Research reports
1,224 reports from 387 publishers45 added in the past week
143 reports, newest added first
Added Wed 15 Apr
BlackCat said they breached US Department of Defense contractor and went offline
The ransomware gang first said they would leak NJVCs data every 12 hours but later dropped the victim from its list. Ransomware gang BlackCat, also known as ALPHV, added NJVC, an IT company supporting the federal government and the US Department of Defense,…
Ransomware
Cl0p hacker operating from Russia-Ukraine war front line – exclusive
As the Cl0p ransomware gang continues to sow anxiety worldwide, affecting prominent companies like the BBC and Deutsche Bank, at least one of the gang’s masterminds, Cybernews discovered, is still residing in Ukraine. Deutsche Bank, one of the world’s largest…
RansomwareVulnerabilities
Million-dollar deposits and friends in high places: how we applied for a job with a ransomware gang
During an undercover interview, a CyberNews researcher tricked ransomware operators affiliated with Ragnar Locker into revealing their ransom payout structure, cash out schemes, and target acquisition strategies. From a relatively rare threat just a few years…
Ransomware
Added Sun 12 Apr
Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months
Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…
RansomwareMalwareTakedowns and arrests
Added Sat 11 Apr
Henry Schein re-encrypted by BlackCat again
On Saturday, October 14, Henry Schein, Inc. (Nasdaq: HSIC) determined that a portion of its manufacturing and distribution businesses experienced a cybersecurity incident. Henry Schein promptly took precautionary action, including taking certain systems…
Ransomware
"Almost everything you have posted in your news article about this incident is a total crap" -- BlackCat to Bangladeshi news outlets
On June 23, using the greeting that Hive ransomware always used in emailing victims, AlphV wrote to the Bangladesh Krishi Bank (BKB). Typos, grammar, and spelling as in the original: Hello,Ladies and Gentlemen! This is ALPHV Ransomware Team. We are here to…
Ransomware
REvil ransomware threat actors reveal their gaming company victim
In a recent interview with Yelisey Boguslavskiy, “UNKN” of the threat actors known as REvil (Sodinokibi) indicated that they were planning a major attack on a gaming network. Today, the threat actors added GPI (Gaming Partners International) to their…
Ransomware
Breaking: LockBit 3.0 gives Sick Kids free decryptor, claims to ban partner who attacked them
#LockBit has formally apologized for the attack on the Hospital for Sick Kids in Canada that took place on December 18. The hospital is still trying to recover from it. “We formally apologize for the attack on sikkids.ca and give back the decryptor for free,…
Ransomware
East Tennessee Children's Hospital updates information on ransomware incident
On March 15, this site noted that the East Tennessee Children’s Hospital had posted a notice about an IT security incident. At the time, they did not identify the incident as a ransomware incident. DataBreaches.net subsequently found some explanation for that…
Ransomware
Added Fri 10 Apr
HelloKitty: When Cyberpunk met cy-purr-crime
On February 9, after discovering a compromise, CD Projekt Red (CDPR) announced to its 1+ million followers on Twitter that it was the victim of a ransomware attack against its systems (and made it clear they would not yield to the demands of the threat…
Ransomware
Initial Takeaways from the Black Basta Chat Leaks
The Black Basta ransomware group's internal chat logs, leaked on February 11, 2025, consist of nearly 200,000 Russian-language messages spanning September 18, 2023, to September 28, 2024. These logs, exposed by an individual known as "ExploitWhispers",…
Ransomware
Petya: the two-in-one trojan
Infecting the Master Boot Record (MBR) and encrypting files is nothing new in the world of malicious programs. Back in 1994, the virus OneHalf emerged that infected MBRs and encrypted the disk contents. However, that virus did not extort money. In 2011, MBR…
RansomwareMalware
Babuk Ransomware v3
This is a short report for the latest Babuk ransomware sample. This sample is marked as version 3 based on the run-once mutex string. For this new version, the malware author keeps most of the old functionalities the same except for the encryption scheme and…
Ransomware
Analysis of the Ransomware Nitrogen
The aim of this analysis is to dissect the Nitrogen ransomware distributed by Nitrogen Ransomware Group to better understand how it works. This ransomware has much in common with the LukaLocker ransomware distributed by the Volcano Demon group. Source:…
Ransomware
Added Thu 9 Apr
ShinyHunters sent Google an extortion demand; Shiny comments on current activities
Even the NSA can’t stop or identify us anymore. The FBI and everyone else is irrelevant and incompetent as far as we’re concerned :). When DataBreaches asked ShinyHunters if anything in particular had inspired that statement, “Shiny1” responded: I heard the…
Ransomware
Ryuk Ransomware: A Targeted Campaign Break-Down
Over the past two weeks, Ryuk, a targeted and well-planned Ransomware, has attacked various organizations worldwide. So far the campaign has targeted several enterprises, while encrypting hundreds of PC, storage and data centers in each infected company.…
Ransomware
If at first you don't succeed, screw it up again?
Unfortunately for AlphV, they did not seem to know that the law wasn’t in effect yet. Today, BlackCat tried again. Their leak site now lists Viking Therapeutics as a victim. Instead of providing any proof of claims, however, they posted that they got…
Ransomware
Still think you can negotiate with REvil and get your files back? Read this first.
The government and professionals involved in ransomware incident response have often advised victims not to pay the ransom because even if you pay, you may not get your data back, and you may not get your data deleted by criminals who pinky swear that they…
Ransomware
"BlackCat" attempts to up the pressure on Suffolk County; starts to leak data?
Since September 8, Suffolk County has been trying to recover from a cyberattack by a ransomware group known as “ALPHV” or “BlackCat.” The attack disabled the county’s 911 system as well as other services. The county reverted to older methods for handling…
Ransomware
AlphV responds to MGM incident and sloppy reporting
AlphV has posted a statement about their attack on MGM Resorts. They also post some scathing criticisms of journalists and news outlets for reporting inaccurately and not verifying sources. Of note, their statement also asserts, “The ALPHV ransomware group…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.