Ransomware

Cybersecurity
APT73 Bashe Ransomware Claims Armenia’s Ministry of Internal Affairs
APT73 (Bashe), a LockBit-linked RaaS, posted Armenia's elections.mia.gov.am as a victim, threatening voter registration and electoral administration data.
Cybersecurity
Sophos: AI Ransomware Toolkit Uses Claude Opus 4.5 for EDR Evasion
Sophos discovered a criminal ransomware framework using Claude Opus 4.5 and multi-agent AI pipelines to build and test 80 evasion-optimized malware modules.
Cybersecurity
TheGentlemen Ransomware Lists US Water Utility Suburban Water
TheGentlemen ransomware posted Suburban Water, a US critical infrastructure water utility, among 14 victims across five sectors in a 46-minute window.
Cybersecurity
ShadowByt3$ Ransomware Hits Syngenta’s Cropwise Platform
ShadowByt3$ ransomware claims unauthorized access to Cropwise, Syngenta's precision agriculture platform, stealing GIS data, yield models, and API keys.
Cybersecurity
PureLogs Infostealer Uses MSBuild.exe for Fileless Deployment
FortiGuard Labs documents PureLogs infostealer delivered via fake purchase order emails, using MSBuild.exe process hollowing to execute entirely in memory.
Cybersecurity
Play Ransomware Claims US Telecom Hightower Communications
Play ransomware has listed Hightower Communications on its dark web leak site, marking the second US telecom claimed by the group within a ten-day period.
Cybersecurity
Play Ransomware Claims US Telecom Hightower Communications
Play ransomware has listed Hightower Communications on its dark web leak site, marking the second US telecom claimed by the group within a ten-day period.
Cybersecurity
ShadowByt3$ Ransomware Hits Syngenta’s Cropwise Platform
ShadowByt3$ ransomware claims unauthorized access to Cropwise, Syngenta's precision agriculture platform, stealing GIS data, yield models, and API keys.
Cybersecurity
TheGentlemen Ransomware Lists US Water Utility Suburban Water
TheGentlemen ransomware posted Suburban Water, a US critical infrastructure water utility, among 14 victims across five sectors in a 46-minute window.
Cybersecurity
Play Ransomware Lists MyPillow, US Telecom in Six-Victim Batch
Play ransomware listed six victims on May 25, led by consumer brand MyPillow and a US telecom provider, in a multi-sector batch spanning four countries.

Threat actors