Nova Ransomware Apologizes for CIS Rule Violation, Bans Affiliate
June 3, 2026
Nova ransomware publicly apologized and banned an affiliate for attacking Eriell Group, an Uzbekistan oilfield firm, violating the CIS safe
Ransomware
Nova Ransomware Apologizes for CIS Rule Violation, Bans Affiliate
Nova ransomware publicly apologized and banned an affiliate for attacking Eriell Group, an Uzbekistan oilfield firm, violating the CIS safe harbor rule.
Qilin Ransomware Claims Six Victims Across Five Countries in Two Days
Qilin ransomware posted six victims across five countries over two days, including Nova Medical Products and MEISA Sines at Portugal's Sines energy port.
APT73 Bashe Ransomware Claims Armenia’s Ministry of Internal Affairs
APT73 (Bashe), a LockBit-linked RaaS, posted Armenia's elections.mia.gov.am as a victim, threatening voter registration and electoral administration data.
Sophos: AI Ransomware Toolkit Uses Claude Opus 4.5 for EDR Evasion
Sophos discovered a criminal ransomware framework using Claude Opus 4.5 and multi-agent AI pipelines to build and test 80 evasion-optimized malware modules.
TheGentlemen Ransomware Lists US Water Utility Suburban Water
TheGentlemen ransomware posted Suburban Water, a US critical infrastructure water utility, among 14 victims across five sectors in a 46-minute window.
ShadowByt3$ Ransomware Hits Syngenta’s Cropwise Platform
ShadowByt3$ ransomware claims unauthorized access to Cropwise, Syngenta's precision agriculture platform, stealing GIS data, yield models, and API keys.
PureLogs Infostealer Uses MSBuild.exe for Fileless Deployment
FortiGuard Labs documents PureLogs infostealer delivered via fake purchase order emails, using MSBuild.exe process hollowing to execute entirely in memory.
Play Ransomware Claims US Telecom Hightower Communications
Play ransomware has listed Hightower Communications on its dark web leak site, marking the second US telecom claimed by the group within a ten-day period.
Play Ransomware Claims US Telecom Hightower Communications
Play ransomware has listed Hightower Communications on its dark web leak site, marking the second US telecom claimed by the group within a ten-day period.
ShadowByt3$ Ransomware Hits Syngenta’s Cropwise Platform
ShadowByt3$ ransomware claims unauthorized access to Cropwise, Syngenta's precision agriculture platform, stealing GIS data, yield models, and API keys.
Qilin Ransomware Claims Six Victims Across Five Countries in Two Days
June 3, 2026
Qilin ransomware posted six victims across five countries over two days, including Nova Medical Products and MEISA Sines at Portugal’s
APT73 Bashe Ransomware Claims Armenia’s Ministry of Internal Affairs
June 3, 2026
APT73 (Bashe), a LockBit-linked RaaS, posted Armenia’s elections.mia.gov.am as a victim, threatening voter registration and electoral administration data.
Sophos: AI Ransomware Toolkit Uses Claude Opus 4.5 for EDR Evasion
June 3, 2026
Sophos discovered a criminal ransomware framework using Claude Opus 4.5 and multi-agent AI pipelines to build and test 80 evasion-optimized
TheGentlemen Ransomware Lists US Water Utility Suburban Water
June 2, 2026
TheGentlemen ransomware posted Suburban Water, a US critical infrastructure water utility, among 14 victims across five sectors in a 46-minute
ShadowByt3$ Ransomware Hits Syngenta’s Cropwise Platform
June 2, 2026
ShadowByt3$ ransomware claims unauthorized access to Cropwise, Syngenta’s precision agriculture platform, stealing GIS data, yield models, and API keys.
PureLogs Infostealer Uses MSBuild.exe for Fileless Deployment
June 2, 2026
FortiGuard Labs documents PureLogs infostealer delivered via fake purchase order emails, using MSBuild.exe process hollowing to execute entirely in memory.
Play Ransomware Claims US Telecom Hightower Communications
June 2, 2026
Play ransomware has listed Hightower Communications on its dark web leak site, marking the second US telecom claimed by the
Play Ransomware Claims US Telecom Hightower Communications
June 2, 2026
Play ransomware has listed Hightower Communications on its dark web leak site, marking the second US telecom claimed by the
ShadowByt3$ Ransomware Hits Syngenta’s Cropwise Platform
June 2, 2026
ShadowByt3$ ransomware claims unauthorized access to Cropwise, Syngenta’s precision agriculture platform, stealing GIS data, yield models, and API keys.
Threat actors
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.