Cyber insurance providers such as Coalition, Chubb, AXA XL, Cowbell and Resilience are broadening their role beyond writing policies, taking a more active hand in clients' cybersecurity defenses. The shift comes as AI tools let attackers craft faster, more convincing phishing and social engineering campaigns, straining insurers' historical loss models built around traditional ransomware patterns. Cowbell's Thomas Pytel told Dark Reading his firm now favors underwriting that continuously adapts to changing risk.
darkreading.com
· 2026-10-23
CISA, the FBI, the US Secret Service, and law enforcement agencies in Germany and the UK issued a joint advisory stating the SafePay ransomware gang has compromised more than 600 critical infrastructure organizations across North America, South America, Europe and Australia since August 2024. The agencies said SafePay actors gain access through credential theft, brute-force attacks, and VPN exploitation, particularly targeting Mullvad VPN IP addresses, and often delete shadow copies and reset network-attached storage to hinder recovery.
bleepingcomputer.com
· 2026-10-21
A developer released VoidAccess, a self-hostable, open-source tool that lets security researchers turn dark-web search queries into structured threat intelligence. It collects data from Tor indexes, paste sites, code forges and security feeds, extracts entities like IOCs and malware, and builds relationship graphs that can be exported in formats such as STIX, MISP and YARA. It is available via pip install and can run locally or as a Docker Compose stack.
github.com
· 2026-10-20
Three copies, two kinds of media, one off-site. The rule is old because it keeps surviving the specific ways people actually lose files.
gokawiil.com
· 2026-10-19
German authorities have detained a 28-year-old Russian man, named by German press as Vladimir K, who was arrested in Japan in May after being extradited on hacking charges. The BBC has confirmed German investigators are now examining his alleged role in the 2024 Synnovis cyber attack, which disrupted pathology services at London hospitals and was linked to a patient's death. He is accused of being a core member of the Qilin cyber-crime gang, alleged to have hacked over 4,000 organisations and extorted more than $140m.
bbc.co.uk
· 2026-10-16
A well-known ransomware negotiator has been arrested amid allegations of collusion with the hacking groups they were supposedly negotiating against. The case raises questions about oversight of third-party vendors brought in during ransomware incident response.
darkreading.com
· 2026-10-16
Proofpoint researcher Selena Larson told Dark Reading that threat actors like TA4903 and TA2725, once sophisticated operations, have grown less effective after adopting AI tools in their attack chains. She contrasted this with widely cited survey data claiming 84% of ransomware attacks now involve AI, arguing that such headline figures overstate AI's actual impact on attacker capability.
darkreading.com
· 2026-10-15
On October 8 the United Kingdom imposed economic sanctions on Cryptomus, a cryptocurrency payment processor previously known as Certa Payments and Xeltox Enterprises, accusing it of processing payments benefiting the Russian government and its banks. The sanctions freeze Cryptomus assets held at UK banks and prohibit British firms from doing business with it, and also hit related services VexPay, TokenSpot and Tsunami Payments.
krebsonsecurity.com
· 2026-10-14
Semperis's 2026 Ransomware Risk Report found that 40% of surveyed organizations experienced intimidation or threats tied to ransomware attacks, including threats against employees' families, physical intrusion, stalking, and abduction. More than half of those threatened said attackers actually followed through, though Semperis relied on self-reported data that couldn't be independently verified.
darkreading.com
· 2026-10-14
Mandiant detailed an August 4, 2026 Akira ransomware intrusion in which an affiliate brute-forced a SonicWall SSL VPN account that had no multi-factor authentication, gaining access within minutes. The attacker then used RDP to reach the domain controller, enumerate Active Directory, and steal credentials and file-share data, though the ransomware payload itself failed to deploy. Mandiant's 2025 data shows compromised credentials caused 21% of ransomware incidents with a known entry point, and RDP was used for lateral movement in about 85% of cases.
bleepingcomputer.com
· 2026-10-13
Edward Dubrovsky, a veteran cybersecurity executive known for negotiating with ransomware gangs, was arrested in Pennsylvania last week. He faces a federal charge of conspiracy to extort money.
darkreading.com
· 2026-10-12
The FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive and ransomware expert, in connection with a hack that exposed sensitive data of current and former FBI employees. He faces extortion and threat-related charges and has been moved to Texas's Eastern District for a detention hearing. FBI Director Kash Patel announced the arrest without naming the suspect, but sources confirmed Dubrovsky's identity to CNN.
it.slashdot.org
· 2026-10-11
GoKawiil