Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

From Data Theft to Production Shutdown: The Top 3 Ransomware Threats Facing U.S. Manufacturers in 2026

The manufacturing sector remains one of the most aggressively targeted industries in the ransomware economy. In 2026, threat actors are no longer merely encrypting file servers-they are disrupting production lines, freezing ERP systems, and leveraging operational downtime as a strategic pressure point.

Cyberattacks on Hospitals Are Attacks on Communities: Why Ransomware Is a Patient Safety Crisis

In this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, host Josh Howell speaks with John Riggi, National Advisor for Cybersecurity and Risk at the American Hospital Association. Drawing on nearly 30 years at the FBI and his current work advising more than 5,000 hospitals, Riggi explains why ransomware attacks on healthcare should be treated as threat-to-life events. He breaks down the real-world consequences of cyberattacks, from ambulance diversion to delayed cancer care, and outlines what leaders must do now to prepare for outages that last weeks, not hours.

Leaked Credentials: The Hidden Supply Chain Powering Modern Ransomware Attacks

Ransomware incidents are often perceived as sudden, destructive events triggered by malicious payloads. In reality, many modern ransomware attacks begin much earlier and in a far less visible way: with compromised credentials and pre-existing access sold in underground markets. Threat intelligence collected from access broker activity and credential exposure sources indicates that ransomware operators increasingly rely on purchased access rather than direct exploitation.

Key Lessons from the Major Ransomware Attacks in Recent Months

The biggest ransomware attacks of 2025 have shown that this threat remains critical for organizations across all sectors. Incidents such as the Change Healthcare attack, which compromised the data of nearly 190 million individuals, and the attack on Jaguar Land Rover, which forced production lines to halt and caused losses amounting to hundreds of millions of dollars, show that a single incident can impact both operational continuity and information confidentiality.

Amit Malik gives you an inside look at new attack methods being used by adversaries

Attackers are using AI and LLMs in unique ways to increase their capabilities and minimize their footprint; so how can defenders respond? Don’t miss this episode of Data Security Decoded with Amit Malik, a Staff Security Researcher at Rubrik Zero Labs, who gives you an inside look at new attack methods being used by adversaries. Get Data Security Decoded wherever you listen to your podcasts, or subscribe to our channel!

1,500% Surge in New Malware: Why MSPs Must Act Now

The latest findings from WatchGuard Technologies reveal a stark reality for managed service providers: cyber threats are not only increasing—they’re evolving faster than traditional defenses can keep up. In its newest Internet Security Report, WatchGuard identified a 1,548% spike in new, unique malware from Q3 to Q4 2025. Nearly one in four threats bypassed signature-based detection, highlighting a critical gap in reactive security models still used across many customer environments.

Protecting Azure DevOps with Rubrik

Your code is one of your organization’s most critical assets, and protecting it should be as resilient as the applications it builds. In this video, we walk through how Rubrik delivers enterprise-grade protection for enterprise-critical code by securing Azure DevOps repositories against accidental deletion, malicious activity, and ransomware threats.

Ransomware in Financial Services: Traditional Backup Isn't Enough

Many financial services IT leaders believe they’re protected against ransomware because they have backups. According to Sophos’ State of Ransomware in Financial Services 2025, 64% of financial services organizations were hit by ransomware in the past year. Of those with backups, a significant percentage discovered their backup infrastructure had been compromised too. Modern ransomware operators don’t just encrypt production data.

The Real Risks of Agentic AI in the Enterprise with Camille Stewart-Gloster

In this episode of Data Security Decoded, host Caleb Tolin is joined by Camille Stewart-Gloster, CEO of CAS Strategies and former Deputy National Cyber Director, to unpack how AI is redefining cyber risk at every layer of the organization. Camille explains why identity-based attacks are so effective and how non-human identities (from APIs to AI agents) are quietly expanding the attack surface. She emphasized how critical MFA is for organizations to enable as they scale up AI operations, and why conditional access and governance must be foundational, not optional.

Why Hospitals Pay Ransom to Hackers

Targets in western countries are picked with care, since hospitals and critical services face lives at risk and heavy legal fallout after breaches. When attackers weigh up ransom against long court battles and recovery costs, payment becomes the path many victims choose, feeding the growth of cybercrime. ⸻ For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com. We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion..

How Hospitals Sustain Patient Care When Systems Go Dark

In this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, host Josh Howell speaks with Drex DeFord, veteran healthcare CIO, strategist, and President of 229 Cyber & Risk at This Week Health. Drawing on decades of experience leading technology and transformation across organizations like the U.S. Air Force, Seattle Children’s, Scripps Health, and Steward Healthcare, Drex explores what it really takes to sustain patient care when cyberattacks force systems offline.

