Blackcat - GoKawiil

Ransomware groups increasingly target backup systems before encrypting data, advisories show

Security researchers and government advisories document a shift in ransomware tactics, with groups like BlackMatter and Gunra deliberately locating and destroying backup data before encrypting primary systems. The 2024 ALPHV/BlackCat attack on Change Healthcare exemplified the pattern: inadequate backup isolation contributed to UnitedHealth paying $22 million without recovering its data, with total costs reaching an estimated $1.6 billion. CISA, the FBI, and the NSA have jointly documented these methods across multiple incidents.

bleepingcomputer.com · 2026-10-07

Huntress details how it caught fake North Korean IT workers in 2026 probes

Security firm Huntress published findings from investigations conducted throughout 2026 in which it helped organizations confirm they had unknowingly hired North Korean operatives posing as IT staff. Cases included an Australian healthcare firm that flagged three employees suspected of impersonating Chinese nationals, plus two separate incidents in the financial services sector uncovered in August. Huntress noted these DPRK-linked workers have grown more skilled and active, blending into IT teams while funneling wages back to the regime and potentially planting malware or stealing data.

darkreading.com · 2026-08-26