A newly documented ransomware family called Spirals moved from initial access to network-wide encryption in less than 24 hours, hitting an IT services company in South Asia. The attack started with a compromised internet-facing Microsoft IIS server and ended with encrypted files across more than a dozen systems. The speed is alarming. But every phase […]
What HYFLOCK Does HYFLOCK is a ransomware variant discovered on VirusTotal that encrypts files on Windows systems and appends the “.locked” extension. A file named “report.docx” becomes “report.docx.locked”. After encryption completes, it drops an HTML ransom note instructing victims to install qTox and Tor Browser to contact the attackers within 48 hours. The ransom note […]
The Shift From Vulnerabilities to Identities Sophos’s 2026 State of Ransomware report documents a significant shift in attacker methodology: 79% of ransomware attacks now originate from compromised identities rather than exploited vulnerabilities. Malicious email (26%) and phishing (24%) have overtaken vulnerability exploitation as the primary initial access vectors. This represents a tactical evolution. Attackers have […]
LockBit is both a ransomware family and a criminal ecosystem. Core developers maintain the malware platform. Affiliates — largely independent operators — obtain access to victim environments, steal data, and deploy the ransomware. This separation matters for defense: LockBit attacks vary widely in tactics, tools, and timing because different affiliates are running them. A recent […]
Centers Laboratory just notified 540,000 patients that their health information was stolen. The WorldLeaks extortion group claims responsibility and says they exfiltrated 720 GB of diagnostic data. That’s not a smash-and-grab. That’s an attacker who had time to work. The Problem: Bulk Data Staging Requires Reading Files The article points out that the 720 GB […]
Marlboro-Chesterfield Pathology, a North Carolina-based molecular and cytology lab, agreed to settle a class action lawsuit stemming from a 2025 ransomware attack. The attack compromised patient data, disrupted lab operations, and triggered the legal liability that healthcare organizations dread most: a breach of protected health information under HIPAA. Pathology labs are high-value targets. They handle […]
What Happened TuakTOX is a ransomware variant that encrypts files using AES 256-bit encryption and demands $32 in Bitcoin within a 32-minute deadline. Security researchers found it on VirusTotal, and it’s being distributed through the usual vectors: phishing emails with malicious attachments, fake software updates, malicious advertisements, trojans, and pirated software. The ransomware doesn’t append […]
Microsoft’s threat intelligence team published a detailed analysis of GigaWiper on July 9, 2026 — a modular Windows backdoor that combines full surveillance capabilities with three independent disk destruction mechanisms. The malware, attributed by Google’s Threat Intelligence Group to an Iran-nexus operator, was first identified in October 2025 during investigations of wiped enterprise environments. What […]
The Attack: SUCKS 2 SUCK Ransomware Security researchers discovered SUCKS 2 SUCK ransomware on VirusTotal in early July 2026. Once it infects a Windows system, it encrypts files using AES-256, appends the .encrypted extension to filenames, and displays a full-screen lock message demanding $500 in Bitcoin. Victims get 10 attempts to enter the correct unlock […]
The Largest Healthcare Breach in History In February 2024, ransomware operators compromised Change Healthcare and exposed the protected health information of approximately 192.7 million people — roughly two-thirds of all healthcare data exposures that year. It remains the largest health data breach in history, surpassing the 2015 Anthem breach that held the record for nine […]