A Chinese cyber group traditionally known for espionage has expanded into ransomware operations, as revealed in a November 2024 attack using RA World ransomware. The group, linked to Mustang Panda, targeted multiple organizations throughout 2024-2025 using PlugX malware and DLL side-loadin...
International law enforcement agencies arrested two Russian nationals in Thailand connected to the Phobos ransomware operation, which targeted over 1,000 victims and collected $16M in Bitcoin. The operation, dubbed "Phobos Aetor," also dismantled the 8Base ransomware infrastructure and inv...
Security researchers have identified active exploitation of critical vulnerabilities in SimpleHelp RMM software, potentially enabling ransomware attacks. The flaws allow information disclosure, privilege escalation, and remote code execution. Attackers are using these vulnerabilities to cr...
Google's cloud division reveals TRIPLESTRENGTH, a sophisticated cyber threat actor targeting major cloud platforms through stolen credentials. The group conducts cryptocurrency mining operations, deploys ransomware attacks, and sells unauthorized cloud access via Telegram. Their activities...
Ransomware attackers are employing a new hybrid strategy combining email bombing and fake Microsoft Teams support calls to infiltrate corporate networks. Two major campaigns, STAC5143 and STAC5777, linked to FIN7 and Black Basta respectively, utilize sophisticated techniques including DLL ...
