What Happened at MCBS MCBS, LLC, a Georgia-based healthcare management and revenue cycle management company, just disclosed a cybersecurity incident affecting 1.26 million individuals. While the full details are still emerging, this is the nightmare scenario for any organization handling protected health information: over a million patient records potentially compromised, HIPAA breach notification requirements triggered, […]
Cisco Talos recently disclosed msaRAT, a remote access trojan attributed to the Chaos ransomware group. The malware is notable for its evasion technique: it uses headless Chrome or Edge browser processes to communicate with command-and-control servers via the Chrome DevTools Protocol, disguising its traffic as legitimate browser activity. Traditional network monitoring tools and antivirus software […]
AnMed Health, a nonprofit health system serving upstate South Carolina and Northeast Georgia, was forced to close nearly 80 facilities following a cyberattack. While the organization hasn’t disclosed specifics, the scale of disruption — shutting down dozens of care locations — points to ransomware that encrypted critical systems across the network. This is what happens […]
The Attack: Sophisticated Evasion Assumes the Payload Already Landed Proofpoint recently documented Cruciferra, a crypter-as-a-service used by multiple cybercrime groups to deliver RATs and info-stealers to financial services, healthcare, government, and education targets. The campaigns use phishing emails with malicious attachments or links to ZIP files hosting the payload. What makes Cruciferra interesting is the […]
The Attack: Malware Assembly Inside the Browser The SourTrade malvertising campaign, documented by Confiant in July 2026, represents a new level of effort in evading signature-based detection. Instead of serving a complete malicious executable from a fixed URL, the attack has the victim’s browser build the payload itself. The landing page registers a ServiceWorker and […]
The Problem: Ransomware No Longer Breaks In. It Logs In. Sophos’ seventh annual State of Ransomware report, released in July 2026, documents a fundamental shift in how ransomware attacks begin. For the first time in years, exploited software vulnerabilities are no longer the leading cause. Instead, 79% of ransomware attacks now start with a compromised […]
2,252 Victims, One Common Requirement ReliaQuest’s Q2 2026 ransomware report documents 2,252 victim organizations across 90 ransomware groups and 99 countries. The Gentlemen claimed the top spot with 300 victims, powered by an affiliate kit that includes custom EDR killers, Group Policy Object-based deployment, and SMB encryption tools. Deadlock emerged from 11 months of silence […]
This article from Quercus IT does a solid job explaining the four-stage anatomy of a modern ransomware attack: initial footprint, reconnaissance and lateral movement, backup targeting, and finally exfiltration and encryption. It’s accurate. The problem is that most organizations focus their defenses on the later stages — trying to detect the reconnaissance, trying to protect […]
A newly documented ransomware family called Spirals moved from initial access to network-wide encryption in less than 24 hours, hitting an IT services company in South Asia. The attack started with a compromised internet-facing Microsoft IIS server and ended with encrypted files across more than a dozen systems. The speed is alarming. But every phase […]
What HYFLOCK Does HYFLOCK is a ransomware variant discovered on VirusTotal that encrypts files on Windows systems and appends the “.locked” extension. A file named “report.docx” becomes “report.docx.locked”. After encryption completes, it drops an HTML ransom note instructing victims to install qTox and Tor Browser to contact the attackers within 48 hours. The ransom note […]