Ransomware

Comparitech reports Q3 2026 recorded 2,627 claimed ransomware attacks, with finance, tech, education, and healthcare hit hardest.

Ransomware groups exploit Palo Alto GlobalProtect authentication bypass (CVE-2026-0257) to create unauthorized VPN sessions and access internal networks.

DoJ charged MonsterCloud owner Zohar Pinhasi for wire fraud, alleging secret ransom payments and overbilling of victims.

Ukraine's ATB grocery chain confirms cyberattack with attackers threatening data leaks and extortion demands.

Former engineer sentenced for locking 3,000+ employer devices in a ransomware-style sabotage on a Windows network.

Ransomware impacted University of Illinois Chicago College of Medicine, with data theft reported from servers.

Osaka Metropolitan University cancels classes after a ransomware outage affecting internal network, email and academic systems.

Profile of the newly emerged N0n ransomware extortion gang that published dozens of victims shortly after appearing in September 2026.

Law enforcement dismantled KillSec operators; seizures and arrests disrupted ransomware activity and prevented an air-traffic attack.

Warlock exploited SharePoint vulnerabilities to deploy ransomware against water, telecom, and government organizations.

International police seized KillSec leak site and data, secured 110TB, and identified an alleged teenage administrator.

Warlock (Longlegs/Storm-2603) exploits SharePoint vulnerabilities to deploy ransomware against water and telecom operators.

CISA warns ransomware actors are exploiting a critical JetBrains TeamCity vulnerability patched in July to gain footholds.

Analysis of JADEPUFFER shows ransomware groups now target AI/ML models and model recovery chains for extortion and disruption.

Revolut allegedly exposed customer data for five months to attackers impersonating an Italian agency, affecting 680 high-profile accounts and a $3M ransom.

CISA warns ransomware gangs are exploiting a critical VMware vCenter RCE to spread ransomware; patch vCenter immediately.

CISA warns WatchGuard Firebox RCE is being exploited by ransomware gangs to deploy encryptors and extort victims.