./Ransomware newsMon, 19 Oct 2026 12:28:44 GMT https://bsky.app/profile/hackmanac.com/post/3my7oq5q7lc2kdwf443Mon, 19 Oct 2026 08:19:00 GMTHackmanac Alerts. Italy - Mastelli The Qilin ransomware group claims to have breached Mastelli, a bio-pharmaceutical company based in Sanremo. Threat actor: Qilin Sector: Healthcare Data exposure (claimed): Not specified Data type: Not specified Observed: Oct 18, 2026BreachRansomware https://bsky.app/profile/hackmanac.com/post/3my7oh7ggt22k1kjg65hMon, 19 Oct 2026 08:14:00 GMTHackmanac Alerts. Japan - First Brothers Co. Ltd The Qilin ransomware group claims to have breached First Brothers Co. Ltd.BreachRansomware https://www.helpnetsecurity.com/2026/10/19/semperis-ransomware-employee-safety-report/1eufsluMon, 19 Oct 2026 04:00:22 GMTHelp Net Security. Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one…Ransomware https://securityaffairs.com/201230/malware/security-affairs-malware-newsletter-round-119.html1tskdf7Sun, 18 Oct 2026 09:10:15 GMTSecurity Affairs. Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime AI models may be…RansomwareMalware https://objective-see.org/blog/blog_0x8A.htmllvm9qdSun, 18 Oct 2026 00:00:00 GMTObjective-See. A newly discovered macOS ransomware sample attempts to rewrite, recompile, and replace itself with a metamorphic variant. In this blog post, we analyze Heartbreaker's encryption, persistence, and unusual self-rebuilding logic, then put it to the test against…ResearchRansomware https://www.zscaler.com/blogs/security-research/ransomware-machine-speed-how-genai-shrinks-path-after-initial-accessllnzpbFri, 16 Oct 2026 22:48:36 GMTZscaler ThreatLabz. Artificial Intelligence technologies have made a huge impact on the security industry. But as with any public technology, adversaries have access to AI as well. They’re wasting no time incorporating AI into their malicious workflows and ransomware operators…ResearchRansomwareAI https://www.darkreading.com/cyber-risk/when-your-ransomware-negotiator-works-other-sidejerh8eFri, 16 Oct 2026 14:00:00 GMTDark Reading. The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.Ransomware https://therecord.media/anne-arundel-county-maryland-confirms-data-breachdlrdu5Fri, 16 Oct 2026 13:05:00 GMTThe Record. Anne Arundel County, Maryland, said an intruder stole files from government systems, and investigators are working to assess how much data was exposed.BreachRansomware https://www.infosecurity-magazine.com/news/ransomware-threats-physical/1bd0ohzFri, 16 Oct 2026 13:00:00 GMTInfosecurity Magazine. New report warns that threats of violence against employees of organizations hit by ransomware are on the rise as attackers find new ways to guarantee paymentsRansomware https://www.theregister.com/security/2026/10/16/user-refused-to-change-her-password-because-everyone-already-knew-it/5301864vt200cFri, 16 Oct 2026 07:28:00 GMTThe Register. School staff seemed to be trying to get ransomware – for a second timeRansomware https://bsky.app/profile/hackmanac.com/post/3mxxwkhgces2gfmd6exFri, 16 Oct 2026 06:18:00 GMTHackmanac Alerts. Egypt - Luxor Drinking Water and Sanitation Company The LockBit 5.0 ransomware group claims to have breached Luxor Drinking Water and Sanitation Company.BreachRansomware https://bsky.app/profile/hackmanac.com/post/3mxxv6647d227g5fbxsFri, 16 Oct 2026 05:53:00 GMTHackmanac Alerts. Japan - Keio Corporation The Qilin ransomware group claims to have breached Keio Corporation, a major Japanese transportation company, and threatened to leak allegedly stolen confidential data.BreachRansomware https://dysruptionhub.com/sangre-de-cristo-colorado-cyber-intrusion/ippzx0Thu, 15 Oct 2026 16:00:27 GMTDysruptionHub. Billing and telephone services have been restored, but