Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

upguard

Ransomware Inc: Decoding the RaaS Business Model

Apr 30, 2025 By Leah Sadoian In UpGuard
When you hear the word “ransomware,” many people think of a lone hacker launching a complex cyberattack. However, ransomware attacks that paralyze businesses worldwide have evolved into the product of a highly organized, industrialized criminal ecosystem. Their secret weapon? Ransomware-as-a-Service, or RaaS.
Read Post
tripwire

The Growing Threat of Ransomware-as-a-Service (RaaS) on Healthcare Infrastructure

Apr 30, 2025 By Guest Authors In Tripwire
According to the 2024 State of Ransomware report by Sophos, there was a 500% increase in ransom bills in the last 12 months. Moreover, an analysis by Comparitech revealed 181 confirmed ransomware incidents targeting healthcare providers in 2024, with 25.6 million records compromised. Meanwhile, there were 42 more confirmed attacks on healthcare organizations not involved in direct care provision. These additional attacks amounted to over 115 million compromised records.
Read Post
tripwire

The Growing Threat of Ransomware to the Manufacturing Sector

Apr 29, 2025 By Kirsten Doyle In Tripwire
Ransomware has evolved from a distant “I hope it doesn’t happen to us” threat to an insidious, worldwide crisis. Among the sectors most affected is manufacturing, which has found itself more and more in attackers’ crosshairs. Manufacturing has long viewed itself as immune to digital crime, but ransomware attackers have belied this belief.
Read Post
Arctic Wolf

The Dangers of Double and Triple Extortion in Ransomware Attacks

Apr 29, 2025 By Sule Tatar In Arctic Wolf
In the summer of 2024, a Russian ransomware gang launched an attack on a UK pathology services provider. However, the group didn’t just encrypt the organization’s data and demand a ransom. It exfiltrated data from more than 300 million patient interactions with the National Health Service (NHS), and when the victim organization refused to pay the hefty ransom, the group released all the stolen data on the dark web.
Read Post
bdrsuite

Top Endpoint Protection Tools for MSPs to Stop Ransomware in 2025

Apr 29, 2025 By Evangelin Sebattini In BDRSuite
For Managed Service Providers (MSPs), ransomware attacks aren’t just a security issue, they’re a business-killing risk. In 2020, the average cost of downtime caused by ransomware was $274,200 — nearly double what it was the year before. Now, imagine you’re an MSP responsible for multiple clients, each relying on your service for their critical operations.
Read Post
kroll

The Rapid Evolution of CLEARFAKE Delivery

Apr 29, 2025 By Kroll In Kroll
Kroll continues to observe widespread attempted initial access through CLEARFAKE via fake CAPTCHA pop-ups across a wide range of industry sectors. As detailed in previous Kroll reporting, CLEARFAKE is a malicious in-browser JavaScript framework deployed on compromised webpages as part of drive-by compromise campaigns. Although CLEARFAKE continues to show the same themes surrounding its use alongside fake CAPTCHA pop-ups, there are also a wide range of nuances that have appeared in the past few months.
Read Post
Raising the Security Bar: Essential Measures to Combat Emerging Cyber Threats

Raising the Security Bar: Essential Measures to Combat Emerging Cyber Threats

Apr 29, 2025 By SecuritySenses In SecuritySenses
Cyber threats are evolving all the time, and the pace of advancement is increasing. From malware and ransomware attacks to increasingly sophisticated phishing techniques and zero-day exploits, threat actors are constantly working to find new ways to breach our defenses, so we need to take proactive steps to raise security standards and keep our organizations on the front foot in the fight against cybercrime. In this piece, we'll discuss some essential measures you can take to do this, highlighting best practices and security technologies that can enable you to build a more threat-resilient organization.
Read Post

Ep 7: Everything Everywhere All At Once

Apr 28, 2025 By Rubrik In Rubrik
The General Manager of an electric and water utility in Littleton, Mass. gets a surprise call from the FBI. At first he suspects the caller is a spammer, but soon he learns the agent is very real. Chinese hackers are lurking deep in his utility’s systems. And his is not the only one. Hundreds of other power, water and pipeline operations across the United States are getting hit. These targets have little to no intelligence value at all. But their potential for sabotage? Enormous.
View Video
Trustwave

