The cybercrime gang has listed major companies such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision. The post Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign appeared first on SecurityWeek .
The FBI said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. [...]
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]
StopAndProtect is a large-scale malware operation abusing thousands of hacked WordPress sites as infrastructure to spread malware, control infected machines, and store stolen data. It uses a multi-stage infection chain initiated by a social engineering ClickFix prompt leading to PowerShell scripts and .NET loaders. The operation includes ransomware, data theft, screen locking, credential stealing, and a chat utility. Operational security failures exposed extensive logs, screenshots, and source code, revealing the scale and tools used. Many compromised WordPress sites are outdated and vulnerable, facilitating the attackers' control. The campaign affects victims globally, with many IPs from the US, Russia, and India. No official patch or fix is applicable as this is a malware campaign leveraging vulnerable third-party sites.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. [...]
Storm-0501 is a financially motivated cybercrime group conducting sophisticated ransomware campaigns targeting Microsoft Azure cloud environments. Unlike traditional ransomware that encrypts local endpoints, Storm-0501 hijacks cloud tenants by compromising high-privilege administrative identities, dismantling defensive controls such as resource locks and backups, and weaponizing native cloud tools. This cloud ransomware campaign involves evading detection, exfiltrating data, destroying backups, and demanding ransom payments. Detection requires cloud detection and response (CDR) capabilities that provide full visibility into the attack chain and connect disparate cloud activity logs into a unified threat story. Tenable One Cloud Exposure offers AI-powered threat detection tailored to Storm-0501’s tactics, enabling rapid triage, containment, and recovery actions to mitigate the impact of these attacks.
C2Looper is a Rust-based backdoor malware identified in mid-2026, associated with ransomware threat actors. It provides remote shell execution, reconnaissance, and payload deployment capabilities. Initial versions communicate via plaintext HTTP, while later versions use GitHub repositories for command-and-control, storing commands and exfiltrated data in JSON files. Version 2 adds features such as drive enumeration, shellcode injection, and file listing. Delivery is assessed with low to medium confidence to occur through multi-stage ClickFix infection chains. The malware is actively developed and likely used by initial access brokers to facilitate ransomware and data theft operations.
Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data. [...]
This article provides a detailed technical breakdown of the active exploitation of the critical VMware vCenter vulnerability CVE-2026-59310 by a suspected APT group. It covers the attack chain, including the use of a directory traversal flaw to deploy persistent reverse SSH tools and web shells, and offers specific indicators of compromise and mitigation guidance.
The article provides a detailed analysis of the Shell data breach attributed to the Cl0p ransomware syndicate, highlighting the exfiltration of 89GB of sensitive engineering data through a pure extortion attack. It explains Cl0p's shift from traditional ransomware encryption to data theft and extortion, the risks posed to the global energy supply chain, and offers concrete defensive recommendations for critical infrastructure operators.
This content discusses a proposed ransomware defense approach that assumes an attacker has local administrative privileges and enforces immutability on files at the kernel level to prevent modification or deletion. The author built a kernel-level filter driver enforcing Write Once Read Many (WORM) semantics on a mapped drive, tested it against a ransomware sample, and observed that files on the protected drive remained unchanged. The discussion questions whether this approach adds value beyond good backups and considers operational challenges. No exploit or vulnerability is reported; rather, it is a conceptual defense technique shared for community feedback.
An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...]
An Akira ransomware affiliate gained initial access through an exposed SonicWall VPN without multi-factor authentication via credential spraying. After compromising the domain controller, the attacker performed Active Directory enumeration, collected and exfiltrated data using WinRAR and s5cmd to cloud storage. The affiliate employed a novel evasion technique by rebooting the victim host into Safe Mode with Networking to disable EDR and antivirus protection. AnyDesk was installed as a persistent remote access mechanism. However, the Safe Mode environment caused the ransomware to fail due to out-of-virtual-memory errors, preventing encryption. Despite the encryption failure, the attacker had already exfiltrated credentials and file shares, enabling extortion through data leak threats. This marks the first observed instance of Akira affiliates using Safe Mode boot as an anti-EDR technique.
