ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity ransomware news, analysis, and intelligence.
Ramanan Pathmanathan received a 33-year federal sentence for sextorting 145 minors via fake social media accounts from 2014–2021. The Canadian predator posed as a teenage boy to coerce victims into producing sexual content, representing one of North America's largest documented child exploitation op
The Silent Ransom Group targets law firms using social engineering, phishing, and physical office infiltration to steal confidential client data, then extorts victims by threatening to release sensitive materials. The FBI warned of this escalating hybrid attack strategy on May 27, 2026.
FBI alerts law firms to Silent Ransom Group's dual-vector attacks: initial social engineering for remote access, escalating to on-site USB data theft if remote access fails, then extortion.
Silent Ransom Group escalates attacks with physical operatives inserting USB devices when phishing fails. The extortion gang steals data and threatens to publish it for payment.
Authorities from 16 countries shut down First VPN—used by 25 ransomware groups—seizing 33 servers in May 2026. It's the first successful takedown of a VPN service designed for cybercriminals.
International law enforcement dismantled First VPN, a decade-old service used by 25+ ransomware groups. The operation took down 33 servers, arrested the admin in Ukraine, and identified 506 users for investigation.
Interpol and Europol shut down **First VPN**, a service deliberately designed to support ransomware gangs' command-and-control, reconnaissance, and data theft operations. Cybersecurity experts caution that threat actors will quickly migrate to alternative anonymity platforms, making this a temporary
Microsoft dismantled Fox Tempest, a malware-signing service that sold code certificates to ransomware groups. The operation enabled criminals to distribute malware while bypassing security controls.
The FBI warns educational institutions after ShinyHunters successfully extorted Canvas LMS ransom from Instructure. Paying ransom encourages future attacks, the agency cautions.
Discord has completed end-to-end encryption for all voice and video calls protecting 200 million users. All DMs, voice channels, and Go Live streams now default to encryption, except Stage channels.
Microsoft shut down Fox Tempest, a malware-signing service that enabled ransomware gangs to distribute disguised malware as legitimate software. The operation involved over 1,000 compromised code-signing certificates and generated millions in criminal revenue before the takedown.
American Lending Center disclosed a July 2025 ransomware attack exposing 123,000+ customers' SSNs and personal data. Attackers exfiltrated sensitive files before encrypting systems in a multi-stage breach completed by April 2026.
Organized crime uses ransomware tactics to steal cargo from logistics networks. North America reported $725M in cargo losses in 2025; cyber-enabled theft now dominates the industry.
Foxconn was hit by Nitrogen ransomware, stealing sensitive operational data from North American facilities. The attack reveals manufacturing's critical vulnerability: extreme downtime intolerance makes the sector a prime extortion target for criminal gangs, with 600+ incidents hitting manufacturers
Ransomware gangs now combine digital extortion with physical intimidation, hiring local operatives to threaten victims. Groups like LockBit and BlackCat escalate to violence when payment is refused, marking a dangerous shift in cybercrime tactics.
Foxconn confirmed a North American cyberattack. Nitrogen ransomware claims 8TB of data from Apple, Intel, Google, Nvidia, and AMD containing product designs and engineering specifications.
House Committee demands Instructure testimony after ShinyHunters' dual Canvas attacks exposed 280M records from 8,809 schools. The breach stole names, emails, and student IDs but not passwords.
iOS 26.5 brings default RCS encryption. iPhone and Android users now get military-grade encrypted messaging by default—the first time secure communication is standard across both platforms.
Today's sophisticated attacks combine AI-powered phishing, account compromise, and ransomware to overwhelm traditional defenses. Prevention-only security strategies are insufficient; organizations must embed recovery capabilities into their core security architecture to survive breaches.
ShinyHunters defaced Canvas login pages with ransom demands on May 7, disrupting 9,000+ schools during peak exam season. The attack followed Instructure's acknowledgment of a 275M-person data breach, with the cybercrime group pressuring individual institutions to negotiate separately for data protec
MuddyWater, an Iranian APT, disguised credential theft as a Chaos ransomware attack to evade detection. The false flag misdirected incident response, allowing extended dwell time for data exfiltration.
MuddyWater (Iranian state hackers) use Microsoft Teams social engineering to steal credentials, then deploy ransomware configured to appear from a different threat actor—obscuring true attribution.
Iranian APT MuddyWater deploys Chaos ransomware as a decoy to obscure espionage operations, distracting incident responders while establishing persistent backdoor access via Microsoft Teams social engineering—prioritizing intelligence gathering over financial extortion.
Modern ransomware groups now target backup infrastructure first, disabling recovery options before encrypting production data. This tactical shift has rendered traditional disaster recovery plans obsolete for many organizations.
A Latvian operative received 8.5 years for negotiating ransoms in Karakurt, a Russian-linked extortion group targeting hundreds of firms. The conviction marks a major law enforcement victory.
Attackers merge vishing and SSO exploitation for rapid SaaS extortion. They trick employees for credentials, use SSO for lateral access, steal data, and demand ransom within hours.
Two US security experts were sentenced to 4 years for assisting ransomware gangs. The case exposes a growing insider threat as credentialed professionals leverage expertise for extortion campaigns.
Federal prosecutors sentenced two cybersecurity professionals to four years in prison each for facilitating BlackCat ransomware attacks between April–December 2023, marking escalated DoJ enforcement against ransomware-as-a-service operations. The convictions target not just architects but facilitato
Two cybersecurity professionals were sentenced to 4 years for aiding BlackCat ransomware attacks. They exploited insider access and expertise from their incident response firm jobs for financial gain, highlighting a critical industry vulnerability.
Sandhills Medical disclosed a ransomware breach affecting 170,000 individuals, but delayed public notice by nearly a year. The extended timeline raises serious questions about breach notification protocols and HIPAA compliance in healthcare.