Six Ransomware Groups Post Cross-Sector Victims in Single Day
June 8, 2026
Play, Genesis, Nova, Incransom, Blackwater, and Krybit each posted victims on the same day, spanning automotive, dental, higher education, travel,
Ransomware
Six Ransomware Groups Post Cross-Sector Victims in Single Day
Play, Genesis, Nova, Incransom, Blackwater, and Krybit each posted victims on the same day, spanning automotive, dental, higher education, travel, and retail.
Payload Ransomware Hits Retailer, Textile Firm, and Hotel Group
Payload ransomware posted Plaza Lama, Hansoll Textile, and Villea Hotels on its Tor leak site, targeting the Dominican Republic, Vietnam, and Malaysia.
CoinbaseCartel Ransomware Targets Cambridge Mobile Telematics
CoinbaseCartel posted Cambridge Mobile Telematics on its dark web leak site, threatening to expose driving behavior data for millions of insured drivers.
Anubis Ransomware Wiper Mode Targets US Law Firm and UK Contractor
Anubis ransomware used its WIPEMODE against a US estate law firm and UK contractor; Nova claimed an Indian hospital and Securotrop hit Kriete Truck Centers.
Play Ransomware Hits Law Firm, Food Tech, Church, and Factory
Play ransomware posted four US victims in a single day: a food processing manufacturer, a law firm, a religious organization, and a manufacturing company.
Akira Threatens to Publish 53 GB from US Parts Maker and Ohio MLS
Akira ransomware posted National Standard Parts Associates and Northern Ohio Regional MLS, threatening 53 GB of employee records, contracts, and financial data.
Qilin Ransomware Hits Avcon Jet, Slovenian Food Group, and Trican
Qilin ransomware posted Avcon Jet, SKUPINA Don Don, and Trican in a three-country sweep targeting private aviation, food retail, and Canadian oilfield services.
TheGentlemen Hits Saudi Arabia, India, Thailand, and Portugal
TheGentlemen ransomware struck Saudi Arabia, India, Thailand, and Portugal in one day, including a first GCC target, as the group exceeds 330 victims in 2026.
WorldLeaks Targets Thai Infrastructure Giant CH Karnchang
WorldLeaks claimed CH Karnchang, Thailand's major infrastructure builder, and United Auto Supply in a pure data extortion operation with no file encryption.
OFAC Sanctions Nobitex, Iran’s Largest Crypto Exchange
OFAC sanctioned Nobitex and three companion Iranian crypto exchanges for facilitating IRGC transactions and converting ransomware proceeds into usable funds.
Payload Ransomware Hits Retailer, Textile Firm, and Hotel Group
June 8, 2026
Payload ransomware posted Plaza Lama, Hansoll Textile, and Villea Hotels on its Tor leak site, targeting the Dominican Republic, Vietnam,
CoinbaseCartel Ransomware Targets Cambridge Mobile Telematics
June 8, 2026
CoinbaseCartel posted Cambridge Mobile Telematics on its dark web leak site, threatening to expose driving behavior data for millions of
Anubis Ransomware Wiper Mode Targets US Law Firm and UK Contractor
June 8, 2026
Anubis ransomware used its WIPEMODE against a US estate law firm and UK contractor; Nova claimed an Indian hospital and
Play Ransomware Hits Law Firm, Food Tech, Church, and Factory
June 5, 2026
Play ransomware posted four US victims in a single day: a food processing manufacturer, a law firm, a religious organization,
Akira Threatens to Publish 53 GB from US Parts Maker and Ohio MLS
June 5, 2026
Akira ransomware posted National Standard Parts Associates and Northern Ohio Regional MLS, threatening 53 GB of employee records, contracts, and
Qilin Ransomware Hits Avcon Jet, Slovenian Food Group, and Trican
June 5, 2026
Qilin ransomware posted Avcon Jet, SKUPINA Don Don, and Trican in a three-country sweep targeting private aviation, food retail, and
TheGentlemen Hits Saudi Arabia, India, Thailand, and Portugal
June 5, 2026
TheGentlemen ransomware struck Saudi Arabia, India, Thailand, and Portugal in one day, including a first GCC target, as the group
WorldLeaks Targets Thai Infrastructure Giant CH Karnchang
June 5, 2026
WorldLeaks claimed CH Karnchang, Thailand’s major infrastructure builder, and United Auto Supply in a pure data extortion operation with no
OFAC Sanctions Nobitex, Iran’s Largest Crypto Exchange
June 4, 2026
OFAC sanctioned Nobitex and three companion Iranian crypto exchanges for facilitating IRGC transactions and converting ransomware proceeds into usable funds.
Threat actors
Play Ransomware: The Shadow Syndicate
February 11, 2025
Play is a highly capable ransomware group demonstrating advanced technical skills and operational sophistication.
Dark Angels Ransomware: Sophistication & High Stakes Attacks
December 23, 2024
Overview The Dark Angels ransomware group is a sophisticated and stealthy cybercrime operation known for its targeted attacks on large
Salt Typhoon: A Chinese APT at War with the US
December 23, 2024
Salt Typhoon is considered an advanced persistent threat (APT) actor, reportedly operated by the Chinese government.
RansomHub Ransomware – A RaaS Syndicate
December 23, 2024
RansomHub operates as a Ransomware-as-a-Service (RaaS), providing infrastructure and code to affiliates.
Ryuk Ransomware: A Big Game Hunting Cyberthreat
December 6, 2024
Ryuk operates under a RaaS model, meaning the developers provide the ransomware to other cybercriminals who then carry out the
Lazarus Ransomware Group – The North Korean Cyber Menace
December 6, 2024
Lazarus Group is a highly sophisticated and adaptable APT group with a diverse range of targets and objectives.
FIN11 – A Critical Healthcare Cyberthreat
November 6, 2024
FIN11, also known as DEV-0950, Lace Tempest, TA505, TEMP.Warlock, and UNC902, is a cybercrime group that has been conducting financially-motivated
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.