2,252 Victims, One Common Requirement ReliaQuest’s Q2 2026 ransomware report documents 2,252 victim organizations across 90 ransomware groups and 99 countries. The Gentlemen claimed the top spot with 300 victims, powered by an affiliate kit that includes custom EDR killers, Group Policy Object-based deployment, and SMB encryption tools. Deadlock emerged from 11 months of silence […]
This article from Quercus IT does a solid job explaining the four-stage anatomy of a modern ransomware attack: initial footprint, reconnaissance and lateral movement, backup targeting, and finally exfiltration and encryption. It’s accurate. The problem is that most organizations focus their defenses on the later stages — trying to detect the reconnaissance, trying to protect […]
A newly documented ransomware family called Spirals moved from initial access to network-wide encryption in less than 24 hours, hitting an IT services company in South Asia. The attack started with a compromised internet-facing Microsoft IIS server and ended with encrypted files across more than a dozen systems. The speed is alarming. But every phase […]
What HYFLOCK Does HYFLOCK is a ransomware variant discovered on VirusTotal that encrypts files on Windows systems and appends the “.locked” extension. A file named “report.docx” becomes “report.docx.locked”. After encryption completes, it drops an HTML ransom note instructing victims to install qTox and Tor Browser to contact the attackers within 48 hours. The ransom note […]
The Shift From Vulnerabilities to Identities Sophos’s 2026 State of Ransomware report documents a significant shift in attacker methodology: 79% of ransomware attacks now originate from compromised identities rather than exploited vulnerabilities. Malicious email (26%) and phishing (24%) have overtaken vulnerability exploitation as the primary initial access vectors. This represents a tactical evolution. Attackers have […]
LockBit is both a ransomware family and a criminal ecosystem. Core developers maintain the malware platform. Affiliates — largely independent operators — obtain access to victim environments, steal data, and deploy the ransomware. This separation matters for defense: LockBit attacks vary widely in tactics, tools, and timing because different affiliates are running them. A recent […]
Centers Laboratory just notified 540,000 patients that their health information was stolen. The WorldLeaks extortion group claims responsibility and says they exfiltrated 720 GB of diagnostic data. That’s not a smash-and-grab. That’s an attacker who had time to work. The Problem: Bulk Data Staging Requires Reading Files The article points out that the 720 GB […]
Marlboro-Chesterfield Pathology, a North Carolina-based molecular and cytology lab, agreed to settle a class action lawsuit stemming from a 2025 ransomware attack. The attack compromised patient data, disrupted lab operations, and triggered the legal liability that healthcare organizations dread most: a breach of protected health information under HIPAA. Pathology labs are high-value targets. They handle […]
What Happened TuakTOX is a ransomware variant that encrypts files using AES 256-bit encryption and demands $32 in Bitcoin within a 32-minute deadline. Security researchers found it on VirusTotal, and it’s being distributed through the usual vectors: phishing emails with malicious attachments, fake software updates, malicious advertisements, trojans, and pirated software. The ransomware doesn’t append […]
Microsoft’s threat intelligence team published a detailed analysis of GigaWiper on July 9, 2026 — a modular Windows backdoor that combines full surveillance capabilities with three independent disk destruction mechanisms. The malware, attributed by Google’s Threat Intelligence Group to an Iran-nexus operator, was first identified in October 2025 during investigations of wiped enterprise environments. What […]