ransomware

The Clop ransomware gang has moved to new server infrastructure after exploiting a vulnerability in Grav CMS, the open-source flat-file content management system. The extortion group, known for large-scale data-theft campaigns against corporations and government agencies, is continuing operations despite the disruption. Security teams are being urged to patch Grav CMS installations and review whether their systems were targeted.

Keio Electric Railway, a major private railway operator in Tokyo, has been hit by a ransomware attack that disrupted its payment and settlement systems. The company says train operations themselves were not affected, and services continue to run normally while it deals with the cyberattack. The incident adds to a string of ransomware attacks on Japanese organisations, drawing attention to the vulnerability of critical transport infrastructure.

The hacking group ShinyHunters has compromised Cl0p, a rival ransomware gang, and taken control of its dark web Tor data leak site, according to a report by CPO Magazine. The takeover of one major cybercrime operation by another is drawing attention from security researchers tracking shifting alliances and infighting in the ransomware underworld.

Police have arrested a 16-year-old suspected of leading the KillSec ransomware group, according to Help Net Security. The arrest of a minor at the head of a ransomware operation has drawn attention to how young hackers have become involved in organized cybercrime, and to the growing activity of the KillSec group itself.

A new ransomware group calling itself Storm has published a leak-site post claiming the extortion of Allied Machine & Engineering, a US manufacturing company. A post titled 'Step By Step' with an unknown victim was also listed. The alerts were flagged by cybersecurity threat-intelligence trackers monitoring ransom group blogs.

An international law enforcement operation has taken down the KillSec ransomware group, arresting its suspected leader, who is reportedly only 16 years old. The case has drawn attention both to the growing role of teenagers in cybercrime and to cross-border cooperation against ransomware networks that have targeted organisations worldwide.

Police have arrested three people, including a teenager suspected of running the KillSec ransomware group, in an operation dubbed KillSwitch. Servers were seized and the gang's leak site was taken over, reportedly holding at least 110 TB of stolen data. The takeover marks a major disruption of a group blamed for extensive ransomware attacks.

The Rhysida ransomware group has listed Electro Heat Sweden AB, a Swedish manufacturing company, as a new victim on its leak blog. The claim was flagged by threat intelligence watchers tracking ransomware activity. Rhysida is a known ransomware operation that publishes victim names to pressure companies into paying. No details on stolen data or the company's response have been confirmed.

The ransomware group RansomHouse has listed Hospital Hermilio Valdizán in Peru as a new victim on its leak site, adding the healthcare facility to its portfolio of claimed attacks. If confirmed, patient data and hospital systems could be at risk. The claim is circulating among cybersecurity researchers tracking ransomware activity in Latin America's health sector.

The City of Vicksburg, Mississippi, disclosed a ransomware attack that forced a temporary shutdown of its municipal computer systems on October 1, 2026. City officials confirmed that critical services, including 911 dispatch, police, and fire departments, remained operational while other services were disrupted. The incident adds to a growing string of ransomware attacks targeting US local governments, prompting calls for stronger municipal cybersecurity defenses.

Scattered Spider's 2023 attack on MGM Resorts is being retold in a quirky animated explainer, with low-poly potato characters. The story shows how a single phone call, LinkedIn research and help-desk impersonation led to a password and MFA reset, ransomware across 100+ MGM servers and the shutdown of Las Vegas operations. The campaign later hit Caesars, M&S, Salesforce clients and TfL, where two members were arrested.

An international police operation has reportedly dismantled the KillSec ransomware group, whose alleged leader is a 16-year-old. The operation targeted members of the cybercrime gang, which is associated with ransomware attacks and data extortion. Discussion is focused on the involvement of teenage hackers in major ransomware operations and what the arrests mean for the group's activity.

The Nightspire ransomware group has added Forma Therapeutics Holdings, a US healthcare company, to its leak site, indicating an alleged attack and possible data theft. A separate group, Bavacai, simultaneously claimed a Nigerian logistics firm, BAWABAH. Security researchers track these victim postings as early warnings of new extortion campaigns against companies in the healthcare and logistics sectors.

Two-thirds of schools in England now report recovering immediately from cyber incidents, suggesting improved resilience to attacks such as ransomware and phishing. Despite the progress, teachers remain divided over who bears responsibility for security and whose job security is at risk when breaches occur, with staff often left handling technical problems outside their expertise.

The mayor of Vicksburg, Mississippi, said a ransomware incident forced the city to shut down its computer systems. Officials pulled services offline to contain the attack, the latest in a string of ransomware strikes on US local governments. Cybersecurity observers are highlighting the growing pattern of municipal targets, alongside reported incidents elsewhere, including an architects' association in France.

