Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI meets ransomware: a new cyber threat

AI is powering a new wave of ransomware. Learn how Avast stopped FunkSec's attack and how you can protect your files from evolving cyber threats. Ransomware has long been one of the most feared cyber threats on the internet, and for good reason. It’s fast, disruptive, and increasingly effective at locking up your most important files and demanding payment in exchange for their return. It’s not just businesses that get hit, either.

Malicious Connectors Potentially Impact Hundreds of Millions of Microsoft 365 Users

Most Microsoft 365 users aren’t aware of this recently growing serious email threat vector. I have been teaching about the risks of Microsoft email rules, forms and connectors on email clients and servers for decades. Both can be created by an attacker learning your email address and logon credentials (e.g., password or MFA codes).

Anubis and the Death of Data: A New Era of Ransomware Operations

Ransomware activity continues to increase, and Bitsight data illustrates the scale of this growth. In our State of the Underground 2025 report, Bitsight TRACE observed a nearly 25% rise in unique ransomware victims publicly listed on leak sites. Additionally, the number of leak sites operated by ransomware groups grew by 53%.

Enterprise SAN Data Recovery: Protecting Critical Systems from Catastrophic Loss

The current world of business is a world of the digital age, where enterprise operations are greatly dependent on the constant availability of data. With the growth of organizations ' storage facilities, Storage Area Networks (SANs) have worked as the medium of fast, scalable, and reliable access to data. Nevertheless, SAN systems are pretty dangerous when they break down (be it a system hardware trouble, hacking, or human negligence), as the consequences may be disastrous.

Ransomware As A Service: Understanding the Risks

As companies invest in cybersecurity to avoid fines and ransomware payouts, criminals are doing the opposite by turning ransomware into a full-blown business. With ransomware as a service (RaaS), cybercriminals are building revenue streams by selling ransomware kits online. This model doesn’t require technical skills or deep knowledge of hacking.

AURA Stealer: A Crude Clone of LummaC2 - Technical Analysis and Threat Breakdown

AURA Stealer is a newly emerging information-stealing malware that presents itself as a streamlined alternative to more established stealer families such as LummaC2. Marketed as a carefully engineered solution, AURA is positioned by its developers as purpose-built for efficiency and results—eschewing unnecessary complexity in favor of a focused and modular design.

ToxicPanda: The Android Banking Trojan Targeting Europe

ToxicPanda is a banking trojan designed to infiltrate your mobile device, stealing financial details by targeting banking & financial apps. The malware keeps evolving, with the developers behind it being quick to add new features, such as overlaying pin & pattern codes, overlaying credential inputs for specific banking apps, allowing cybercriminals to remotely take control of compromised bank accounts and initiate unauthorized money transfers.

XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed

In September 2024, Netskope Threat Labs reported on the XWorm malware and its infection chain. We revealed new XWorm command and control (C2) commands and dissected its notable features. After nearly a year of tracking this malware, we discovered a new version (version 6.0) in the wild, which introduced new features such as process protection and enhanced anti-analysis capabilities.

Ransomware Detection and Response: Strengthening Your Cyber Resilience

In 2024, the average ransom payment surged to nearly $4 million, more than double the previous year, while over 70% of ransomware incidents involved data encryption (Source: The Latest Ransomware Statistics & Trends ). These figures underscore the growing scale and sophistication of ransomware threats. As attackers refine their tactics and target critical infrastructure, organizations must adopt a more strategic and proactive approach to detection and response.

Warning: Ransomware Attacks Surged by 63% Last Quarter

Ransomware attacks increased by 63% year-over-year in the second quarter of 2025, with a total of 276 publicly disclosed incidents, according to a new report from BlackFog. Notably, there were far more ransomware attacks that weren’t publicly disclosed. The researchers note, “The figures also reveal that the scale of hidden activity remains significant, with 80.9% of all ransomware attacks going unreported.

Top Financial Cyber Threats Facing Businesses in 2025

The world of business is facing a growing wave of cyber threats, especially when it comes to financial security. Cybercriminals are getting smarter, and their tactics are more sophisticated than ever. This isn't just a concern for big corporations; businesses of all sizes need to stay alert. A cyberattack could lead to major financial losses, damage to your reputation, or even legal headaches. In this article, we'll break down some of the top financial cyber threats businesses will likely face in 2025.

Beyond the Operating System: Ransomware in the CPU

Being alert to ransomware is nothing new. Ransomware can wreak havoc and often cause permanent damage to endpoints, unless effective recovery processes are in place. Many ransomware operators attempt to delete shadow copies and other recovery methods, which makes redundancy in recovery essential. However, the situation becomes even more serious with the emergence of microcode ransomware.