Essential Strategies for HIPAA Compliance and Ransomware Resilience

Apr 28, 2025 By Trustwave In Trustwave
Neglecting regulatory compliance obligations, whether intentional or not, is not just a procedural error but a direct invitation for significant financial penalties, operational disruption, and, in the case of a healthcare organization, creating a potentially life-threatening situation. These consequences were recently illustrated by the US Department of Health and Human Services (HHS), Office for Civil Rights (OCR).
Read Post
knowbe4

Social Engineering Campaign Abuses Zoom to Install Malware

Apr 25, 2025 By Stu Sjouwerman In KnowBe4
A social engineering campaign is abusing Zoom's remote control feature to take control of victims’ computers and install malware, according to researchers at security firm Trail of Bits. The operation targeted Trail of Bits’ CEO, who recognized it as malicious and didn’t fall for the attack. The researchers have attributed the campaign to the ELUSIVE COMET threat actor.
Read Post
Trustwave

FBI 2024 IC3 Report: Phishing Soars, Ransomware Batters Critical Infrastructure as Cyber Losses Climb

Apr 25, 2025 By Trustwave In Trustwave
The Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center issued the 25th edition of its annual report this month, again noting a jump in complaints and losses from phishing, ransomware, and data breaches among the leading cyber threats. Overall, the FBI’s 2024 IC3 reported $16.6 billion in losses, up from $12.5 billion in 2023, on 859,532 complaints received. This figure was down slightly from the 880,418 complaints received in 2023.
Read Post
knowbe4

Warning: Ransomware Remains a Top Threat for SMBs

Apr 23, 2025 By Stu Sjouwerman In KnowBe4
A new report from Sophos found that ransomware attacks accounted for over 90% of incident response cases involving medium-sized businesses in 2024, as well as 70% of cases involving small businesses. “While the overall number of incidents in 2024 was slightly down—in part because of better defenses and the disruption of some major ransomware-as-a-service operators—ransomware-related crime is not fading away,” Sophos says.
Read Post
cyberint

Is SafePay Ransomware Safe?

Apr 23, 2025 By Adi Bleih In Cyberint
Safepay is a newcomer to the ransomware landscape. Since its first published attack in October 2024, the group has attacked over 50 organizations worldwide. SafePay maintains a dark web blog and a presence on the TON network for victim communications. The group employs the increasingly common double extortion model, combining data encryption with the theft of sensitive information to pressure victims into payment.
Read Post

The State of Data Security: A Distributed Crisis

Apr 23, 2025 By Rubrik In Rubrik
Welcome to the Data Security Decoded podcast by Rubrik Zero Labs. In this episode, our host Caleb Tolin speaks with Joe Hladik, a veteran security expert with two decades of experience, to explore the evolving landscape of cybersecurity, incident response, and the critical challenges of data security in today's distributed environments.
View Video
How to Protect Your Contact Center from Cyber Threats in 2025

How to Protect Your Contact Center from Cyber Threats in 2025

Apr 22, 2025 By SecuritySenses In SecuritySenses
It's no secret that today's contact centers and call centers aren't just customer service hubs. Many contact centers operate in highly regulated industries, such as finance or healthcare, which means they are constantly dealing with vast amounts of sensitive customer data, including personally identifiable information (PII), confidential business information, and payment details.
Read Post
tripwire

APT Rogues' Gallery: The World's Most Dangerous Cyber Adversaries

Apr 16, 2025 By Kirsten Doyle In Tripwire
Advanced Persistent Threat (APT) groups are not a new scourge. These sophisticated, state-sponsored cyber adversaries, with deep pockets and highly advanced technical skills, conduct prolonged and targeted attacks to infiltrate networks, exfiltrate sensitive data, and disrupt critical infrastructure.
Read Post
foresiet

NetSupport RAT Malware: VM Evasion & Self-Deletion Tactics

Apr 15, 2025 By Foresiet In Foresiet
Researchers at Foresiet have analyzed a Remote Access Trojan (RAT) known as NetSupport Manager. Originally developed as a legitimate remote access and IT support tool, NetSupport Manager has a history spanning over two decades. It provides features such as file transfer, remote desktop sharing, chat support, screen monitoring, and inventory tracking. However, in recent years, threat actors have increasingly weaponized this tool in malicious campaigns.
Read Post
WatchGuard

