ransomware group

Japanese media report that a member of a ransomware group has been detained and handed over to German authorities in connection with a cyberattack on Asahi. Investigators cited the group's statement claiming responsibility for the attack on the Japanese brewer. The case highlights growing international cooperation in tracking ransomware operators.

Law enforcement, coordinated through Europol, has seized servers and the leak site of the KillSec ransomware group, which is suspected of being led by a teenager. The takedown disrupts one of the more active ransomware operations, and the suspect's young age is drawing attention to how ransomware crews are increasingly run by minors operating from home.

Japanese authorities have detained a Russian man identified as a core member of the international hacking group Qilin, and are proceeding with his extradition. The group has been linked to major ransomware attacks worldwide, and the arrest marks a notable step in international cooperation against cybercrime.

A core member of the hacker group Qilin has been arrested in Japan, according to a report by TV Asahi's ANN news. The ransomware group is said to have hit victims in more than 100 countries, including Asahi Group Holdings. The arrest of a central figure in one of the world's most active cybercrime groups is drawing wide attention in Japanese media.

Aon has published an analysis of a ransomware attack attributed to the Termite group, which exploited CVE-2024-50623, a vulnerability in Cleo file-transfer software. The flaw allowed attackers to gain unauthorised access to systems before deploying ransomware. Security teams are being urged to patch Cleo installations and review exposure to the vulnerability.

A ransomware group calling itself Global has added claims about Sutton Public Schools and the Town of Sutton in Massachusetts to its leak blog, listing the US education and local government sectors. Cybersecurity trackers monitoring ransom group posts flagged the new listings, though no details on stolen data or demands have been confirmed.

Cybersecurity researchers are tracking a new ransomware group calling itself Bavacai, which has published a blog post titled 'Balaqah' on its leak site. Threat intelligence monitors flagged the activity, and a tracking page with details on the group has been made available to the infosec community. Details about the group's victims and operations remain limited while analysts assess the new threat.

The Nightspire ransomware group has added new victims to its leak site, naming UK technology company Royal EGT and construction firm Lumabuilt. Cybersecurity threat intelligence watchers flagged the listings, which typically follow extortion attempts in which attackers threaten to publish stolen data unless a ransom is paid.

The ransomware group RunSomeWares has listed Morton LTC Pharmacy, a US healthcare provider, as a new victim on its leak site. The claim, flagged by cyber threat intelligence monitors, adds the pharmacy to a growing list of healthcare organisations targeted by ransomware crews. Healthcare attacks are closely watched because of the risk to patient data and care services.

The Deadlock ransomware group has listed Rino Greggio Argenterie, a silverware manufacturer based in Sarmeola di Rubano, in the province of Padua, on its leak site. The group claims to have exfiltrated about 500 GB of data and has set an October 14 publication deadline. No data has been published yet, and the company has not publicly commented.

A new ransomware group calling itself SilentRansomGroup has been profiled in a fresh threat intelligence write-up. The post lists the group's name and activity but leaves its targeted sector unknown, and details remain limited. Cybersecurity researchers are circulating the alert among threat intelligence and infosec communities as they track the group's emergence.

The DragonForce ransomware group has added French construction company RÉSO to its leak site, listing the firm as a new victim. The claim was flagged by cyber threat intelligence monitors tracking ransom group posts. DragonForce has been active in recent ransomware campaigns, and listings of new victims across sectors such as construction and finance continue to draw attention from security researchers.

The Vexy Ransomware group has published a new blog post titled 'KOOKABARRA JUICE' on its extortion site, typically a sign the gang is claiming a fresh victim or releasing stolen data. Threat intelligence monitors flagged the update to the cybersecurity community, where researchers track such posts to identify targeted organisations and assess the group's activity.

Japan has extradited to Germany a Russian national suspected of a leading role in the Qilin hacking group. North Rhine-Westphalia interior minister Herbert Reul said the 28-year-old, identified as Vladimir K., was transferred after German investigators secretly surveilled him for several months. The case highlights growing international cooperation against ransomware gangs.

