Topic
Malware that encrypts a victim's files or systems, used by attackers to demand ransom for decryption and often threaten to leak stolen data.
Japan's government will build and test methods to find attackers already inside power and telecom networks, with costs in fiscal 2027 budget requests. For operators, the job extends past answering alerts to searching for intruders who never set one off.
Reality
Sysdig says an LLM-driven operator it calls JADEPUFFER ran a database-extortion campaign on its own, entering through unpatched Langflow flaw CVE-2025-3248. It calls the operation the first documented ransomware run end to end by a model.
Reality
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishersReality
Microsoft says Storm-3168, also tracked as JADEPUFFER, used two stolen Azure service principals to try deleting more than 100 storage accounts. The deletions took about seven minutes, so the 17 hours of API reads before them were when anyone watching those identities had time to act.
Perspective Coverage
6 publishersReality
Warlock, the group Microsoft tracks as Storm-2603, hit four organizations in Spanish- or Portuguese-speaking countries in two months, Symantec says. It works like the Chinese state groups it first appeared beside and extorts like a ransomware crew.
Perspective Coverage
6 publishersReality
Investigators say KillSec, tied to about 1,000 suspected attacks, got in through software flaws, weak cloud storage and logins bought on the dark web. Those gaps sit in victims' own systems, beyond the reach of any server seizure.
Reality
Gunra affiliates get in through two FortiOS and FortiProxy authentication bypasses, CVE-2024-55591 and CVE-2025-24472, says a 10 August 2026 advisory. Its fix for exposed RDP routes remote access through that same class of appliance, so the gateway has to be secured before RDP moves behind it.
Reality
Symantec says Warlock operators ran an AV/EDR killer across at least 40 machines in roughly two hours after a suspected SharePoint compromise. The ransomware payloads moved between domain controllers through SYSVOL replication.
Reality
Vicksburg Mayor Willis Thompson says ransomware forced a shutdown of city systems that hit utility payments in the Mississippi city of more than 20,000. The city, still investigating, has not determined whether personal data on customers, employees or vendors was accessed.
Reality
China-linked Warlock operators hit at least four organisations through SharePoint flaws in two months, Symantec says. Its report lists six 2026 SharePoint CVEs only as possible additions, and the entry it documents is still older flaws on servers never patched or mitigated.
Reality
South Africa's ATNS, which runs air traffic control for about 10% of the world's airspace, found early-stage ransomware tooling in a weather OT network. The state operator says its team stopped the attack yet is seeking outside forensics to learn how the attackers got in.
Perspective Coverage
3 publishersReality
Zscaler ThreatLabz logged 20.1% fewer ransomware payments in the year to March 2026, worth $327.8M in total, while the average payment rose 5.3% to $431,995. Leak-site listings fell just 3% over the same period, so the decline is in how many victims pay.
Reality
Ofqual found that 9% of teachers in England see senior leadership as primarily responsible for cyber security, while 46% name the IT team. The regulator says backups and response plans belong to leaders, a duty most staff assign elsewhere.
Reality
Gunra actors entered a victim's network through an SSL VPN admin account still on default credentials, according to a 10 August 2026 advisory. The path used no software flaw, so it tests credential changes, lockout and account reviews on edge devices.
Reality
Arizona's Supreme Court says hackers copied personal data on "many Arizonans," with no ransomware deployed and no ransom demand as of Monday. For the people in those records, the risk now is direct misuse of the data, and no extortion talks are under way to show what the thieves intend.
Reality
Pen Test Partners says ship rules never test onboard IT, and nine years of shipping ransomware has yet to be confirmed on a vessel's own computers. Fleets moving to a single Windows domain can lose every ship's IT to one intrusion.
Reality
Keio Corporation shut down its network after a September 26 ransomware attack that disrupted Keio Group companies, including the Keio Plaza Hotel Tokyo. Trains are running normally while Keio checks whether customer and business data left its network.
Perspective Coverage
4 publishersReality
Keio Corporation shut its network after ransomware hit its group servers on September 26, disrupting payments and the business behind its 25 hotels. Its trains appear unaffected. Investigators have not yet traced the attack path, so it is still unknown whether a designed boundary kept rail out of reach.
Reality
Cisco Talos says three threat clusters are exploiting a CVSS 10.0 pre-auth root bypass and a 5.3 hard-coded credential in Secure Firewall Management Center. A patch policy with a severity cutoff above 5.3 would have skipped the credential fix on the console that pushes policy to every managed firewall.
Reality
NCC Group counted 1,073 ransomware attacks in August, a second straight 2026 high and 12% above July. Industrial companies took 31% of them, up from 28% in July, so the hardest-hit sector drew a larger slice of a larger total.
Reality
Security · September 27, 2026 · 2 publishers
Security · August 17, 2026 · 3 publishers
Security · August 18, 2026 · 3 publishers
Security · August 18, 2026 · 3 publishers
Security · August 18, 2026 · 3 publishers
Security · August 21, 2026 · 2 publishers
Security · September 26, 2026 · 1 publisher
Security · August 28, 2026 · 17 publishers
Security · August 28, 2026 · 4 publishers
Security · August 28, 2026 · 6 publishers
Security · September 2, 2026 · 2 publishers
Security · September 5, 2026 · 4 publishers
Security · September 10, 2026 · 2 publishers
Security · September 9, 2026 · 2 publishers
Security · September 10, 2026 · 2 publishers
Security · September 9, 2026 · 6 publishers
Security · September 10, 2026 · 5 publishers
Security · September 15, 2026 · 2 publishers
Security · September 25, 2026 · 1 publisher
Security · September 17, 2026 · 2 publishers
Security · September 18, 2026 · 2 publishers
Security · September 25, 2026 · 2 publishers
Security · September 24, 2026 · 5 publishers
Security · September 24, 2026 · 1 publisher
Security · September 24, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher
Build · September 23, 2026 · 1 publisher
Security · September 19, 2026 · 6 publishers
Security · September 22, 2026 · 1 publisher
Security · September 22, 2026 · 1 publisher
Product · September 21, 2026 · 1 publisher
Security · September 21, 2026 · 1 publisher
Product · September 21, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Security · September 19, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher