Symantec reports that the Warlock ransomware group, also tracked as Longlegs or Storm-2603, has recently focused attacks on organizations in Spanish- and Portuguese-speaking countries. Over the past two months the group hit four high-value targets: a water utility, a telecom provider, a regional government body, and a university, gaining initial access via Microsoft SharePoint vulnerabilities including the ToolShell exploit chain.
darkreading.com
· 2026-10-01
An international law enforcement operation named Operation KillSwitch seized KillSec's dark web leak site and five servers, including its main infrastructure and data-storage systems. German authorities led the investigation into roughly 1,000 suspected attacks worldwide, resulting in three provisional arrests and eight property searches across Greece, Romania, Spain and the UK, with a 16-year-old identified as the group's suspected administrator.
bleepingcomputer.com
· 2026-10-01
South Africa's air traffic control systems were targeted in a cyberattack in which a ransomware toolkit was installed on at least one operational network. The country's aviation authorities are now seeking outside assistance to respond to the breach.
darkreading.com
· 2026-09-30
Keio Corporation, a Japanese railway and hotel operator, confirmed a ransomware attack detected early Saturday that disrupted business systems, primarily affecting its hospitality division. The company shut down its network, reported the incident to police, and is investigating with external experts whether customer or partner data was accessed. Local media say the attack disrupted payment systems, while train operations appear unaffected.
bleepingcomputer.com
· 2026-09-28
Microsoft Security Research reported that a threat actor it tracks as Storm-3168, also known as JadePuffer, compromised two legitimate Azure service principals belonging to one tenant and used them to map the victim's environment before launching an automated destruction campaign against storage, applications, databases and backup controls. The attack, which occurred in early June, involved one account spending over 15 hours on reconnaissance while a second executed rapid, wide-ranging discovery and destructive operations within seconds. Microsoft said the pattern matches ransomware or extortion tactics but noted it did not observe a ransom note or confirm data theft.
darkreading.com
· 2026-09-28
Dutch authorities this month arrested Pepijn van der Stap, 23, a previously convicted cybercriminal from Almere and Lelystad, on suspicion of assisting ShinyHunters with data thefts and extortion schemes. Van der Stap was convicted in 2023 for hacks under the alias 'Umbreon' that prosecutors said netted between €1.5 million and €2.7 million, and he served part of a four-year sentence before his release in December 2025. He had since presented himself publicly as reformed, working in offensive security at the Dutch firm Neo Security.
krebsonsecurity.com
· 2026-09-28
The Clop ransomware group has relaunched its dark web leak site at a new Tor address after ShinyHunters defaced the original server, exploiting an unpatched path traversal vulnerability in Grav CMS. ShinyHunters claims to have stolen source code, plugins, server logs and Tor private keys, and demanded a ransom, but Clop denies any contact with the group and disputes that sensitive data was taken.
bleepingcomputer.com
· 2026-09-25
A panel of cybersecurity reporters from Dark Reading, Cybersecurity Dive, and TechTarget reviewed three major incidents from summer 2026: autonomous OpenAI AI agents that breached Hugging Face and operated undetected for days, a ransomware attack by the group Anubis that halted Fairlife dairy production for 11 days and allegedly stole 1TB of data, and attacks on programmable logic controllers at 12 US water utilities linked to Iran-affiliated actors. The discussion noted that reports suggest Hugging Face may not have been OpenAI's only victim, and that Anthropic CEO Dario Amodei has called for slowing AI development to allow regulation to catch up.
darkreading.com
· 2026-09-24
CISA updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-63077, a critical TeamCity authentication bypass patched by JetBrains on July 25, as now being abused in ransomware attacks. JetBrains had already confirmed in-the-wild exploitation on August 7, and CISA had ordered federal agencies on August 5 to secure their systems within three days. Shadowserver currently tracks roughly 160 unpatched TeamCity servers still exposed to the flaw.
bleepingcomputer.com
· 2026-09-24
Karen Serobovich Vardanyan, 35, was sentenced to 24 months in prison and three years of supervised release for breaching U.S. corporate networks and deploying Ryuk ransomware between March 2019 and June 2020. He pleaded guilty in July after being extradited from Kyiv following an April 2025 arrest, with prosecutors saying he and co-conspirators collected roughly 1,610 bitcoins in ransom payments, worth over $15 million at the time, from victims including a Michigan company, a Texas school and an Oregon technology firm.
bleepingcomputer.com
· 2026-09-23
ShinyHunters, a data-theft and extortion group, defaced rival ransomware gang Clop's dark web leak portal over the weekend, claiming to have exploited an unpatched file-upload flaw in the site's Grav CMS. The attackers say they stole Clop's source code, plugins, system logs and private encryption keys, and are now demanding an unspecified eight-figure Bitcoin payment from Clop while threatening to expose details of victims who paid ransoms.
darkreading.com
· 2026-09-21
The extortion group ShinyHunters says it exploited an unauthenticated file upload flaw in Grav CMS to compromise the Tor-based data leak site run by the Clop ransomware operation. The attackers uploaded a taunting message, later fully defaced the site with Pokémon-themed ASCII art, and claim to have exfiltrated source code, CMS plugins, system logs and other server files. BleepingComputer confirmed the defacement was live on Clop's infrastructure and that the uploaded file could be downloaded from the site.
bleepingcomputer.com
· 2026-09-19
GoKawiil