ransomware

The Clop ransomware gang has moved to new server infrastructure after exploiting a vulnerability in Grav CMS, the open-source flat-file content management system. The extortion group, known for large-scale data-theft campaigns against corporations and government agencies, is continuing operations despite the disruption. Security teams are being urged to patch Grav CMS installations and review whether their systems were targeted.

Keio Electric Railway, a major private railway operator in Tokyo, has been hit by a ransomware attack that disrupted its payment and settlement systems. The company says train operations themselves were not affected, and services continue to run normally while it deals with the cyberattack. The incident adds to a string of ransomware attacks on Japanese organisations, drawing attention to the vulnerability of critical transport infrastructure.

The hacking group ShinyHunters has compromised Cl0p, a rival ransomware gang, and taken control of its dark web Tor data leak site, according to a report by CPO Magazine. The takeover of one major cybercrime operation by another is drawing attention from security researchers tracking shifting alliances and infighting in the ransomware underworld.

Police have arrested a 16-year-old suspected of leading the KillSec ransomware group, according to Help Net Security. The arrest of a minor at the head of a ransomware operation has drawn attention to how young hackers have become involved in organized cybercrime, and to the growing activity of the KillSec group itself.

The ransomware group RansomHouse has listed Hospital Hermilio Valdizán in Peru as a new victim on its leak site, adding the healthcare facility to its portfolio of claimed attacks. If confirmed, patient data and hospital systems could be at risk. The claim is circulating among cybersecurity researchers tracking ransomware activity in Latin America's health sector.

Scattered Spider's 2023 attack on MGM Resorts is being retold in a quirky animated explainer, with low-poly potato characters. The story shows how a single phone call, LinkedIn research and help-desk impersonation led to a password and MFA reset, ransomware across 100+ MGM servers and the shutdown of Las Vegas operations. The campaign later hit Caesars, M&S, Salesforce clients and TfL, where two members were arrested.

An international police operation has reportedly dismantled the KillSec ransomware group, whose alleged leader is a 16-year-old. The operation targeted members of the cybercrime gang, which is associated with ransomware attacks and data extortion. Discussion is focused on the involvement of teenage hackers in major ransomware operations and what the arrests mean for the group's activity.

Two-thirds of schools in England now report recovering immediately from cyber incidents, suggesting improved resilience to attacks such as ransomware and phishing. Despite the progress, teachers remain divided over who bears responsibility for security and whose job security is at risk when breaches occur, with staff often left handling technical problems outside their expertise.

Flashpoint has announced a patented ransomware risk model designed to help organizations prioritize vulnerability patching. The scoring method assesses which vulnerabilities are most likely to be exploited in ransomware attacks, allowing security teams to focus remediation efforts where the threat of encryption-based extortion is highest. The announcement is drawing attention within the cybersecurity community as defenders seek better ways to manage growing vulnerability backlogs.

Black Cat White Hat Security is asking businesses a blunt question: if ransomware struck tomorrow, would they know what to do? The firm says its Defend & Respond platform now includes a Ransomware Assessment, arguing that cybersecurity is not only about prevention but also about being prepared to respond when an attack happens.

International law enforcement has seized the infrastructure of the KillSec extortion group and arrested three alleged members of the hacking crew. The takedown reportedly disrupts the group's ability to conduct extortion operations. The action highlights continued police pressure on ransomware and extortion networks, and details about the arrested suspects and the scale of the seized infrastructure have not yet been made public.

The Storm ransomware group has added new entries to its leak site, naming The Money Store, Silvercup Studios and Century Management Services among its latest claimed victims. The listings were flagged by threat intelligence monitors who track ransomware group blogs. Ransomware crews routinely publish victim names to pressure companies into paying, and each new post typically prompts checks by security researchers and affected firms.

A ransomware group calling itself Netrunner has listed Main Place Mall as a new victim on its leak site, tagging the target in the retail sector. The claim surfaced alongside fresh postings from other extortion groups, including Booba Project, in a routinely monitored feed of ransomware activity. Security researchers track these listings as an early indicator of breaches, though the mall operator has not publicly confirmed any incident.

The Aurora ransomware group has published a new post on its leak site naming Buford-Thompson Company, LTD as its latest claimed victim. The listing appeared in threat intelligence tracking of ransomware group blogs. Security researchers monitor these posts to identify newly attacked organisations and track the activity of emerging ransomware operations like Aurora.

Threat intelligence feeds are reporting a claim by the ransomware actor known as "lamashtu" involving Dr Damiel Pugliese, dated September 2026 and tracked by the monitoring service Yazoul. The claim is explicitly flagged as unverified and the scope of any breach is undisclosed. Cybersecurity observers are circulating it while awaiting confirmation.

The ThreeAM ransomware group has added US heavy equipment dealer Newman Tractor to its leak site, listing the company as a new victim in the manufacturing sector. The claim suggests the group may have exfiltrated company data and could publish it unless a ransom is paid. Security researchers monitoring ransomware activity are flagging the listing as part of ongoing tracking of the group's attacks against US businesses.

The ransomware group m3rx has published new entries on its leak blog, naming iccsi.com, noonsugar.com and somasolucoes.com among its latest alleged victims. Cybersecurity threat-intelligence monitors flagged the posts, adding the group to tracked victim feeds. The listings imply the affected organisations now face data extortion demands, though the extent of the breaches and the companies' responses are not yet known.