ransomware

Law enforcement agencies, working with Europol, have seized servers and the leak site used by the KillSec ransomware group, and suspect the operation was led by a teenager. The takedown disrupts one of the newer ransomware crews active in recent attacks, and the unusually young age of the suspected leader has drawn attention as details of the operation emerge.

ARC Advisory Group has published analysis on how industrial operators can strengthen cyber resilience as threats to critical infrastructure grow in sophistication and frequency. The discussion focuses on protecting industrial control systems in an evolving threat environment, a concern that has intensified following rising ransomware and state-linked attacks targeting manufacturing, energy and utilities worldwide.

The United States Senate has passed the Health Care Cybersecurity and Resilience Act, legislation aimed at strengthening protections against cyberattacks on hospitals and health systems. The American Hospital Association highlighted the passage. The bill now moves to the House, and supporters say it addresses growing threats to patient data and medical services.

The US Senate has passed the Health Care Cybersecurity and Resilience Act, legislation aimed at strengthening cyber defenses across the health care sector. The American Hospital Association reported the passage, a signal of growing federal concern over ransomware and data breaches targeting hospitals and health systems. The bill now moves to the House for consideration.

Japanese railway operator Keio has been hit by a ransomware attack, which has caused a data breach affecting its Times Car ride-sharing service. Details on the number of customers affected or the scope of the stolen data have not been disclosed. The incident adds to a string of cyberattacks disrupting major Japanese transport and mobility companies.

A solo developer has produced a buggy PC port of Marvel's Wolverine, the unreleased Insomniac Games PlayStation 5 exclusive, reportedly using AI tools and source code obtained from the 2023 ransomware attack on Sony that exposed stolen internal files. The project is drawing attention because it uses materials from a major security breach and involves an official title that Sony never released publicly.

Cybersecurity professionals are arguing that Cybersecurity Awareness Month 2026 should not be reduced to the familiar advice of avoiding suspicious links. They say modern attacks now cover the full kill chain, including reconnaissance, credential theft, lateral movement, ransomware and data exfiltration, alongside AI-powered social engineering and software supply chain threats. The discussion is prompting calls for security education that reflects how sophisticated today's attack techniques have become.

Europol and Eurojust coordinated raids in four European countries that dismantled KillSec, a ransomware-as-a-service group that began as a hacktivist collective in 2023. Reports say the operation, dubbed KillSwitch, targeted the group's leadership, which allegedly included a teenager. The arrests highlight how young actors are running increasingly professional cybercrime operations.

Cybersecurity trackers report that a ransomware group calling itself BYOD has added new victim posts to its leak site, naming Franklin Empire and Malaysia's Royal Selangor, with the latter listed in the manufacturing sector. Analysts monitoring ransom leak sites flag these listings to warn potential targets and track which sectors and regions the group is hitting.

Cybersecurity watchers are tracking two newly emerged ransomware groups announcing their first victims. One group listed Trump Mobile Wireless, the mobile phone venture backed by Donald Trump, as its target, while another new actor claimed O2 Dental Group in the United States. Researchers are monitoring ransomware tracking sites to verify the claims, noting the unusual prominence of a brand tied to the US president among the first claimed victims.

The Qilin ransomware group has added a new entry to its leak site, naming Asia Era One as its latest claimed victim. The sector of the targeted organisation was not specified in the listing. Security researchers monitoring ransomware activity flagged the post, adding Qilin to the ongoing tally of active extortion operations targeting companies across regions.

The Sovcali ransomware group has listed Warp9 Microsolutions, an Indian technology company, as a new victim on its leak site, a common tactic used to pressure companies into paying. The claim was flagged by cyber threat intelligence monitors tracking ransomware activity. No details on the scale of the alleged breach or the company's response have been confirmed.