Nova, Stormous, and Akira Target European Organizations
June 10, 2026
Nova claimed Trevi S.p.A., Stormous listed a Dutch Catholic group, and Akira hit a French ambulatory clinic in coordinated European
Ransomware
Nova, Stormous, and Akira Target European Organizations
Nova claimed Trevi S.p.A., Stormous listed a Dutch Catholic group, and Akira hit a French ambulatory clinic in coordinated European ransomware postings.
Akira Claims Industrial Finisher, NJ Country Club, Architecture Firm
Akira ransomware posted three US victims on June 9: Spray Equipment with 26GB of W-2 records and engineering drawings, Rockaway River Country Club, and SMPC ...
Chaos Ransomware Lists Airespring as Iranian False-Flag History Looms
Chaos ransomware listed US telecom provider Airespring on its leak site. Rapid7 documented Chaos as a MuddyWater Iranian APT false-flag tool, complicating attribution.
Check Point VPN CVE-2026-50751 Exploited by Qilin Before Patch Release
Check Point disclosed CVE-2026-50751, a critical VPN authentication bypass exploited by Qilin ransomware for five weeks, and released an emergency hotfix.
TheGentlemen Ransomware Posts 12 Victims in One Day Across 8 Countries
TheGentlemen ransomware posted 12 victims across 8 countries in one day, including two healthcare providers with HIPAA and NHS breach notification exposure.
Akira, Qilin, and Nightspire Post 4 Victims on Ransomware Leak Sites
Akira, Qilin, and Nightspire claimed four victims including a port trade association, a German security firm, a youth nonprofit, and a commercial printer.
ShinyHunters Publishes 234 GB of DentaQuest Records for 2.6M
ShinyHunters published 234 GB of DentaQuest healthcare records for 2.6 million patients after ransom talks failed, exposing Medicaid IDs and enrollment data.
Six Ransomware Groups Post Cross-Sector Victims in Single Day
Play, Genesis, Nova, Incransom, Blackwater, and Krybit each posted victims on the same day, spanning automotive, dental, higher education, travel, and retail.
Payload Ransomware Hits Retailer, Textile Firm, and Hotel Group
Payload ransomware posted Plaza Lama, Hansoll Textile, and Villea Hotels on its Tor leak site, targeting the Dominican Republic, Vietnam, and Malaysia.
CoinbaseCartel Ransomware Targets Cambridge Mobile Telematics
CoinbaseCartel posted Cambridge Mobile Telematics on its dark web leak site, threatening to expose driving behavior data for millions of insured drivers.
Akira Claims Industrial Finisher, NJ Country Club, Architecture Firm
June 10, 2026
Akira ransomware posted three US victims on June 9: Spray Equipment with 26GB of W-2 records and engineering drawings, Rockaway
Chaos Ransomware Lists Airespring as Iranian False-Flag History Looms
June 10, 2026
Chaos ransomware listed US telecom provider Airespring on its leak site. Rapid7 documented Chaos as a MuddyWater Iranian APT false-flag
Check Point VPN CVE-2026-50751 Exploited by Qilin Before Patch Release
June 9, 2026
Check Point disclosed CVE-2026-50751, a critical VPN authentication bypass exploited by Qilin ransomware for five weeks, and released an emergency
TheGentlemen Ransomware Posts 12 Victims in One Day Across 8 Countries
June 9, 2026
TheGentlemen ransomware posted 12 victims across 8 countries in one day, including two healthcare providers with HIPAA and NHS breach
Akira, Qilin, and Nightspire Post 4 Victims on Ransomware Leak Sites
June 9, 2026
Akira, Qilin, and Nightspire claimed four victims including a port trade association, a German security firm, a youth nonprofit, and
ShinyHunters Publishes 234 GB of DentaQuest Records for 2.6M
June 8, 2026
ShinyHunters published 234 GB of DentaQuest healthcare records for 2.6 million patients after ransom talks failed, exposing Medicaid IDs and
Six Ransomware Groups Post Cross-Sector Victims in Single Day
June 8, 2026
Play, Genesis, Nova, Incransom, Blackwater, and Krybit each posted victims on the same day, spanning automotive, dental, higher education, travel,
Payload Ransomware Hits Retailer, Textile Firm, and Hotel Group
June 8, 2026
Payload ransomware posted Plaza Lama, Hansoll Textile, and Villea Hotels on its Tor leak site, targeting the Dominican Republic, Vietnam,
CoinbaseCartel Ransomware Targets Cambridge Mobile Telematics
June 8, 2026
CoinbaseCartel posted Cambridge Mobile Telematics on its dark web leak site, threatening to expose driving behavior data for millions of
Threat actors
Play Ransomware: The Shadow Syndicate
February 11, 2025
Play is a highly capable ransomware group demonstrating advanced technical skills and operational sophistication.
Dark Angels Ransomware: Sophistication & High Stakes Attacks
December 23, 2024
Overview The Dark Angels ransomware group is a sophisticated and stealthy cybercrime operation known for its targeted attacks on large
Salt Typhoon: A Chinese APT at War with the US
December 23, 2024
Salt Typhoon is considered an advanced persistent threat (APT) actor, reportedly operated by the Chinese government.
RansomHub Ransomware – A RaaS Syndicate
December 23, 2024
RansomHub operates as a Ransomware-as-a-Service (RaaS), providing infrastructure and code to affiliates.
Ryuk Ransomware: A Big Game Hunting Cyberthreat
December 6, 2024
Ryuk operates under a RaaS model, meaning the developers provide the ransomware to other cybercriminals who then carry out the
Lazarus Ransomware Group – The North Korean Cyber Menace
December 6, 2024
Lazarus Group is a highly sophisticated and adaptable APT group with a diverse range of targets and objectives.
FIN11 – A Critical Healthcare Cyberthreat
November 6, 2024
FIN11, also known as DEV-0950, Lace Tempest, TA505, TEMP.Warlock, and UNC902, is a cybercrime group that has been conducting financially-motivated
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.