Research reports
1,224 reports from 387 publishers45 added in the past week
143 reports, newest added first
Added Sun 5 Apr
Nine Entertainment warns ransomware recovery 'will take time'
Nine Entertainment warned Monday night that it would be some time before it could fully restore core systems and connectivity following a ransomware infection over the weekend. Chief information and technology officer Damian Cronan said in a letter to staff…
Ransomware
Added Thu 2 Apr
Powerhost’s ESXi Servers Encrypted with New SEXi Ransomware
IxMetro Powerhost, a Chilean data center and hosting provider, has become the latest target of a cyberattack by a newly identified ransomware group dubbed SEXi. This malicious group successfully encrypted the company’s VMware ESXi servers, which host virtual…
Ransomware
Added Thu 26 Feb
CERTFR-2019-CTI-009.pdf
Ces dernières semaines, l’ANSSI a observé plusieurs attaques impliquant le déploiement du rançongiciel Clop sur des systèmes d’information en France. Ce code malveillant chiffre les documents présents sur les SI et leur ajoute, suivant les versions,…
Ransomware
Added Tue 20 Jan
Yalishanda.pdf
The interesting thing about cybercrime is that, sooner or later, the names behind those who commit it are going to come out. Often, unraveling starts from the inside, with actors turning on each other, or someone close enough to do real harm. In February…
Ransomware
Added Tue 16 Dec 2025
RALord-Novo-grupo-de-Ransomware-as-a-Service-1.pdf
WhatsApp! Heimdall Security Research Acesse boletins diários sobre agentes de ameaças, malwares, indicadores de comprometimentos, TTPs e outras informações no site da ISH. Boletins de Segurança – Heimdall P á g i n a 3 | 35 SUMÁRIO 1 Sumário executivo…
Ransomware
Added Wed 29 Oct 2025
202406181500_Qilin Threat Profile_TLPCLEAR
Qilin is a ransomware-as-a-service (RaaS) offering in operation since 2022, and which continues to target healthcare organizations and other industries worldwide. The group likely originates from Russia, and was recently observed recruiting affiliates in late…
Ransomware
A Deep Dive into Medusa Ransomware
Medusa ransomware appeared in June 2021, and it became more active this year by launching the “Medusa Blog” containing data leaked from victims that didn’t pay the ransom. The malware stops a list of services and processes decrypted at runtime and deletes the…
RansomwareMalware
Added Thu 2 Oct 2025
BQTLock Ransomware
BQTLock is an advanced ransomware-as-a-service (RaaS) that has emerged in recent months and is entering the scene in a disruptive way. Its operations, attack methods, and malware features stand out from other ransomware groups. Originating from the East and…
Ransomware
Added Sat 30 Aug 2025
b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf
Vibe hacking: how cybercriminals are using AI coding agents to scale data 4 extortion operations Remote worker fraud: how North Korean IT workers are scaling fraudulent 11 employment with AI No-code malware: selling AI-generated ransomware-as-a-service 15…
RansomwareMalware
Added Sat 24 May 2025
Sarcoma-Ransomware.pdf
Sarcoma Ransomware has been one of the most active ransomware gangs in recent months. First detected in October 2024, it quickly evolved from an emerging threat into a major concern for the cybersecurity community. In a short time, it has attracted…
RansomwareVulnerabilities
Added Wed 23 Apr 2025
aa23-075a-stop-ransomware-lockbit.pdf
#StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing & Analysis…
Ransomware
#StopRansomware: RansomHub Ransomware
To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office or CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the…
Ransomware
#StopRansomware: Akira Ransomware
To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office or CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the…
Ransomware
rpt-fin-10-anatomy-of-a-cyber-en.pdf
Lessons learned from investigating FIN10 and other disruptive breaches 12 Conclusion 14 Appendix - Sample Extortion Email 15
Ransomware
scattered-spider-conducts-sim-swapping-attacks-12.pdf
The Scattered Spider threat group (AKA Roasted 0ktapus, UNC3944) has been financially motivated group primarily targets telecommunication service providers. the victims are usually large (Fortune 2000) organizations that have valuable intellectual property…
RansomwarePhishing
Added Sat 12 Apr 2025
TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base
The operators behind TAG-124 show high levels of activity, frequently updating compromised WordPress sites, setting up new servers, and refining TDS-related conditional logic and infection techniques. Numerous threat actors have relied on or continue to use…
Ransomware
Added Fri 11 Apr 2025
Anastasia-Inside-BlackBasta.pdf
April 2022. a group of cybercriminals calling themselves BlackBasta came together, determined to continue their illicit operations. At its core were former members of Conti, a ransomware group infamous for its high-profile attacks, including the Government of…
Ransomware
A_Deep_Dive_into_the_Leaked_Black_Basta_Chat_Logs.pdf
• In February 2025, a leak of internal chat logs exposed Black Basta’s operations, uncovering part of their infrastructure and revealing insights into their tools, culture, tactics, and decision-making. • Black Basta operates as a highly disciplined business…
Ransomware
Added Fri 7 Mar 2025
threat_horizons_report_h1_2025.pdf
Database Security: Critical Cloud Protection 14 Threat Actor Spotlight: UNC2165 Ransomware 16 and Data Theft Extortion Disrupting Financially Motivated Threat Actors 21 Conducting Cloud Hijacking Campaigns Growing Threat from Data Leak Sites Enabling 24…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.