Key Takeaways from the Latest ISR: More Malware, and Harder to Detect

Apr 15, 2025 By Corey Nachreiner In WatchGuard
Malware hasn’t just increased—it’s become harder to detect. Evasive techniques are reshaping the threat landscape and pushing traditional security models to their limits. Today’s advanced malware campaigns are consistently slipping past multiple layers of defense—from email and network to endpoints—challenging even the most robust infrastructures.
Read Post
Trustwave

Proton66 Part 1: Mass Scanning and Exploit Campaigns

Apr 14, 2025 By Pawel Knapczyk, Dawid Nesterowicz In Trustwave
Trustwave SpiderLabs continuously tracks a range of malicious activities originating from Proton66 ASN, including vulnerability scanning, exploit attempts, and phishing campaigns leading to malware infections. In this two-part series, SpiderLabs explores the malicious traffic associated with Proton66, revealing the extent and nature of these attacks.
Read Post

Ep 6: The Gunslingers

Apr 14, 2025 By Rubrik In Rubrik
During China’s pseudo-cyber-hiatus, the PRC’s hacking operations get a major overhaul. CCP leadership moves responsibility away from the sloppy, brazen hackers at the People’s Liberation Army to the far more stealthy, and strategic, Ministry of State Security. Gone are the “most polite” hackers in the digital world. Here to stay are the gunslingers – the elite of the elite in their field. In Episode 6, host and former New York Times cybersecurity reporter, Nicole Perlroth lays out what it looked like as China’s hackers went underground… and what we missed in Eastern Europe as they did.
View Video
tripwire

Ransomware Reaches A Record High, But Payouts Are Dwindling

Apr 11, 2025 By Graham Cluley In Tripwire
Shed a tear, if you can, for the poor, misunderstood cybercriminals hard at work trying to earn a dishonest crust by infecting organisations with ransomware. Newly released research has revealed that the riches to be made from encrypting a company's data and demanding a ransom are not proving so easy to come by as they once were. Because, although the number of ransomware attacks are reported to have reached record-breaking heights in the first months of 2025, gangs' profits are thought to be plummeting.
Read Post
New WatchGuard Threat Lab Report Discovers 94% Increase in Network Malware as Cybercriminals Exploit Advanced, Encrypted Connections

New WatchGuard Threat Lab Report Discovers 94% Increase in Network Malware as Cybercriminals Exploit Advanced, Encrypted Connections

Apr 10, 2025 By WatchGuard In WatchGuard
Other key findings show an increase in crypto miner detections, a spike in zero-day malware, a drop in endpoint malware, a rise in Linux-based threats, and more.
Read Post
foresiet

Chinese APT Exploits Ivanti CVE-2025-22457 with Malware

Apr 10, 2025 By Foresiet In Foresiet
A newly disclosed vulnerability in Ivanti Connect Secure (ICS) VPN appliances has been weaponized in the wild by a Chinese nation-state threat actor, UNC5221. Tracked as CVE-2025-22457, this critical stack-based buffer overflow vulnerability allows unauthenticated remote attackers to execute arbitrary code, posing a significant risk to enterprise networks.
Read Post
knowbe4

64% of Australian Organizations Hit by Ransomware Were Forced to Halt Operations

Apr 10, 2025 By Stu Sjouwerman In KnowBe4
Illumio’s recent Global Cost of Ransomware Study found that 64% of Australian companies hit by ransomware had to shut down operations as a result. Additionally, 43% of these organizations reported a significant loss of revenue, and 39% lost customers as a result of an attack. Most respondents indicated that reputational damage has overtaken regulatory fees as the most costly effect of a ransomware attack.
Read Post
Trustwave

Tycoon2FA New Evasion Technique for 2025

Apr 10, 2025 By Phil Hay, Rodel Mendrez In Trustwave
The Tycoon 2FA phishing kit has adopted several new evasion techniques aimed at slipping past endpoints and detection systems. These include using a custom CAPTCHA rendered via HTML5 canvas, invisible Unicode characters in obfuscated JavaScript, and anti-debugging scripts to thwart inspection. This blog takes a closer look at these methods to better understand how this kit is evolving and what defenders should be aware of.
Read Post

OCULAR SPIDER and the Rise of Ransomware-as-a-Service

Apr 10, 2025 By CrowdStrike In CrowdStrike
Ransomware has become more difficult for organizations to defend against, but easier for adversaries to deploy. The rise of ransomware-as-a-service (RaaS) — a model in which ransomware operators write the malware and affiliates pay to launch it — has lowered the barrier to entry so threat actors of all skill levels can participate and profit.
View Video
threatspike

Diskless Infostealer, Next-generation Delivery?

