Research reports
1,224 reports from 387 publishers45 added in the past week
128 reports, newest added first
Added Tue 5 May
Inside the Hive
In the first 11 months of 2021, over 60% of all incidents investigated by Group-IB involved ransomware. Ransomware has finally established itself as cyber threat number one. In July 2021, international media reported that REvil ransomware operators demanded a…
Ransomware
Cybercriminal greeners from Iran attack companies worldwide for financial gain
Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has detected financially motivated attacks carried out by Iranian newbie threat actors in June. The attackers used Dharma ransomware and a mix of publicly available tools…
RansomwareState-sponsored
Added Sun 3 May
Nemty 1.6 Ransomware Released and Pushed via RIG Exploit Kit
The RIG exploit kit is now pushing a cocktail of malware that includes a new variant of the Nemty Ransomware. First spotted by exploit kit researcher mol69, a malvertising campaign is redirecting users to the RIG exploit kit to target enterprise users who are…
RansomwareMalwareVulnerabilities
Added Fri 1 May
City of Liege, Belgium hit by ransomware
Liege, the third biggest city in Belgium, has suffered today a ransomware attack that has disrupted the municipality's IT network and online services. Following the attack, most of the city's civil status and population services are down, Liege officials said…
Ransomware
Amazon-owned Ring denies ‘ransomware event’ following darknet listing
The smart doorbell and security camera company Ring has denied that it suffered a ransomware attack after the company was listed on a prominent ransomware gang’s extortion site. The ALPHV ransomware group, also known as BlackCat, added the listing for Ring to…
Ransomware
Ransomware gang Conti published data of 850 companies
Group-IB, one of the global leaders in cybersecurity and headquartered in Singapore, has today presented its findings about ARMattack, one of the shortest yet most successful campaigns by the Russian-speaking ransomware gang Conti. In slightly more than a…
Ransomware
Cybersecurity News: INC targets healthcare, Providence schools cyberattack, Apple iPads bricked
A warning from Microsoft about a financially motivated threat actor who is using INC ransomware against the U.S. health sector for the first time. The group has been given the name Vanilla Tempest. In a series of posts on X, Microsoft describes its campaign…
Ransomware
Significant ransom payment by major Iranian IT firm underway
Major Iranian IT vendor Tosan has been providing ransom payments on an installment basis following a significant cyberattack by the IRLeaks threat operation last month, which was reported to have compromised data from nearly 70% of the country's active credit…
Ransomware
Added Wed 29 Apr
Response When Minutes Matter: Rising Up Against Ransomware
This blog describes a recent incident that highlights the CrowdStrike Falcon® Complete™ team’s ability to act as an extension of a customer’s security team to quickly detect, triage and contain an active attacker before it was able to achieve its goal. In…
Ransomware
Ransomware Spotlight: Ransomhub
The following section details the initial infection chain observed from RansomHub activity as illustrated in Figure 1. Initial Access The RansomHub ransomware group use spear-phishing voice scams for initial access. The cybercriminals use social engineering…
Ransomware
Added Fri 24 Apr
Ransomware attacks airport authority's servers
A crypto virus that attacked the Albany County Airport Authority's computer management provider during the Christmas holiday period ended up infecting the authority's servers as well, encrypting files and demanding a ransom payment. Paul Buckowski/Times Union…
Ransomware
Charger Malware Calls and Raises the Risk on Google Play
Several weeks ago, Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “Charger.” This incident demonstrates how…
RansomwareMalwareMobile
Added Thu 23 Apr
Ukrainian Arrested and Charged with Ransomware Attack on Kaseya
The Justice Department announced today recent actions taken against two foreign nationals charged with deploying Sodinokibi/REvil ransomware to attack businesses and government entities in the United States. An indictment unsealed today charges Yaroslav…
RansomwareTakedowns and arrests
Negotiations with the Akira ransomware group: an ill-advised approach
@Chum1ng0 took a look at four victims of Akira and what happened in terms of negotiations or not. In translation: After a detailed analysis, we identified four chats from different companies that attempted to communicate with Akira after being attacked. Some…
Ransomware
Added Sun 19 Apr
CRYING IS FUTILE: SandBlast Forensic Analysis of WannaCry
Using the NSA exploit EternalBlue released by the Shadow Brokers, the WannaCry ransomware developers have added their names to malware lore. Given the number of institutions hit and the amount of media generated, it seemed appropriate to show what the…
Ransomware
Added Fri 17 Apr
Exclusive: Krybit hackers claim breach of New Zealand IT services provider
Ransomware new kids on the block, Krybit, has listed Auckland-based Dencom New Zealand as a hacking victim. A newcomer to the ransomware scene has listed Kiwi company Dencom New Zealand as a victim on its darknet leak site, one of 16 victims the group has…
Ransomware
[KRYBIT] - Ransomware Victim: Hacked 0APT
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an…
Ransomware
[KRYBIT] - Ransomware Victim: fraper[.]com
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an…
Ransomware
No Encryptors, No Problem: The Coinbase Cartel Ransomware Group
The ransomware threat actor Coinbase Cartel first emerged in September 2025 and claimed 14 victims that month. The group focuses on data exfiltration, which aligns with a trend Bitdefender is tracking in the ongoing evolution of ransomware. Currently, the…
Ransomware
Added Thu 16 Apr
Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations
Iranian threat actor Agrius continues to operate against Israeli targets, masking destructive influence operations as ransomware attacks. In recent attacks the group deployed Moneybird, a previously unseen ransomware written in C++. Despite presenting…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.