DOJ Charges Three Russians Behind LockBit, Play Hosting Network
July 15, 2026
The DOJ unsealed charges against three Russians who ran Media Land and ML.Cloud, bulletproof hosting that served LockBit, Blacksuit, and
Ransomware
DOJ Charges Three Russians Behind LockBit, Play Hosting Network
The DOJ unsealed charges against three Russians who ran Media Land and ML.Cloud, bulletproof hosting that served LockBit, Blacksuit, and Play ransomware.
Ryuk Ransomware Broker Pleads Guilty in $15M Bitcoin Theft Case
Armenian national Karen Vardanyan pleaded guilty to enabling Ryuk ransomware attacks on U.S. organizations that yielded about 1,610 Bitcoin for the gang.
DigitalMint Employee Sentenced for BlackCat Ransomware Conspiracy
A former DigitalMint employee received 70 months in prison for conspiring with BlackCat ransomware operators while posing as a trusted victim recovery advisor.
GodDamn Ransomware Uses PoisonX Driver to Kill EDR Before Encrypting
Symantec identified GodDamn ransomware using a kernel driver named PoisonX via the BYOVD technique to kill security software before file encryption begins.
CSE Admits Hacking Ransomware Gangs and Deleting Stolen Victim Data
Canada's CSE confirmed offensive cyber operations against ransomware gangs, including destroying a gang's full infrastructure and deleting stolen victim data.
JADEPUFFER: First AI-Orchestrated Ransomware Exploits Langflow RCE
Sysdig identified JADEPUFFER, the first ransomware campaign run by an LLM autonomous agent exploiting CVE-2026-33017 in Langflow to complete full attack chains without human operators.
Qilin Ransomware Claims Canadian Manufacturer Chamco Industries
Qilin listed Chamco Industries on its dark web extortion portal, threatening to leak stolen data in its latest attack on a Canadian manufacturing company.
FortiBleed True Scale: 430,000 Firewalls Targeted, INC and Lynx Linked
SOCRadar confirmed FortiBleed hit 430,000 FortiGate firewalls with sniffers on 19,000 devices, linking the operation to INC Ransom and Lynx ransomware groups.
DeepSeek Built Browser Ransomware Using Chrome File System API
Check Point researchers showed DeepSeek generated InfernoGrabber 9000, near-functional browser ransomware using Chrome's File System Access API to encrypt files across four OS platforms.
CISA Confirms BlueHammer CVE-2026-33825 Used in Ransomware
CISA updated its KEV entry for CVE-2026-33825 to flag ransomware group exploitation of the Windows Defender privilege escalation flaw, first patched in April.
Ryuk Ransomware Broker Pleads Guilty in $15M Bitcoin Theft Case
July 13, 2026
Armenian national Karen Vardanyan pleaded guilty to enabling Ryuk ransomware attacks on U.S. organizations that yielded about 1,610 Bitcoin for
DigitalMint Employee Sentenced for BlackCat Ransomware Conspiracy
July 10, 2026
A former DigitalMint employee received 70 months in prison for conspiring with BlackCat ransomware operators while posing as a trusted
GodDamn Ransomware Uses PoisonX Driver to Kill EDR Before Encrypting
July 10, 2026
Symantec identified GodDamn ransomware using a kernel driver named PoisonX via the BYOVD technique to kill security software before file
CSE Admits Hacking Ransomware Gangs and Deleting Stolen Victim Data
July 7, 2026
Canada’s CSE confirmed offensive cyber operations against ransomware gangs, including destroying a gang’s full infrastructure and deleting stolen victim data.
JADEPUFFER: First AI-Orchestrated Ransomware Exploits Langflow RCE
July 2, 2026
Sysdig identified JADEPUFFER, the first ransomware campaign run by an LLM autonomous agent exploiting CVE-2026-33017 in Langflow to complete full
Qilin Ransomware Claims Canadian Manufacturer Chamco Industries
July 2, 2026
Qilin listed Chamco Industries on its dark web extortion portal, threatening to leak stolen data in its latest attack on
FortiBleed True Scale: 430,000 Firewalls Targeted, INC and Lynx Linked
July 2, 2026
SOCRadar confirmed FortiBleed hit 430,000 FortiGate firewalls with sniffers on 19,000 devices, linking the operation to INC Ransom and Lynx
DeepSeek Built Browser Ransomware Using Chrome File System API
July 2, 2026
Check Point researchers showed DeepSeek generated InfernoGrabber 9000, near-functional browser ransomware using Chrome’s File System Access API to encrypt files
CISA Confirms BlueHammer CVE-2026-33825 Used in Ransomware
June 30, 2026
CISA updated its KEV entry for CVE-2026-33825 to flag ransomware group exploitation of the Windows Defender privilege escalation flaw, first
Threat actors
Play Ransomware: The Shadow Syndicate
February 11, 2025
Play is a highly capable ransomware group demonstrating advanced technical skills and operational sophistication.
Dark Angels Ransomware: Sophistication & High Stakes Attacks
December 23, 2024
Overview The Dark Angels ransomware group is a sophisticated and stealthy cybercrime operation known for its targeted attacks on large
Salt Typhoon: A Chinese APT at War with the US
December 23, 2024
Salt Typhoon is considered an advanced persistent threat (APT) actor, reportedly operated by the Chinese government.
RansomHub Ransomware – A RaaS Syndicate
December 23, 2024
RansomHub operates as a Ransomware-as-a-Service (RaaS), providing infrastructure and code to affiliates.
Ryuk Ransomware: A Big Game Hunting Cyberthreat
December 6, 2024
Ryuk operates under a RaaS model, meaning the developers provide the ransomware to other cybercriminals who then carry out the
Lazarus Ransomware Group – The North Korean Cyber Menace
December 6, 2024
Lazarus Group is a highly sophisticated and adaptable APT group with a diverse range of targets and objectives.
FIN11 – A Critical Healthcare Cyberthreat
November 6, 2024
FIN11, also known as DEV-0950, Lace Tempest, TA505, TEMP.Warlock, and UNC902, is a cybercrime group that has been conducting financially-motivated
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.