Ransomware in First Half of 2025: An Ecosystem in Flux

The first half of 2025 has been a period of disruption and realignment within the ransomware ecosystem. Following years of dominance by a few key players, the landscape has fragmented into a chaotic and highly competitive market defined by new leaders, divergent attack strategies, and a laser focus on high-pressure targets. In total, more than 3,000 ransomware incidents were recorded in the first six months of the year. The overall threat has not diminished; it has become more unpredictable.

The Rise of Acreed Infostealer in the Post-LummaC2 Threat Landscape

Acreed, a new malware-as-a-service (MaaS) platform, appears to have taken the top spot in the infostealer ecosystem. We suspect this is due to the takedown of Lumma Stealer (LummaC2) in May 2025. In just its first week, Acreed was observed uploading over 4,000 stolen credential logs to a dark web Russian Market.

Ransomware Trends in 2025

I’ve been following ransomware since the first one, the AIDS Cop Trojan, was released in December 1989. It locked up victim computers and asked for $300 to be sent to a Panama P.O. Box. A lot has changed since then. The invention of cryptocurrencies, particularly Bitcoin in January 2009, was largely responsible for the explosion of ransomware by 2013. This was when CryptoLocker ransomware was released to the world. Ransomware gangs have been making many billions of dollars per year ever since.

Cato CTRL Threat Research: Investigation of RMM Tools Leveraged by Ransomware Gangs in Real-World Incidents

Remote Monitoring and Management (RMM) tools are essential for IT operations, but their powerful capabilities and trusted status within enterprise networks have also made them valuable to threat actors. In the second half of 2024 and first quarter of 2025, we uncovered a recurring pattern during a series of cyber forensic investigations and threat detections impacting two US-based organizations and one UK-based organization.

Unmasking Malicious APKs: Android Malware Blending Click Fraud and Credential Theft

Malicious APKs (Android Package Kit files) continue to serve as one of the most persistent and adaptable delivery mechanisms in mobile threat campaigns. Threat actors routinely exploit social engineering and off-market distribution to bypass conventional security controls and capitalize on user trust to steal a variety of data, such as log in credentials.

Greedy Sponge Targets Mexico with AllaKore RAT and SystemBC

A financially-motivated threat actor, active since early 2021, has been targeting Mexican organizations with custom packaged installers that deliver a modified version of AllaKore RAT. Arctic Wolf documented 2022 and 2023 campaign samples from this unidentified threat actor in a previous report. We are now referring to this group as Greedy Sponge, due to its financial focus and prior use of a popular “SpongeBob” meme on its C2.

Different Types of Malware Explained

The internet isn’t always a safe place. Behind every click, every download, and every flashy pop-up ad, there might be something lurking that could bring down entire systems or steal sensitive information. That “something” goes by a name we’ve all heard: malware. But while the word gets used a lot, how many of us really know what it means? Or better yet, how many of us understand the different ways malware can mess with our data, our privacy, or even our businesses?

Cybersecurity Isn't Just Tech - It's a Team Culture

Cybersecurity in healthcare isn't just about firewalls and software — it's about empowering every person in the organization. From nurses to administrators, everyone needs to feel safe reporting threats and be trained continuously, not just once a year. It's time to build a human firewall — a culture where cybersecurity is everyone's responsibility. Errol Weiss breaks down how role-specific training and psychological safety can make or break your cyber defense.

New FileFix Delivery Method Used to Distribute Interlock RAT

Since at least February 2025, Arctic Wolf has observed Interlock Remote Access Trojan (RAT) being deployed via social engineering techniques. Recently, The DFIR Report published a technical analysis of the Interlock RAT being delivered via a social engineering technique dubbed “FileFix.” The name FileFix is derived from its similarity to the previously documented ClickFix technique using fake CAPTCHA pages.

Can Your Hospital Keep Running During a Cyberattack?

A cyber breach shouldn't bring critical patient care to a halt. That’s the idea behind the Minimum Viable Hospital, a model that ensures essential functions continue even under attack. Errol Weiss shares how leading healthcare systems are planning for resilience, and why smaller hospitals may struggle to keep up. He highlights how the standard response to healthcare cyberattacks overlooks the complex reality of delivering medical care. It’s time to recognize that cybersecurity isn’t just about systems, it’s about people.

KAWA4096's Ransomware Tide: Rising Threat With Borrowed Styles

KAWA4096, a ransomware whose name includes "Kawa", the Japanese word for "river", first emerged in June 2025. This new threat features a leak site that follows the style of the Akira ransomware group, and a ransom note format similar to Qilin’s, likely an attempt to further enrich their visibility and credibility. In this blog post, we’ll share key insights from an analyzed KAWA4096 sample to uncover how this ransomware operates and what sets it apart.

