A new ransomware-as-a-service operation called Chaos has emerged in February 2025, likely formed by former BlackSuit members after law enforcement seized BlackSuit's infrastructure during Operation Checkmate. Chaos uses sophisticated multi-stage attacks involving spam campaigns, voice-base...
A new ransomware strain called Anubis has emerged with a devastating "wipe mode" capability that permanently destroys file contents while encrypting data, making recovery impossible even after ransom payment. Active since December 2024, this ransomware-as-a-service operation spreads throug...
Anubis ransomware-as-a-service has introduced a destructive file-wiping feature that permanently destroys victim data, making recovery impossible even after ransom payment. First detected in December 2024, this emerging threat uses sophisticated ECIES encryption and activates its wiper fun...
RansomHub's infrastructure went offline on April 1, 2025, causing affiliates to migrate to competitor Qilin. The disruption has triggered significant shifts in the ransomware landscape, with DragonForce claiming RansomHub is joining their new "Ransomware Cartel" business model. This model ...
VanHelsing is a new multi-platform ransomware-as-a-service targeting Windows, Linux, BSD, ARM, and ESXi systems. Launched in March 2024, it offers an 80/20 profit split favoring affiliates, with a $5,000 deposit required for inexperienced actors. The C++ ransomware employs ChaCha20 encrypt...
