cyber security
Kimsuky Uses Quasar RAT to Deploy Funhouse Ransomware Through Multi-Stage Scripts
A Kimsuky campaign that delivers Funhouse ransomware through a malicious Hangul document disguised as a resume.
The operation combines embedded OLE objects, sequential scripts,...
cyber security
Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks
A Russian-speaking Gentlemen ransomware affiliate used the Model Context Protocol (MCP) to execute commands during live intrusions, turning an AI coding assistant’s tool interface...
Cyber Security News
16-Year-Old Suspected KillSec Ransomware Leader Arrested in International Operation
International law enforcement authorities have arrested three suspects linked to the KillSec ransomware group, including a 16-year-old who is alleged to be the operation's...
Cyber Security News
Keio Railway Confirms Ransomware Attack Disrupted Business Systems
Keio Corporation has confirmed that a ransomware attack has caused a system failure within parts of its group infrastructure, disrupting certain business systems at...
cyber security
New Galago Ransomware Operation Emerges With Links to Panzer Extortion Group
A newly identified ransomware operation tracked as Galago has emerged with apparent operational links to the Panzer ransomware group, raising concerns of an expanding...
Cyber Security News
PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain
A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on...
cyber security
Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware
Feral Wolf has expanded its ransomware tradecraft by abusing exposed Atlassian Confluence servers and insecure 1C:Enterprise deployments to gain access to Russian corporate networks...
cyber security
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
A newly observed ransomware operation dubbed SETTRA is abusing the legitimate MeshAgent remote monitoring and management platform for persistence while using recovery-inhibition and defense-evasion...