HIPAA 2.0, Minimum Viable Hospitals, and Strategies for Cyber Resilience within Healthcare

Welcome to the Data Security Decoded podcast, brought to you by Rubrik Zero Labs. In each episode, we discuss cybersecurity with thought leaders and industry experts, getting their take on trends, themes, and how they see data security evolving. This is a must-listen for security and IT leaders looking to better understand trends shaping data security and how they can achieve cyber resilience.

Pegasus Spyware Email Scam: How to Detect and Protect Yourself

Among today's rising cyber threats, Pegasus spyware email has become one of the most famous names among the latest threats. Pegasus is a malware spy tool developed for extensive surveillance but has now been turned into the new wave of scams exerted by cybercriminals, especially through Pegasus spyware scam mails used to extort money from victims, claiming their devices had been hacked.

Stop Ransomware Over SMB with Falcon Endpoint Security: Demo Drill Down

Ransomware is evolving—and it's targeting your blind spots. Attackers now encrypt files remotely over SMB shares using stolen credentials and unmanaged systems, bypassing traditional defenses. CrowdStrike closes this gap with File System Containment, a powerful Falcon Endpoint Security feature that detects ransomware-style behaviors like mass encryption and blocks destructive file actions instantly—directly at the endpoint, without relying on cloud checks or process termination.

A Beginner's Guide to Ransomware-as-a-Service (Raas)

Over the last few years, news reports around ransomware attacks have noted that the attacks are increasingly sophisticated. Simultaneously, they say that the attackers are less sophisticated than in the past. While these two statements appear to conflict with each other, they are both true when viewed through the lens of the current cybercriminals business models.

Stop Remote Ransomware Attacks with Falcon Endpoint Security

Ransomware is a rapidly evolving threat, with attackers increasingly turning to remote techniques that target network shares. To help defend against these tactics, CrowdStrike Falcon Prevent endpoint security includes a capability called File System Containment, which is precision-focused to block malicious file system actions over Windows Server Message Block (SMB) shares, halting encryption as soon as possible.

Ransomware Strikes : The Final Conclusion (Part 4)

Moving into the Final Chapter of Our Ransomware Series! You've made it through the critical first hour—great job! Now, the real work begins. In this video, we go into the after effects and solutions to what happens after the initial containment, including the importance of a solid Incident Response Plan, whether to pay the ransom, engaging experts, and the crucial steps to recover and harden your defenses.

Cloak Ransomware: Who's Behind the Cloak?

Emerging between late 2022 and the beginning of 2023, Cloak Ransomware is a new ransomware group. Despite its activities, the origins and organizational structure of the group remain unknown. According to data from the group’s DLS (data leak site), Cloak has accessed 23 databases of small-medium businesses, selling 21 of them so far. Out of these, 21 victims paid the ransom and had their data deleted, 1 declined and 1 is still in negotiations, indicating a high payment rate of 91-96%.

Qilin Ransomware: Get the 2025 Lowdown

Qilin operates as an affiliate program for Ransomware-as-a-Service, employing a Rust-based ransomware to target victims. Qilin ransomware attacks are often tailored for each victim to maximize their impact, utilizing tactics like altering filename extensions of encrypted files and terminating specific processes and services.

Helping the Financial Sector Deliver Secure and Modern Infrastructure through Regulation

In 2024, ransomware continues to be the most prevalent form of cyber-attack, affecting three out of four organisations, according to Veeam. The increasing frequency and sophistication of these attacks are driven by easy access to ransomware kits on the dark web and the significant profits cybercriminals generate through extortion schemes.

Alert: Scattered Spider is Targeting the Aviation Sector

The US FBI and cybersecurity experts are warning that the Scattered Spider extortion gang has shifted its focus to the aviation and transportation sectors, BleepingComputer reports. The group spent the past several months targeting companies in the retail and insurance sectors, and has now hit several airlines. Scattered Spider uses social engineering attacks to gain initial access, then steals data and/or deploys ransomware to extort their victims.

WatchGuard Report: Malware Explodes Across Network and Endpoints

In WatchGuard’s just-released Q1 2025 Internet Security Report, one thing is clear: attackers are getting faster, stealthier, and more sophisticated, powered by an underground boom in AI tools. The numbers speak for themselves: These insights paint a clear picture: evasive, AI-driven threats are reshaping the cybersecurity battlefield. Organizations must adapt with layered, intelligent, and proactive defenses to stay ahead.

Cato CTRL Threat Research: Overview of BloodHound and Associated Collectors Including ShadowHound, SharpHound, and SoapHound

Think back to when you were a kid, eyeing a cookie jar on the top shelf. Getting to it wasn’t just about reaching; it was about strategy. You had to avoid making noise, pick the sturdiest route, and time your move perfectly to avoid getting caught. Imagine having a team of expert scouts feeding you all the correct information: where the dangers are, which surfaces can support you, and the best way to grab that prize unnoticed. That’s exactly what BloodHound does.