INC Ransom claims to have stolen sensitive infrastructure records and threatens further disruption.Ransomware https://cybersecuritynews.com/hackers-use-clickfix/kml2riThu, 15 Oct 2026 14:30:51 GMTCybersecurity News. Hackers are using ClickFix tricks to install malware loaders and Python tunnels on Windows systems, creating access that could support ransomware attacks. A late September incident shows how a user running a command can start an infection chain built around…RansomwareMalware https://news.google.com/rss/articles/CBMiYEFVX3lxTE9LOXYtVE9hcFVyM0hfaFVlcmRObFIwcnlaQ0RVRjl3OWpnUmpSY0ZMcVZETUd3N3BUWnk4YlV0Y1VfYXUyVjduT25LN3F5a2tfa2hRLXlGblJJRnpTTEtfSdIBZkFVX3lxTE1ZMG81S3BvdE9KczZUVkh0VlhweC1UNWFuVFVSQU10VjdremRvWms4UzZna1BOVEJ6eUFiVnlDT0ZZY0RDMDZHaGhJWWFCc1BoOEFUaW4tNGl3WTc0S1hOLVJyZ1p0dw?oc=51e2hgubThu, 15 Oct 2026 14:30:51 GMTCybersecurity News. Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks CyberSecurityNewsRansomwareMalware https://bsky.app/profile/hackmanac.com/post/3mxvvynp4ns2t1jxotlgThu, 15 Oct 2026 11:02:00 GMTHackmanac Alerts. UAE - Amity University Dubai The Black Nevas ransomware group claims to have compromised Amity University Dubai, a private university in the UAE, allegedly stealing sensitive information belonging to students, staff, parents, and guardians.Ransomware https://cybersecuritynews.com/ransomware-attacks-get-personal/12aoej6Thu, 15 Oct 2026 10:28:30 GMTCybersecurity News (+1 more sources). Ransomware gangs are moving beyond locked files and stolen data. Criminals now threaten employees, executives, and their families to force companies to pay. According to the Semperis 2026 Ransomware Risk Report, 37% of successful attacks included threats…Ransomware https://bsky.app/profile/hackmanac.com/post/3mxvlsurmk22f1ipl1b8Thu, 15 Oct 2026 08:00:00 GMTHackmanac Alerts. Italy - Alma Center The Space Bears ransomware group claims to have compromised Alma Center. Threat actor: Space Bears Sector: Healthcare Data exposure (claimed): Not specified Data type: Not specified Observed: Oct 15, 2026 Status: Pending verification…Ransomware https://www.huntress.com/blog/manufacturing-cybersecurity-trends8hk2l9Wed, 14 Oct 2026 16:00:00 GMTHuntress. Explore the latest manufacturing cybersecurity trends, from ransomware to OT takeovers, and real-world risks to production. Learn how to secure your plant.ResearchRansomware https://www.huntress.com/blog/what-does-the-future-hold-for-todays-cybersecurity-leaders1cayil4Wed, 14 Oct 2026 16:00:00 GMTHuntress. The threat landscape has shifted. Here's what cybersecurity leaders need to know about RMM abuse, AI-powered attacks, ransomware, and identity threats in 2026.ResearchRansomware https://databreaches.net/2026/10/14/japan-on-cyberattack-alert-as-ransomware-wave-hits-major-brands-and-exposes-millions-of-records/2404f4Wed, 14 Oct 2026 15:09:36 GMTDataBreaches.net. Audrey Liza M. Nolasco reports: Japan is confronting a mounting cybersecurity crisis, with a ransomware attack disrupting hundreds of organisations and a series of separate breaches putting millions of customer records at risk. One alarming detail: experts…Ransomware https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/epgn5aWed, 14 Oct 2026 14:22:49 GMTKrebs on Security. The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping…RansomwareLaw & policy https://databreaches.net/2026/10/14/shipping-firms-and-ports-caught-in-mass-cyber-extortion-claim/1c8b56yWed, 14 Oct 2026 12:09:35 GMTDataBreaches.net. Bojan Lepic reports: A cyber extortion group has threatened to publish data it claims it stole from 38 shipping, port, and logistics companies unless they pay multimillion-dollar ransoms by October 19. Cybersecurity firm SOCRadar said the group, known as n0n,…Ransomware https://www.theregister.com/cyber-crime/2026/10/14/ransomware-gets-personal-we-know-where-you-are-kind-of-stuff/530293914wb1rvWed, 14 Oct 2026 05:00:00 GMTThe Register. 