The UK government released a batch of cybersecurity policy papers on Nov. 3, including an annual assessment from the National Cyber Security Centre stating it is 'highly likely' AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. The NCSC also said nation-states including China and Russia will likely routinely use AI-driven cyber tools to pursue geopolitical goals in the UK. The announcements followed last week's Autumn Budget 2026, which allocated nearly £200 billion toward AI-driven government cybersecurity projects.
darkreading.com
· 2026-11-06
Bitdefender published research describing a 3AM ransomware affiliate attack on a UK school estate in which attackers stole backup credentials, created rogue domain-admin accounts, linked separate Active Directory domains, and spread across schools before deploying ransomware. Bitdefender says an AI system appeared to generate repetitive commands and troubleshoot issues while a human operator retained control of high-level decisions, using standard Windows tools like PowerShell and WMI throughout.
darkreading.com
· 2026-11-03
Bitdefender reported that a 3AM ransomware affiliate breached a UK school network between September 10 and 19, reaching nearly 50 machines and encrypting about 37 of them. The attackers stole credentials from Veeam backup servers and a Chrome database, deployed Mimikatz and LSASS-dumping tools, created rogue domain admin accounts, linked three Active Directory domains, and disabled security tools before deploying the encryptor.
bleepingcomputer.com
· 2026-11-03
Synology issued an advisory saying threat actors are exploiting a vulnerability patched in December 2024 to deploy C3RB3R ransomware against NAS devices still running outdated DSM software. The company did not name the specific flaw but pointed to a November 2024 advisory covering three vulnerabilities allowing code execution and file read/write access. Synology is urging customers to update DSM immediately, enable automatic updates, and block internet access to the management web interface.
bleepingcomputer.com
· 2026-11-02
A hacker group that claimed responsibility for breaching University of New Mexico Hospital's systems later apologized and said it would offer affected patients $2,500. The group stated it would provide a decryption key for the hospital's data but said it would retain copies of the stolen information.
gizmodo.com
· 2026-10-29
A Reddit user running a Synology DS918+ NAS had files encrypted by ransomware after leaving the device's web interface exposed directly to the internet and roughly 18 months behind on security patches. Forensic analysis of logs and system files, after moving the drives to a Proxmox machine, pointed to exploitation of CVE-2024-10441, a remote code execution vulnerability Synology disclosed a year and a half earlier. The user avoided data loss thanks to a 3-2-1 backup setup.
tomshardware.com
· 2026-10-29
Interpol's third annual Operation Serengeti, a two-month crackdown across 20 African countries and the US, resulted in nearly 1,500 arrests, recovery of $105 million in stolen funds, and the shutdown of almost 11,000 malicious networks. The operation targeted groups behind ransomware, phishing, and cyber-enabled fraud, building on prior sweeps that arrested 1,006 and 1,209 suspects in 2024 and 2025 respectively.
darkreading.com
· 2026-10-28
Artem Aleksandrovych Stryzhak, a 35-year-old Ukrainian national, was sentenced to 70 months in US prison for his role as an affiliate in the Nefilim and Hive ransomware operations, which hit hospitals, government bodies and large companies between 2018 and 2021. He was extradited from Spain in April 2025 after his arrest there in June 2024, and pleaded guilty to computer fraud conspiracy charges.
bleepingcomputer.com
· 2026-10-28
GMO Internet Group has urged users of its Onamae Desktop Cloud VPS service to disconnect from the internet, power down their PCs, and unplug cables after attackers who breached the service followed through on threats to leak stolen data and trigger ransomware. The breach, first detected on October 20, may have affected up to 26,739 customer servers, exposing MetaTrader 4/5 trading credentials though not payment data. GMO says it refused the attacker's ¥8 billion ($50 million) ransom demand and is instead offering each affected customer ¥5,000 ($30) in compensation while working with Trend Micro on recovery.
bleepingcomputer.com
· 2026-10-27
The University of New Mexico Health Sciences Center suffered a cyberattack that forced it to limit new patient admissions, divert ambulances, and suspend outpatient surgeries and appointments. UNM says its hospital and Sandoval Regional Medical Center remain open and clinics resumed scheduled care on Tuesday, though classes at its four health sciences schools were canceled. A new ransomware group calling itself Byod has claimed responsibility, saying it compromised roughly 36,000 systems including Active Directory, Microsoft Entra, Oracle databases, and records containing Social Security numbers, payroll data, research files, and patient information.
bleepingcomputer.com
· 2026-10-27
Zohar Pinhasi, head of Florida-based data recovery firm MonsterCloud, was indicted on federal fraud charges last month for allegedly telling ransomware victims he could restore their files without paying hackers, while secretly paying the ransoms and billing clients far more. Prosecutors say Pinhasi collected over $19 million from clients while paying out roughly $8 million in ransoms, including one case where an $8,200 payment was billed to a client at $150,000. He faces up to 20 years in prison if convicted.
it.slashdot.org
· 2026-10-27
On July 24, 2025, Curaçao's Tax and Customs Administration detected ransomware that knocked out counter services, its call center and internal operations for over a week, requiring Dutch specialists to help restore systems. A day earlier, the Joint Court of Justice serving Curaçao, Aruba, Sint Maarten, Bonaire, Saba and Sint Eustatius was also taken offline, meaning one intrusion disrupted judicial functions across six jurisdictions simultaneously.
darkreading.com
· 2026-10-23
GoKawiil