Research reports
1,224 reports from 387 publishers45 added in the past week
143 reports, newest added first
Added Sun 25 Oct
Etude de cas : Comment Hunters International et ses affiliés ciblent
Hunters International est un groupe de Ransomware-as-a-Service (RaaS) apparu en octobre 2023, après avoir acquis le code source et l'infrastructure du groupe Hive, aujourd'hui démantelé. À ce jour, selon les statistiques publiées, Hunters International et ses…
Ransomware
Inside Trickbot, Russia’s Notorious Ransomware Gang
Internal messages WIRED has viewed shed new light on the operators of one of the world's biggest botnets. Photograph: katleho Seisa/Getty Images When the phones and computer networks went down at Ridgeview Medical Center’s three hospitals on October 24, 2020,…
Ransomware
Added Mon 19 Oct
Added Sun 18 Oct
Ragnar Loader
(a.k.a. Ragnar Locker) ransomware group, which has been inflicting targeted cyberattacks on organizations since its emergence in 2020. The Ragnar Loader, frequently identified within the threat landscape as the Ragnar Framework by its associated actors,…
RansomwareMalware
Netwalker malware: What it is, how it works and how to prevent it
Netwalker is a data encryption malware that represents an evolution of the well-known Kokoklock ransomware and has been active since September 2019. This article will detail the specific technical features of the Netwalker ransomware. We will analyze what…
RansomwareMalware
Operation Lotus Blossom (Reports)
Secure with AI cybersecurity, fraud and ransomware prevention, compliance, and customer data protection Manufacturing Secure with OT security, ransomware defense, industrial cybersecurity, supply chain resilience, and continuity Retail and Hospitality Secure…
Ransomware
Resecurity | Cybercriminals Are Targeting EdTech: Data Breaches and Ransomware Attacks on the Rise
Tuesday, June 16, 2026, 10:11 UTC — The education technology (EdTech) sector has become a prime target for cybercriminals as attacks against educational institutions and related platforms continue to escalate. With sensitive data, including student records,…
Ransomware
Rewterz Threat Alert – Leaked Conti Ransomware Used to Target Russia - Active IOCs
Conti ransomware was discovered in December 2019 and is delivered via TrickBot. It’s been utilized against large companies and government institutions across the world, especially in North America. Conti steals important files and information from targeted…
Ransomware
Added Fri 16 Oct
Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety
UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…
RansomwareState-sponsoredPhishing
Added Wed 14 Oct
Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed
In August 2025, we investigated a new ransomware campaign orchestrated by The Gentlemen, an emerging and previously undocumented threat group. This threat actor quickly established itself within the threat landscape by demonstrating advanced capabilities…
Ransomware
The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
Ransomware that combines robust encryption with rapid lateral movement significantly increases the risk and impact of an attack. The Gentlemen ransomware is a ransomware-as-a-service (RaaS) threat that is distinguished by its ability to pair its strong…
Ransomware
Added Fri 9 Oct
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Acknowledgments: Special thanks to Dray Agha for his extensive contributions to this investigation. Background In September, the Huntress agent was deployed on an organization that had been targeted in an Akira ransomware attack. As we've written about…
Ransomware
Added Tue 6 Oct
JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models
Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered. learn more Ransomware operators make a bet that their victims don’t keep backups. In a…
RansomwareAI
Resecurity | Blacklock Ransomware: A Late Holiday Gift with Intrusion into the Threat Actor's Infrastructure
Dubbed “BlackLock” (aka "El Dorado" or "Eldorado"), the ransomware-as-a-service (RaaS) outfit has existed since March 2024. In Q4 of last year, it increased its number of data leak posts by a staggering 1,425% quarter-on-quarter. According to independent…
Ransomware
JADEPUFFER: Agentic ransomware for automated database extortion
Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered. learn more Ransomware has had a human at the keyboard, or at least a human writing its…
Ransomware
Warlock Ransomware Attackers Hit Water and Telecom Operators
Warlock first came to prominence via the exploitation of a Microsoft SharePoint “ToolShell” exploit chain. Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603). Symantec has previously tied this group to older activity…
RansomwareVulnerabilities
Zawoo Ransomware
Researchers at CERTAINITY recently reported on Zawoo Team, a ransomware operation. The actor has been active since at least early August 2026 and brought its leak site online on 30 August, listing 19 victims at once, concentrated among small and micro…
Ransomware
Threat Spotlight: Inside the World’s Fastest Rising Ransomware Operator — BlackLock
First observed in March 2024, “BlackLock” (aka El Dorado or Eldorado) has rapidly emerged as a major player in the ransomware-as-a-service (RaaS) ecosystem. By Q4 2024, it ranked as the 7th most prolific ransomware group on data-leak sites, fueled by a…
Ransomware
From Payment Plan to Ransomware - Inside a Global Group Attack
Highly sophisticated ransomware now targets industries worldwide. Today’s ransomware allows threat actors to infiltrate networks, encrypt confidential data, and hold critical systems hostage until a cryptocurrency ransom is paid. Worse, threat actors often…
Ransomware
Added Fri 25 Sep
NSA Joins FBI and Others in Releasing Guidance to Defend Against Gunra Ransomware
FORT MEADE, Md. — Today, the National Security Agency (NSA) joins the Federal Bureau of Investigation (FBI) and others in releasing a joint Cybersecurity Advisory, “#StopRansomware: Gunra Ransomware,” as an ongoing effort to publish information about…
RansomwareTakedowns and arrests
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.