37% of ransomware attacks involve psychological or physical threats, global survey foundRansomware https://www.darkreading.com/cybersecurity-analytics/ransomware-gangs-physical-threats-family-stalkinglmu1wtWed, 14 Oct 2026 05:00:00 GMTDark Reading. Organizations are reporting that employees face threats of stalking, physical violence, and abduction. But these alarming claims are hard to verify.Ransomware https://databreaches.net/2026/10/13/shinyhunters-six-years-of-cybercrime-expert-analysis-and-ransomware-group-perspectives/bwo738Tue, 13 Oct 2026 12:43:12 GMTDataBreaches.net. Back in the day, when my co-author and I would conduct training workshops on neurobehavioral disorders in children and teens, we would always introduce our presentation with an overhead that said, “Two Professionals. Three Opinions.” That remains true for so…RansomwareAPT https://bsky.app/profile/hackmanac.com/post/3mxqdat22gc2q1xrwvftTue, 13 Oct 2026 05:44:00 GMTHackmanac Alerts. Saudi Arabia - Port of NEOM The n0n hacking group claims to have targeted Port of NEOM, an industrial port operations entity in Saudi Arabia. The attackers threaten to publish allegedly stolen commercial tariff documentation and invoicing records unless a $4…Ransomware https://bsky.app/profile/hackmanac.com/post/3mxqcmrap4c2qw6odq8Tue, 13 Oct 2026 05:32:00 GMTHackmanac Alerts. Japan - Tsuneishi / Kambara Kisen The n0n cybercriminal group claims to have compromised Tsuneishi and Kambara Kisen, threatening to leak allegedly stolen operational EDI archives and commercial contracts unless a $28 million ransom (267 BTC) is paid.Ransomware https://securityaffairs.com/200847/cyber-crime/shinyhunters-arrest-number-three-a-canadian-ransomware-negotiator.html5uiwb9Mon, 12 Oct 2026 21:26:12 GMTSecurity Affairs. A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian…RansomwareLaw & policyAPT https://www.darkreading.com/insider-threats/prominent-ransomware-negotiator-extortion-chargeszqjwaqMon, 12 Oct 2026 20:00:53 GMTDark Reading. Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.Ransomware https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.htmlnaxpfhMon, 12 Oct 2026 15:16:26 GMTThe Hacker News. Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the…VulnerabilityZero-dayRansomwareMalwareAILaw & policyAPT https://www.infosecurity-magazine.com/news/luna-moth-leaks-ransomware-playbook/17umulwMon, 12 Oct 2026 15:15:00 GMTInfosecurity Magazine. Leaked documents suggest a multi-pronged operation, with social engineering and more technical attackers working together to manipulate a single targetBreachRansomware https://www.schneier.com/blog/archives/2026/10/fbi-arrests-suspect-in-fbi-hacking-case.htmlp6ghc6Mon, 12 Oct 2026 15:01:26 GMTSchneier on Security. In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster . Last week, the FBI arrested (alternate link ) someone associated with that crime.RansomwareLaw & policyAPT https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/x2y5x4Mon, 12 Oct 2026 10:32:05 GMTSecurityWeek. The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.RansomwareLaw & policyAPT https://www.infosecurity-magazine.com/news/net-closes-shinyhunters-another/122coiuMon, 12 Oct 2026 10:00:00 GMTInfosecurity Magazine. The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHuntersRansomwareLaw & policyAPT https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/1iz3gy7Mon, 12 Oct 2026 09:15:00 GMTInfosecurity Magazine. ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in MayVulnerabilityRansomware https://www.helpnetsecurity.com/2026/10/12/akshay-joshi-wef-cyber-resilience-gap/3xde3lMon, 12 Oct 2026 06:00:12 GMTHelp Net Security. In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook…Ransomware https://news.risky.biz/risky-bulletin-shinyhunters-suspects-arrested-in-us-and-jordan/1q6i43zMon, 12 Oct 2026 02:54:42 GMTRisky Bulletin. In other news: Hackers breach TLD registrars to get Google certs; Qilin member arrested in Japan; Google suspends OSS VRP due to AI spam.RansomwareLaw & policyAPT https://bsky.app/profile/hackmanac.com/post/3mxmfrpj5mc2i1kh1owfSun, 11 Oct 2026 16:18:00 GMTHackmanac Alerts. United States - KFC The Gentlemen ransomware group claims to have breached KFC. Threat actor: The Gentlemen Sector: Hospitality Data exposure (claimed): Not specified Data type: Not specified Observed: Oct 10, 2026 Status: Pending verification ESIX©: 5.23BreachRansomware https://bsky.app/profile/hackmanac.com/post/3mxmfofuntc2i14bnba3Sun, 11 Oct 2026 16:16:00 GMTHackmanac Alerts. United States - Confluent The Gentlemen ransomware group claims to have breached Confluent. Threat actor: The Gentlemen Sector: ICT Data exposure (claimed): Not specified Data type: Not specified Observed: Oct 10, 2026 Status: Pending verification ESIX©: 5.60BreachRansomware https://bsky.app/profile/hackmanac.com/post/3mxmfkts7es2io7by7pSun, 11 Oct 2026 16:14:00 GMTHackmanac Alerts. United States - MoneyGram The Gentlemen ransomware group claims to have breached MoneyGram. Threat actor: The Gentlemen Sector: Financial Data exposure (claimed): Not specified Data type: Not specified Observed: Oct 10, 2026 Status: Pending verification…BreachRansomware https://databreaches.net/2026/10/11/the-luna-moth-files-werent-hacked-heres-how-they-leaked/kkpm59Sun, 11 Oct 2026 13:51:15 GMTDataBreaches.net. When asked about the “Luna Moth Files” that had mysteriously appeared online, Silent Ransom Group called them “fake” and insisted they hadn’t had any leak or breach. But they had. Here’s what we know. When the “Luna Moth Files” appeared on an onion site…BreachRansomware https://securityaffairs.com/200752/breaking-news/security-affairs-newsletter-round-599-by-pierluigi-paganini-international-edition.htmlyyu9t4Sun, 11 Oct 2026 13:34:01 GMTSecurity Affairs. A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Anthropic…Ransomware https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/le2uvySat, 10 Oct 2026 15:07:54 GMTBleepingComputer. Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. [...]RansomwareLaw & policyAPT https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html1gldh5xSat, 10 Oct 2026 15:05:54 GMTSecurity Affairs. Silent Ransom Group allegedly extorted $207 million from 27 law firms in six months using phone calls and social engineering, not encryption. Silent Ransom Group doesn’t rely on encryption. No malware payload, no locked files, just phone calls and social…Ransomware https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/edjrghSat, 10 Oct 2026 13:35:50 GMTCyberScoop. Details of the case align with the investigation into ShinyHunters’ attack on FBI IT systems.RansomwareLaw & policyAPT https://databreaches.net/2026/10/10/fbi-announces-yet-another-arrest-allegedly-connected-to-the-fbi-jobs-hack/1r5xxttSat, 10 Oct 2026 11:57:52 GMTDataBreaches.net. The FBI is doing another victory dance after arresting someone they allege assisted ShinyHunters with the FBI Jobs attack. Brian Krebs reports: Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian…RansomwareLaw & policyAPT https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/15wcc9Sat, 10 Oct 2026 00:17:42 GMTKrebs on Security. Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of…RansomwareLaw & policyAPT https://securityaffairs.com/200695/uncategorized/germany-arrests-suspected-qilin-ransomware-leader-after-japan-detention.htmlfh07luFri, 09 Oct 2026 18:45:43 GMTSecurity Affairs. Japan helped extradite a Russian suspect linked to Qilin ransomware to Germany, but the gang continued attacking victims after his arrest. Germany has arrested a Russian national believed to be a leading figure in the Qilin ransomware group, and Japan’s…RansomwareLaw & policy https://therecord.media/japan-germany-ransomware-arrest1iuvjfmFri, 09 Oct 2026 18:45:00 GMTThe Record. Japan’s National Police Agency confirmed the arrest and extradition to Germany of a Russian national accused of being involved in the Qilin ransomware gang.RansomwareLaw & policy https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html8benqaFri, 09 Oct 2026 17:45:26 GMTThe Hacker News. The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on…RansomwareLaw & policyAPT https://www.darkreading.com/identity-access-management-security/fbi-shinyhunters-claims-hack1o7854aFri, 09 Oct 2026 17:21:00 GMTDark Reading. In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunters operative to the compromise of a Pentagon-run data center.RansomwareLaw & policyAPT https://www.bleepingcomputer.com/news/security/fbi-arrests-another-suspected-shinyhunters-hacker-after-agency-breach/14187fdFri, 09 Oct 2026 17:02:29 GMTBleepingComputer. The FBI has arrested another suspected member of the ShinyHunters extortion group believed to be involved in the recent breach of FBI systems, Director Kash Patel announced Friday. [...]BreachRansomwareLaw & policyAPT https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation1lb9ltaFri, 09 Oct 2026 15:41:00 GMTThe Record. “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate," FBI Director Kash Patel said.BreachRansomwareLaw & policyAPT https://www.bleepingcomputer.com/news/security/germany-arrests-alleged-core-qilin-ransomware-member-after-extradition/1uuh90wFri, 09 Oct 2026 15:38:56 GMTBleepingComputer. Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month. [...]RansomwareLaw & policy https://databreaches.net/2026/10/09/silent-ransom-group-claims-luna-moth-files-are-fake-the-data-suggest-otherwise/1v6dmh3Fri, 09 Oct 2026 13:50:55 GMTDataBreaches.net. On Tuesday, cybersecurity professionals began investigating an onion site that appeared to contain internal chat files from Silent Ransom Group. On Thursday, Silent Ransom Group said the leak was fake, but is it? A bespoke site called “Luna Moth Files”…Ransomware https://www.infosecurity-magazine.com/news/q3-new-record-ransomware/1rdmoflFri, 09 Oct 2026 12:00:00 GMTInfosecurity Magazine. Comparitech observed 2627 claimed ransomware attacks in Q3, with critical sectors like finance, technology, education and healthcare experiencing significant increasesRansomware https://databreaches.net/2026/10/09/cyberattack-at-idc-frontier-disrupts-services-around-nation/gzjhujFri, 09 Oct 2026 11:23:16 GMTDataBreaches.net. The Asahi Shimbun reports: IDC Frontier Inc., a SoftBank subsidiary that provides cloud services, said Oct. 7 that a ransomware attack caused a system outage affecting 495 corporate and local government customers. The Tokyo-based company said it is still…BreachRansomware https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/1d8mjdhThu, 08 Oct 2026 20:09:45 GMTBleepingComputer. IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part of the country. [...]Ransomware https://cyberscoop.com/monstercloud-zohar-pinhasi-ransomware-recovery-scheme/5wherlThu, 08 Oct 2026 19:44:29 GMTCyberScoop. Zohar Pinhasi allegedly deceived ransomware recovery clients into a payment scheme disguised as a specialized service that helped victims avoid paying cybercriminals.RansomwareLaw & policy