The Problem: Recovery Doesn’t Stop Disclosure Ransom payment rates have fallen to record lows — somewhere in the twenties depending on the dataset — while published victim counts climbed to 7,551 in the twelve months to March 2026, up nearly 25% and a fourth consecutive record. Those two numbers together explain more about the current […]
The Attack: Social Engineering Through Trusted Collaboration Tools In 2026, threat actors launched a sophisticated campaign that exploited Microsoft Teams’ external chat feature to deliver ransomware across hundreds of organizations. The attackers didn’t exploit a software vulnerability. They exploited trust. The attack chain started with mail bombing to overwhelm victim inboxes and create urgency. Then […]
What Happened Security firm Forever Security caught an attack on a real customer’s machine: a malicious instruction file in the Downloads folder tried to trick an AI coding agent into installing malware. The file was AGENTS.md, a plain-text file formatted to look like ordinary engineering notes. When the coding agent opened the Downloads folder, it […]
SOCRadar’s Threat Research Unit just published a detailed breakdown of an AI-driven ransomware operation run by affiliates of INC Ransomware and The Gentlemen Ransomware groups. The attackers exploited edge devices at scale — FortiClient EMS, SimpleHelp, cPanel — to gain initial access, then moved laterally and deployed ransomware encryptors across victim networks. The operation was […]
SOCRadar recently exposed infrastructure belonging to ransomware affiliates using an AI-powered framework called “Phantom” to automate intrusions. The operation targeted 62 organizations, exploiting vulnerabilities in FortiClient EMS, SimpleHelp, cPanel, and VPN gateways. Once inside, the attackers used AI agents to orchestrate lateral movement, credential harvesting, data exfiltration, and ransomware deployment. The technical sophistication is notable […]
The FBI and CISA issued a joint advisory in October 2026 warning that SafePay ransomware has become one of the world’s most active ransomware operations, striking over 600 critical infrastructure providers since 2024. SafePay’s victim list includes Ingram Micro, the California-based technology distributor whose July 2025 breach disrupted order processing for days and exposed personal […]
The Problem: DLP Detects Loss After It Happens A recent Cloud Security Alliance survey found that among organizations experiencing data loss, only 16% said their DLP solution blocked the incident before data left the organization. That means 84% of the time, DLP told them what happened — after it was already gone. This isn’t a […]
The Attack: Compromised Updates Delivered Malware for Months UNC7017 executed a sophisticated supply chain compromise targeting AOMEI Technology’s update infrastructure between April and July 2026. The threat actor used brief configuration-tampering windows — lasting only five to ten minutes — to redirect customer update requests toward malicious servers. This ephemeral approach helped evade traditional point-in-time […]
The Attack: Trusted Domains Delivering Malware A recent phishing campaign demonstrates why domain reputation filtering isn’t enough. Attackers created malicious reports hosted on app.powerbi.com — Microsoft’s own Power BI platform — and sent links via email to corporate targets. Because the URL is a legitimate Microsoft domain, secure email gateways and Microsoft 365 Defender let […]
A new Windows malware campaign spreading through WhatsApp demonstrates why signature-based detection isn’t enough. The attack delivers a fake financial document that unpacks into a remote access trojan running with SYSTEM privileges — the highest level of access on a Windows machine. Security firm Morphisec traced the chain: a ZIP file holding Statement.exe arrives via […]