Ransomware Strikes : Actionable steps Minute 20-60 (Part 3)

In Part 3 of our Ransomware Strikes series, We are going to cover the important steps that one should take within the first 20 minutes to the interval of 60 minutes of a ransomware attack to preserve vital evidence and ensure an effective response. Global ransomware damage costs are projected to reach $20 billion annually by 2025, up from $5 billion in 2021. Organizations of all sizes are vulnerable; in 2023 alone, over 60% of organizations reported experiencing a ransomware incident.

XWorm's Shape-Shifting Arsenal: Loader and Stager Variants in the Wild

XWorm, a popular and actively distributed remote access trojan (RAT), has steadily evolved into a versatile tool in the cybercriminal toolkit. Known for its robust feature set, ranging from keylogging and remote desktop access to data exfiltration and command execution, XWorm continues to attract threat actors due to its ease of use, modularity, and frequent updates by its developers.

To Report or Not to Report Ransom Payments - Possibly Not Worth the Effort

Just a recap - Trustwave in no way endorses ransom payments. We believe the best way to deal with a ransomware situation is to: A: Create a strong defensive posture that will deter, if not stop, an attack. B: Have in place a solid and well-practiced incident response plan that includes backups so an organization can quickly recover from any attack.

To Report or Not to Report Ransom Payments - A Helpful and Useful Idea

Just a recap - Trustwave in no way endorses ransom payments. We believe the best way to deal with a ransomware situation is to: A: Create a strong defensive posture that will deter, if not stop, an attack. B: Have in place a solid and well-practiced incident response plan that includes backups so an organization can quickly recover from any attack.

Scattered Spider Unmasked: How an identity-focused APT is redefining cyber threats

Scattered Spider has emerged as one of the most disruptive advanced persistent threats in recent years, breaching major organizations across telecom, gaming, transportation, and retail. In the last few months, the group has escalated its activity—targeting financial services and launching coordinated ransomware campaigns that have crippled operations and exposed sensitive data.

When Installers Turn Evil: The Pascal Script Behind Inno Setup Malware Campaign

Software installer packages are a cornerstone of user-friendly software distribution. Tools like Inno Setup, NSIS (Nullsoft Scriptable Install System), and InstallShield help developers bundle their applications into a single, streamlined installer that users can run with just a few clicks. These installers often include everything needed to set up a program, files, configurations, and even system dependencies, making software installation seamless and accessible.

Ransomware Strikes! What to Do in the First 60 Minutes: Understanding the Threat (Part 2)

Are you prepared for a ransomware attack? In this 2nd part of our "Ransomware Strikes! What to Do in the First 60 Minutes" series, we move forward on one of the most terrifying cyber threats facing businesses today. Join VISTA InfoSec, an officially empaneled organization with CREST, PCI Council, CSRO SG, SWIFT, and CERT-IN, as we dive deep into the reality of ransomware in 2024. We'll reveal staggering statistics and solutions that you ought to execute to escape the mess.

Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

Since early June 2025, Arctic Wolf has observed a search engine optimization (SEO) poisoning and malvertising campaign promoting malicious websites hosting trojanized versions of legitimate IT tools such as PuTTY and WinSCP.

CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

SCATTERED SPIDER, an eCrime adversary, has recently broadened its target scope to include the aviation sector, in addition to its established focus on the insurance and retail industries, as observed by CrowdStrike Services. Throughout Q2 2025, SCATTERED SPIDER's activities have primarily centered on U.S.-based insurance and retail entities, along with U.K.-based retail entities.

What Ransomware Teaches Us About Weak Links in the Development Pipeline

Ransomware attacks aren't just hitting banks and government agencies anymore-they're going straight for the jugular of how modern software is made. That's right: the development pipeline has become prime hunting ground. And while companies scramble to patch after the damage is done, the smarter ones are shifting focus to where it all begins-the code, the pipeline, and the people pushing it live.

Inside Qilin's New Legal Pressure Tactic: How 'Call a Lawyer' Increases Ransomware Success

In the cybercrime ecosystem, innovation often comes in disturbing forms. The ransomware group Qilin—already notorious for offering a full suite of extortion tools to affiliates—has introduced a new feature that elevates psychological warfare to a new level: a “Call a Lawyer” button. This isn’t satire. This is real social engineering, now backed with actual legal threats.

A Pressing Matter Part I - The Simplification of Ransomware Crime Development Through Cybercriminal Forums

Five centuries after the printing press was invented, the digital age began. With significant revolutions in knowledge dissemination, the era taking place now has seen vast amounts of information become instantly accessible. Whilst this is generally seen as a positive in most countries worldwide, malicious intentions persist across the digital world.