiliates and a Russian state-sponsored group known as Sandworm.
A critical remote code execution (RCE) vulnerability in WatchGuard Firebox firewalls (CVE-2025-14733) is actively exploited by ransomware gangs. The flaw allows unauthenticated attackers to execute malicious code remotely via an out-of-bounds write. It affects Fireware OS versions 11.x and later, 12.x and later, and 2025.1 through 2025.1.3. Despite patches released in December 2025, many devices remain unpatched and exposed online. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and included this vulnerability in its Known Exploited Vulnerabilities catalog, mandating urgent patching for federal agencies. WatchGuard has provided indicators of compromise to assist detection. The vulnerability is particularly risky when IKEv2 VPN is configured, but residual risk remains if certain VPN configurations persist.
Mantax Otax is an Android malware targeting devices running Android 9 and earlier. It combines ransomware and spyware capabilities, encrypting files with AES and appending .enc extensions. The malware requests extensive permissions, including device administrator and accessibility access, to steal sensitive data such as screen recordings, browser history, PINs, contacts, call logs, SMS, and chats from WhatsApp and Telegram. It communicates with command and control servers via HTTPS and WebSockets, using dynamic domain resolution through GitHub. Version 2 introduces advanced features like UI hijacking, screen blocking, touch input interception, harassment capabilities, and remote text-to-speech. Data exfiltration is facilitated through Firebase and Catbox services, enabling a double-extortion scheme with an interactive ransom chat portal.
Veradigm, a healthcare technology company, disclosed a data breach resulting from a cybersecurity incident at a third-party vendor. The breach involved unauthorized access to patient personal data, including Social Security numbers, through compromised vendor credentials used to access a limited API interface. Clinical and medical information was not affected. The ransomware group 'The Gentlemen' claimed responsibility, threatening to leak 3.5 million patient records if a ransom is not paid. Veradigm has initiated incident response, notified law enforcement, and is notifying affected individuals with credit monitoring offered where applicable. The investigation is ongoing, and Veradigm does not expect a material impact on its business or operations.
This content is an analytical discussion from Cisco Talos about the challenges in producing actionable threat intelligence and the operational hurdles posed by AI safety guardrails in cybersecurity defense. It highlights how AI models with restrictive guardrails can impede legitimate forensic and defensive tasks, while adversaries exploit unconstrained AI models for attacks. The piece emphasizes the need for security teams to regain control over AI capabilities to maintain an advantage against attackers. It also shares insights into adversary engagement and the human factors influencing cybercriminal behavior.
This content outlines a comprehensive ransomware protection approach for Managed Service Providers (MSPs), emphasizing six critical capabilities to ensure faster recovery from ransomware attacks. It highlights that ransomware resilience requires more than just backups or endpoint detection, advocating for integrated prevention, detection, response, and recovery controls. The article details operational controls such as exposure reduction, attack detection before encryption, 24/7 response, immutable recovery points, clean recovery processes, and multi-tenant operational management. It stresses that immutable backups alone do not prevent data exfiltration or breach notification responsibilities, thus requiring broader detection and containment measures. The guidance is based on the Acronis Cyber Protect Cloud platform and its associated services, providing a tested framework for MSPs to validate their ransomware protection services. This is an advisory and best-practice checklist rather than a specific vulnerability or exploit.
Nutex Health, a healthcare services company, experienced a data breach involving unauthorized access to its network. The breach resulted in the theft of patient, employee, provider, business, and financial information. The ransomware group known as The Gentlemen claimed responsibility and threatened to publicly release the stolen data. Nutex Health has notified the SEC and is investigating the incident while facing potential litigation. No material impact on business operations or financial reporting has been identified so far.
Berlin's city administration confirmed a ransomware attack by the Rhysida gang, which exfiltrated approximately 5.79 TB of data including government, legal, financial, and sensitive infrastructure information. The attackers are attempting to extort the city by threatening to publish stolen data, leveraging GDPR violations to pressure payment. The breach was discovered in mid-August 2026, and investigations by multiple law enforcement and security agencies are ongoing. The method of initial access remains undisclosed. No evidence of election data compromise was found, and affected departments were disconnected from the network to contain the incident.