Apr 9, 2025 By Aaron Hau In ThreatSpike
In a recent social-engineering attack targeting the hospitality sector observed by the ThreatSpike team, there appears to be a change in the tactics employed by the threat actor. The hospitality sector, where top-notch customer-service is expected, customer-facing employees are often lucrative targets for phishing, as detailed in our previous blog post.
Read Post
veracode

Resurgent North Korean Malware Campaign in npm

Apr 9, 2025 By Veracode Threat Research In Veracode
Hello from the Veracode Research blog! It’s been a minute since we’ve done a malware write-up, but we’re back and ready for action! And speaking of folks who are back and ready for action, the North Korean attackers behind the crypto wallet stealer campaign we wrote about in February of 2024 and again in May of 2024 are back at it with a new batch of malicious npm packages.
Read Post
tripwire

The Cost of Ransomware: Shutdowns & Extortion

Apr 9, 2025 By Josh Breaker-Rolfe In Tripwire
Ransomware is no longer in its heyday. Evolving, AI-driven cybersecurity tools and global law enforcement efforts have seen to that. But that doesn’t mean ransomware is no longer a threat. In fact, in some ways, the danger is greater than ever. While ransomware attacks are less common than they used to be, the consequences of those that succeed are more severe. Earlier this year, the Ponemon Institute published a study revealing massive changes in the ransomware landscape.
Read Post

Data Weaponization: How Cyber Attacks Impact the Vulnerable

Apr 8, 2025 By Rubrik In Rubrik
Welcome to the Data Security Decoded podcast by Rubrik Zero Labs. In this episode, our host Caleb Tolin speaks with Pavlina Pavlova, a researcher and cybersecurity advocate focusing on data weaponization and its disproportionate impact on vulnerable populations. Pavlina defines data weaponization as using data to manipulate, deceive, coerce, or attack someone to inflict harm. Her research investigates why cyber attacks and their impacts often have gendered dimensions, with certain populations experiencing more severe consequences.
View Video
Trustwave

Inside Black Basta: Uncovering the Secrets of a Ransomware Powerhouse

Apr 8, 2025 By Serhii Melnyk and Nikita Kazymirskyi In Trustwave
In February 2025, the cybersecurity community witnessed an unprecedented leak that exposed the internal operations of Black Basta, a prolific ransomware group. Trustwave SpiderLabs has taken an in-depth look at the leaked contents, which spell out in detail how the group thinks and operates, revealing discussions on tactics and the effectiveness of various attack tools. Even going so far as to debate the ethical and legal implications of targeting Ascension Health.
Read Post

Ep 5: A Cyber Detente

Apr 7, 2025 By Rubrik In Rubrik
Every U.S. administration, dating back to President H.W. Bush has struggled to address the threat of Chinese trade theft. But a growing sense of urgency kicks in as American businesses start hemorrhaging trade secrets and entire product lines start vanishing to Chinese copycats. Just as the Obama Administration is set to do something about it, Edward Snowden shifts the narrative back onto the United States.
View Video
netskope

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

Apr 4, 2025 By Leandro Fróes In Netskope
Starting February 2025, Netskope Threat Labs has tracked and reported on multiple phishing and malware campaigns targeting victims searching for PDF documents on search engines. Once they open the PDFs, the attackers employ various techniques to direct these victims to malicious websites or trick them into downloading malware.
Read Post
cyjax

A DLS EMERGEncy! - Record breaking extortion group DLS emergence in 2025

Apr 4, 2025 By Adam Price In CYJAX
As the threat landscape continues to develop, ransomware and data broker groups constantly emerge, develop, and disband. Cyjax has observed a significant number of new data-leak sites (DLS) emerge in March 2025, with a total of 14 new sites. This is the highest observed number of extortion groups which have emerged in a single month. The second highest number was observed in September 2022, when 10 data-leak sites emerged. Overall, 21 DLSs have been identified in 2025 so far.
Read Post
foresiet