DeadLock ransomware employs a decentralized infrastructure leveraging blockchain-backed services to maintain resilient communication channels with victims and to conduct data-leak activities. This approach aims to resist traditional infrastructure takedown attempts by law enforcement or security teams. No specific affected software versions or patches are identified. There is no indication of active exploitation details or known exploits in the wild at this time.
A high-severity remote code execution vulnerability in Microsoft SharePoint is being actively exploited by ransomware groups since early July. The vulnerability allows attackers to execute code remotely on affected SharePoint servers, facilitating ransomware deployment. The issue has been confirmed by CISA and reported by Bleeping Computer. No specific affected versions or patch information is provided in the available data.
U.S. federal agencies and South Korea's National Policy Agency issued a joint advisory warning government and critical infrastructure organizations worldwide about Gunra ransomware attacks. Gunra is a double-extortion ransomware variant derived from leaked Conti ransomware source code. It targets multiple sectors including healthcare, finance, and government services. The group exploits known vulnerabilities in Fortinet firewalls and VPN gateways to gain network access. Since early 2026, Gunra operates a ransomware-as-a-service platform, recruiting affiliates and initial access brokers. The advisory recommends patching exploited vulnerabilities, network segmentation, and offline backups to mitigate risk.
A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]
In this article Pre-encryption Encryption Post-encryption Defending against DeadLock ransomware Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process. This architecture likely increases the resilience of portions of its communication, leak-hosting, and negotiation infrastructure, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims. Microsoft has observed DeadLock ransomware being deployed by multiple groups including an affiliate of the Lynx and INC ransomware ecosystems. First observed in July 2025, DeadLock operators employ double extortion tactics, encrypting victim environments while threatening to publicly release exfiltrated data. As of July 2026, the operators have published more than 80 compromised organizations on their data leak site, called the DeadLock blog, with more than half of the claimed victims in Europe. Microsoft identified DeadLock ransomware impacting organizations across information technology (IT), mining, transportation and logistics, manufacturing, hospitality, consumer goods, and other sectors in Europe, Asia, North America, South America, and Africa. The DeadLock encryptor includes a resource-aware throttling mechanism designed to maintain system responsiveness during encryption. In addition to its encryption capabilities, the ransomware also appears to implement language or country-based geofencing designed to avoid running in environments associated with former Soviet and Commonwealth of Independent States (CIS)-linked countries as well as select Middle Eastern countries, a pattern commonly observed among ransomware operators believed to operate from those regions. Together, these capabilities demonstrate how DeadLock combines established ransomware tradecraft with decentralized infrastructure designed to improve operational resilience. In this blog, we present a technical analysis of the DeadLock ransomware encryptor, covering its execution flow, defense evasion techniques, encryption design, and post-encryption behaviors, including a decentralized recovery chat system. We also provide indicators of compromise (IOCs), Microsoft Defender detections, and mitigation guidance to help organizations defend against this threat and similar ransomware activity. Pre-encryption Configuration parsing Before performing any malicious activity, the DeadLock encryptor decrypts an embedded configuration blob using XOR decoding with an 8-byte key. Below are the malware’s configuration fields and their values. Field Value Victim UID Malware public key 03bf50bbf97c4e951e66ff12b689a37a3ce675b4921e254eae76da77573843e4a9 Encryption rule 1000,05052429880,025124288000,010524288000,F991114288000 Language exclude list Geofencing language IDs (see Language geofencing ) Process stop list Processes to terminate (see Process and service termination ) Service stop list Services to stop and delete (see Process and service termination ) File exclude list Extensions and file names to avoid encrypting (see Directory traversal ) Directory exclude list Pre-traversal filter with directories to avoid encrypting (see Directory traversal ) Sub-path Exclude List Sub-paths to avoid encrypting during traversal (see Directory traversal ) Text ransom note Full text ransom note content (see Ransom notes deployment ) HTML recovery chat Full HTML/JS interactive chat page (see Recovery chat: Technical architecture ) Language geofencing As an early exit check, the malware queries the system’s default and user interface (UI) languages. If either language matches the exclude list in the configuration, the malware self-deletes immediately withou…
CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. [...]