The Rhysida ransomware group claimed responsibility for a cyberattack on Berlin's Senate Department for Mobility, Transport, Climate Protection, and Environment, stealing over 5.7 terabytes of data including personal information, credentials, and confidential documents. The attack was detected in mid-August 2026, leading to network shutdowns to contain the breach. The extortion group demanded a ransom of approximately 30 bitcoins (~$2.3 million), which Berlin has publicly refused to pay. An ongoing investigation is being conducted by local and federal authorities. The stolen data reportedly includes sensitive personal and financial information of over 12,000 individuals.
The TerminalFix campaign is a sophisticated multi-stage intrusion targeting organizations via compromised websites that display fake Cloudflare CAPTCHA overlays. Victims are tricked into executing malicious PowerShell commands that download and execute a signed legitimate binary alongside a malicious DLL for sideloading. This leads to steganographic payload extraction, extensive Active Directory reconnaissance, and deployment of a Python-based reverse-tunnel implant providing persistent network-level proxy access. The campaign enables attackers to pivot within the network, conduct domain enumeration, and maintain stealthy persistent access. Although no direct downstream actions were observed, the access gained could facilitate privilege escalation, data exfiltration, and ransomware deployment. The campaign combines advanced evasion techniques and persistent network access, posing a serious threat to enterprise environments.
This is a cybersecurity news roundup covering multiple topics including a Log4j vulnerability scare that was later downplayed by developers, ransomware claims involving U.S. Bank linked to a fourth-party provider, the shutdown of container image provider Minimus, and various other incidents such as credential leaks, mobile banking malware expansion, and data breaches. The Log4j vulnerability mentioned is confirmed by developers as a known issue with specific exploitation conditions, not a new critical threat. Other stories include sanctions on Iranian hackers, a cyberattack on Manchester Airports Group, and exposure of sensitive data in breaches. The report provides a broad overview of recent cybersecurity events without focusing on a single exploitable vulnerability or active exploit.
The US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cybersecurity incident after the Qilin ransomware group claimed responsibility. The affected system was standalone and disconnected promptly, with no impact on the ATF enterprise network or mission capabilities. An investigation is ongoing with the Department of Justice, and the incident is designated a 'major incident' under federal guidelines. Qilin ransomware operates a double-extortion model, encrypting files and exfiltrating data, but no specific claims or leaked data have been made public by the group regarding this incident.
The Gentlemen is a ransomware group active since July 2025, operating a Ransomware-as-a-Service model with dual-extortion tactics. They target Windows, Linux, and ESXi systems, focusing on extensive preparation before encrypting data. Their methods include privilege escalation using legitimate tools, persistence via registry and scheduled tasks, disabling security tools, deleting logs, and terminating backup services. They use strong encryption algorithms XChaCha20 and Curve25519. The group primarily targets medium-to-large organizations in the Asia-Pacific region, with a recent surge in activity. Victims face ransom demands with about 10-day deadlines and threats of data publication if unpaid.
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a major security incident involving a standalone system after claims by the Qilin ransomware gang. The compromised system is separate from the ATF enterprise network and other critical ATF systems. The incident is under investigation with the Department of Justice, and ATF has taken immediate containment and forensic actions. There is no indication that ATF operations or core systems were affected.
A suspected ransomware affiliate operating under the name "Ransom Busters" impersonates a ransomware recovery service to fraudulently collect ransom payments from victims. This group contacts victims before attacks become public, claiming to have decryption keys and the ability to delete stolen data for fees ranging from $20,000 to $60,000. Evidence suggests that Ransom Busters is likely the actual ransomware affiliate responsible for the attacks, using the same tools and tactics across multiple ransomware-as-a-service (RaaS) operations. Victims are advised not to pay Ransom Busters, as this group is not a legitimate recovery service and may be stealing payments from ransomware gangs. This activity increases risks for victims by undermining trust in ransomware negotiations and complicating data protection assurances.