CoffeeLoader Malware: The Advanced Threat Evading Detection

Apr 4, 2025 By Foresiet In Foresiet
The virtual world is ever-changing, as are the cybercriminals who continue to evolve in order to circumvent even the strongest security systems. The newest threat to hit the headlines is CoffeeLoader—a second-stage payload dropper designed to bypass endpoint security tools, digital forensic tools, and EDR (Endpoint Detection and Response) tools.
Read Post
foresiet

Inside Anubis Ransomware: Tactics, Impact & Protection

Apr 4, 2025 By Foresiet In Foresiet
Recently, a new ransomware group, Anubis, has emerged, making its presence known on Twitter. The Foresiet Threat Intel team monitored their activity and observed a new ransomware operation being advertised on their account. The group updated their profile picture and began posting about their latest breaches. Through analysis of their communication patterns and language, Foresiet has determined that the operators behind Anubis likely belong to a Russian-speaking threat group.
Read Post
Internxt

Does Cloud Backup Protect Against Ransomware?

Apr 3, 2025 By Internxt In Internxt
As of 2024, 75 active ransomware groups targeted healthcare industries, businesses, and individuals with the aim of threatening these individuals with data loss or leaks in return for large payouts to decrypt this data. Many security organizations and cybersecurity experts are fighting to prevent ransomware from becoming common. One question on the minds of many people related to this topic is: Does cloud backup protect against ransomware?
Read Post
tripwire

HellCat Ransomware: What You Need To Know

Apr 3, 2025 By Graham Cluley In Tripwire
HellCat is the name of a relatively new ransomware-as-a-service (RaaS) group that first came to prominence in the second half of 2024. Like many other ransomware operations, HellCat breaks into organisations, steals sensitive files, and encrypts computer systems - demanding a ransom payment for a decryption key and to prevent the leaking of stolen files.
Read Post
knowbe4

Malicious Memes: How Cybercriminals Use Humor to Spread Malware

Apr 3, 2025 By Erich Kron In KnowBe4
Internet memes and viral content have become a universal language of online culture. They're easily shareable, often humorous, and can spread rapidly across various platforms. However, this same virality and cultural resonance make memes an attractive vector for cybercriminals and threat actors. Anatomy of a meme Memes are nothing new, and have been around for decades. In fact, a comic published in 1921 followed one of today's most common meme themes: ‘Expectation vs.
Read Post
aikido

Hide and Fail: Obfuscated Malware, Empty Payloads, and npm Shenanigans

Apr 3, 2025 By Willem Delbare In Aikido
‍ On March 14th 2025, we detected a malicious package on npm called node-facebook-messenger-api. At first, it seemed to be pretty run-of-the-mill malware, though we couldn’t tell what the end-goal was. We didn’t think much more of it until April 3rd 2025, when we see the same threat actor expand their attack.
Read Post
exabeam

Using the MITRE ATT&CK Framework to Boost Ransomware Defenses

Apr 2, 2025 By Exabeam
Two variants of Ransomware as a Service (RaaS) - REvil and Conti - are behind some of the most widespread and successful cyberattacks today. Don't let these ransomware attacks siege your operations. Download this white paper to learn how to use the MITRE ATT&CK Framework to improve your security posture, plus discover insightful tactics, techniques, and procedures (TTPs) used by REvil and Conti.
Get White Paper

Master Advanced Threat Investigation: Forensic Analysis with Cato Sandbox

Apr 1, 2025 By Cato Networks In Cato Networks
In this video, we walk you through how Cato Networks' anti-malware and NextGen anti-malware solutions block both known and unknown threats in real time—*before* they can spread. But stopping malware is only the beginning. Learn how Cato Sandbox takes your cybersecurity strategy to the next level by: We’ll show you how to quickly enable Cato Sandbox, demonstrate real-time malware blocking, and explore a full forensic analysis via the Cato Management Application (CMA). Watch as we break down.
View Video
Trustwave

Babuk2 Bjorka: The Evolution of Ransomware for 'Data Commoditization'

Apr 1, 2025 By John Basmayor In Trustwave
An investigation that started with a tip from one of our threat intel sources about the revival of the Babuk (figure 1) threat group has led Trustwave SpiderLabs to uncover what appears to be a paradigm shift in the ransomware landscape. Figure 1. SpiderLabs telemetry (January 2025 events). Figure 1A. February to March events. Figure 1B. SpiderLabs telemetry (March 2025 events).
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.