Ransomware

Extortion group Nightmare Eclipse alleges CrowdStrike zero-day release and leaks Manchester Airports Group data.

FulcrumSec published roughly 550GB of Manchester Airports Group data after MAG refused a ransom demand, exposing passenger records.

Ransomware group claims Nutex Health breach; SEC filing says patient, employee, provider, business, and financial information accessed.

McKesson investigates a data-theft extortion incident after ShinyHunters claimed to steal roughly 284 million records.

ATF confirms a system compromise linked to Qilin ransomware claims affecting investigation-related data access.

Report finds ransomware remains a major threat to education, disrupting operations, data and remote learning access across institutions.

Medusa ransomware campaign now affects 500+ organizations and increasingly targets critical infrastructure sectors.

Investigation reveals Clop likely exploited critical PTC Windchill vulnerability in June, initiating extended extortion and data theft.

Clop-associated web shell on PTC Windchill/FlexPLM decrypts credentials and maps PLM engineering vault data for extortion.

FBI warns Medusa Ransomware affiliates breached over 500 critical infrastructure orgs via improved RaaS tactics and tools.

Clop gang developed a Java web shell tailored for PTC Windchill and FlexPLM to decrypt credentials and exfiltrate files.

CISA confirms ransomware groups are exploiting a high-severity Windows Task Host vulnerability previously flagged as actively exploited.

Updated FBI/CISA/HHS advisory details Medusa techniques: disabling security, exfiltrating data, and encrypting whole networks.

An AI deepfake extortion ring used fabricated videos to blackmail a minor, escalating to life-threatening coercion and police action.

Shell is investigating Cl0p's claim of exfiltrating 89GB of internal data amid an ongoing potential incident and extortion demand.

Gunra actors exploit Fortinet vulnerabilities to exfiltrate large volumes of Microsoft service data, targeting critical infrastructure.

China-linked Storm-1175 deploys StormEncryptor ransomware, likely exploiting an N-able N-central vulnerability to gain initial access.

Microsoft warns China-linked actors are exploiting a critical flaw in N-able to deploy ransomware broadly as a launchpad.

Ransomware group claims 6 TB exfiltration and hijacks a hospital's Facebook page, exposing highly sensitive patient data categories.