Threat intelligence monitoring reports that the Qilin ransomware group has claimed Delta Marine as a victim, though no details of the alleged attack or stolen data have been disclosed and the claim remains unverified. Delta Marine has not publicly confirmed any incident. Security researchers are watching to see whether the claim is substantiated.

The Shiba ransomware group has listed Morgan White Group, a US company in the finance sector, as a new victim on its leak site. The claim is being tracked by cyber threat intelligence observers monitoring ransomware activity. If confirmed, the incident would add to the ongoing wave of extortion attacks targeting financial services firms.

The UmBra ransomware group has added new victims to its leak site, naming Tharisa, a company based in Cyprus, and Raqib, a technology firm in Saudi Arabia. The claims appeared in a threat-intelligence alert shared among cybersecurity watchers tracking ransom group blogs. The companies' involvement has not been independently confirmed, and the sectors affected remain partly unclear.

A newly active ransomware group calling itself UmBra has added two victims to its leak site: Four Hands LLC, a US legal services firm, and Beni Suef Technological University in Egypt. Security researchers are tracking the listings, which suggest the group is broadening its operations across both the legal and education sectors.

The Qilin ransomware group has published a new post on its leak site claiming an attack on BNYH, adding the organisation to its list of alleged victims. The claim was flagged by cyber threat intelligence monitors who track ransom group blogs. No details have been confirmed about the scale of the alleged breach, any stolen data, or a response from the organisation named.

Police have arrested a 16-year-old suspected of leading the KillSec ransomware group, according to Help Net Security. The arrest of a minor at the head of a ransomware operation has drawn attention to how young hackers have become involved in organized cybercrime, and to the growing activity of the KillSec group itself.

A new ransomware group calling itself Storm has published a leak-site post claiming the extortion of Allied Machine & Engineering, a US manufacturing company. A post titled 'Step By Step' with an unknown victim was also listed. The alerts were flagged by cybersecurity threat-intelligence trackers monitoring ransom group blogs.

Europol and Eurojust coordinated raids in four European countries that dismantled KillSec, a ransomware-as-a-service group that began as a hacktivist collective in 2023. Reports say the operation, dubbed KillSwitch, targeted the group's leadership, which allegedly included a teenager. The arrests highlight how young actors are running increasingly professional cybercrime operations.

An international law enforcement operation has taken down the KillSec ransomware group, arresting its suspected leader, who is reportedly only 16 years old. The case has drawn attention both to the growing role of teenagers in cybercrime and to cross-border cooperation against ransomware networks that have targeted organisations worldwide.

Cybersecurity trackers report that a ransomware group calling itself BYOD has added new victim posts to its leak site, naming Franklin Empire and Malaysia's Royal Selangor, with the latter listed in the manufacturing sector. Analysts monitoring ransom leak sites flag these listings to warn potential targets and track which sectors and regions the group is hitting.

Cybersecurity watchers are tracking two newly emerged ransomware groups announcing their first victims. One group listed Trump Mobile Wireless, the mobile phone venture backed by Donald Trump, as its target, while another new actor claimed O2 Dental Group in the United States. Researchers are monitoring ransomware tracking sites to verify the claims, noting the unusual prominence of a brand tied to the US president among the first claimed victims.

The Qilin ransomware group has added a new entry to its leak site, naming Asia Era One as its latest claimed victim. The sector of the targeted organisation was not specified in the listing. Security researchers monitoring ransomware activity flagged the post, adding Qilin to the ongoing tally of active extortion operations targeting companies across regions.

Insurer Tower has launched an investigation after being named on a ransomware group's leak site, according to Insurance Business. The claim remains unverified, and Tower has not confirmed whether any of its systems or customer data have been compromised. Companies listed on such sites are typically given deadlines to pay extortion demands before data is published.