The Booba Project ransomware group has posted the University of Illinois Chicago on its leak site, claiming a breach of the US education institution. A healthcare organisation, Soni Medical Centre, was also added to the group's list of alleged victims. The claims appeared in threat-intelligence monitoring feeds that track ransomware leak sites, and follow-on confirmation from either organisation has not yet been reported.

Flashpoint has announced a patented ransomware risk model designed to help organizations prioritize vulnerability patching. The scoring method assesses which vulnerabilities are most likely to be exploited in ransomware attacks, allowing security teams to focus remediation efforts where the threat of encryption-based extortion is highest. The announcement is drawing attention within the cybersecurity community as defenders seek better ways to manage growing vulnerability backlogs.

The ransomware group calling itself Wallstreet has published a new victim post naming Tronex A/S on its leak site, a standard tactic used to pressure companies into paying by threatening to release stolen data. The listed sector for the company is unknown, and no further details about the alleged attack or the volume of stolen data have been disclosed. Cybersecurity analysts tracking ransomware activity flagged the claim as part of ongoing monitoring of new extortion posts.

The Direwolf ransomware group has added a new victim to its leak site, claiming an attack on NorthStar, a US-based organisation in the finance sector. The listing appeared on the group's blog alongside its name, the target's location and sector. Threat intelligence watchers flagged the post shortly after it was published. Details on the volume of data stolen or a demanded ransom have not yet been made public.

Black Cat White Hat Security is asking businesses a blunt question: if ransomware struck tomorrow, would they know what to do? The firm says its Defend & Respond platform now includes a Ransomware Assessment, arguing that cybersecurity is not only about prevention but also about being prepared to respond when an attack happens.

A previously untracked ransomware operation going by the name ImNotAVillain has set up a leak-site presence, publishing brief posts titled 'Notice' and 'Warning' with no stated target sector. Cyberthreat intelligence trackers flagged the new group's blog activity. Its motives, affiliates and victim base are not yet known, and security researchers will be watching for signs of actual extortion activity.

The Deadlock ransomware group has published a new post claiming to have compromised Shaheen Law Group, a legal practice based in Richmond, Virginia, in the United States. The listing, reported alongside claims against other organisations by a group tracked as Storm, suggests the firms' data may be leaked unless a ransom is paid. The law firm has not publicly commented, and the extent of any breach remains unclear.

International law enforcement has seized the infrastructure of the KillSec extortion group and arrested three alleged members of the hacking crew. The takedown reportedly disrupts the group's ability to conduct extortion operations. The action highlights continued police pressure on ransomware and extortion networks, and details about the arrested suspects and the scale of the seized infrastructure have not yet been made public.

The ransomware group Barracuda has added Automovil Club del Ecuador ANETA to its leak site, listing the Ecuadorian motoring organisation in the services sector. The claim was flagged by a cyber threat intelligence feed that tracks new posts from ransomware gangs. No details have been released about the volume of data allegedly taken or any ransom demand.

The Storm ransomware group has added new entries to its leak site, naming The Money Store, Silvercup Studios and Century Management Services among its latest claimed victims. The listings were flagged by threat intelligence monitors who track ransomware group blogs. Ransomware crews routinely publish victim names to pressure companies into paying, and each new post typically prompts checks by security researchers and affected firms.

A ransomware group calling itself Netrunner has listed Main Place Mall as a new victim on its leak site, tagging the target in the retail sector. The claim surfaced alongside fresh postings from other extortion groups, including Booba Project, in a routinely monitored feed of ransomware activity. Security researchers track these listings as an early indicator of breaches, though the mall operator has not publicly confirmed any incident.

The Aurora ransomware group has published a new post on its leak site naming Buford-Thompson Company, LTD as its latest claimed victim. The listing appeared in threat intelligence tracking of ransomware group blogs. Security researchers monitor these posts to identify newly attacked organisations and track the activity of emerging ransomware operations like Aurora.

Threat intelligence feeds are reporting a claim by the ransomware actor known as "lamashtu" involving Dr Damiel Pugliese, dated September 2026 and tracked by the monitoring service Yazoul. The claim is explicitly flagged as unverified and the scope of any breach is undisclosed. Cybersecurity observers are circulating it while awaiting confirmation.

The ThreeAM ransomware group has added US heavy equipment dealer Newman Tractor to its leak site, listing the company as a new victim in the manufacturing sector. The claim suggests the group may have exfiltrated company data and could publish it unless a ransom is paid. Security researchers monitoring ransomware activity are flagging the listing as part of ongoing tracking of the group's attacks against US businesses.