From Operations to Policy: Contributing to the Global Fight Against Ransomware

Today, the government of Canada issued a statement announcing that Arctic Wolf will continue to co-chair the Counter Ransomware Initiative Public-Private Sector Advisory Panel in 2026, alongside Public Safety Canada and BlackBerry. The panel will also include member organizations such as Ensign InfoSecurity, the Institute for Security and Technology, Microsoft, Palo Alto Networks, and the Royal United Service Institute.

Cato CTRL Threat Research: Foxveil - New Malware Loader Abusing Cloudflare, Discord, and Netlify as Staging Infrastructure

Cato CTRL has identified a previously undocumented malware loader we track as “Foxveil.” We observed evidence that the malware campaign has been active since August 2025, and we observed two distinct variants (v1 and v2). Foxveil behaves like a modern initial-stage loader: it establishes an initial foothold, frustrates analysis, and retrieves next-stage payloads from threat actor-controlled staging hosted on Cloudflare Pages, Netlify, and, in some cases, Discord attachments.

Why Your "Skill Scanner" Is Just False Security (and Maybe Malware)

Maybe you’re an AI builder, or maybe you’re a CISO. You've just authorized the use of AI agents for your dev team. You know the risks, including data exfiltration, prompt injection, and unvetted code execution. So when your lead engineer comes to you and says, "Don't worry, we're using Skill Defender from ClawHub to scan every new Skill," you breathe a sigh of relief. You checked the box. But have you checked this Skills scanner?

Detect OPERATOR PANDA at the Edge with Falcon Adversary Overwatch

CrowdStrike Falcon Adversary Overwatch: ► Detect adversaries hiding in your blind spots. Falcon Adversary Overwatch exposes threats targeting network edge devices—firewalls, routers, and infrastructure traditional security tools can’t see. Watch the demo to see how CrowdStrike detects OPERATOR PANDA in real time and stops edge-driven intrusions that quickly turn into credential theft and identity abuse before they escalate.

How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware

You ask your OpenClaw agent to "check my Gmail." It replies, "I need to install the Google Services Action skill first. Shall I proceed?" You say yes. The agent downloads the skill from ClawHub. It reads the instructions. Then, it pauses. "This skill requires the 'openclaw-core' utility to function," the agent reports, displaying a helpful download link from the skill's README. "Please run this installer to continue." You copy the command. You paste it into your terminal. You have just been compromised.

LevelBlue SpiderLabs: Breaking Down the Ransomware Groups Targeting the Education Sector

Ransomware attack groups have ramped up their efforts, launching attacks on the education sector with recent incidents striking a range of targets from an Australian institution of higher learning to a school district in North Carolina. These facilities contain a large amount of very valuable data, such as student records, intellectual property, and financial information that threat groups can leverage for financial gain. An additional reason education is targeted is that it must stay in operation.

New Malware Kit Promises Guaranteed Publication in the Chrome Web Store

A new malware-as-a-service (MaaS) kit called “Stanley” is offering users guaranteed publication in the Chrome Web Store, bypassing Google’s security verification process, according to researchers at Varonis. “For $2,000 to $6,000, Stanley provides a turnkey website-spoofing operation disguised as a Chrome extension, with its premium tier promising guaranteed publication on the Chrome Web Store,” Varonis says.

Why Cybersecurity is the Core of Corporate Survival

Is your business ready for a digital ambush? It's a loaded question, sure. But not a hypothetical one. In today's landscape, it's practically rhetorical. One phishing scam, one rogue USB stick, one "I'll-just-connect-to-this-coffee-shop-Wi-Fi-for-a-minute" moment and everything can unravel. You'd think big companies would be immune with all their resources, right? Tell that to MGM Resorts, which hemorrhaged over $100 million in 2023 due to a single compromised login. A phone call. That's all it took.
Sponsored Post

Ten threats traditional Antivirus misses (and Next-Gen AV doesn't)

The cybersecurity arena is rapidly shifting and CISOs are locked in a relentless struggle against adversaries who rarely reveal themselves. Traditional antivirus (AV) solutions, which has been the primary shield (and still is for many companies) has reached its 'End of life'. The reason is clear: signature-based protection simply isn't enough anymore.

Breaking AppSec Myths - Obfuscated Packages

As part of the JFrog Security Research team’s ongoing work, we continuously monitor newly published packages across multiple ecosystems for malicious activity. This effort serves the broader open source community through public research disclosures, and it directly impacts the detection capabilities behind JFrog Xray and JFrog Curation. Our scanning pipeline uses a broad set of indicators to detect suspicious behavior.

SpiderLabs Ransomware Tracker Update January 2025: Qilin Continues as Dominant Threat Group

The January 2026 edition of LevelBlue SpiderLabs ransomware tracker noted a sharp fall in the number of attacks launched compared to December 2025. Qilin remained the top attacker, but there was a reshuffling of the remaining top five attackers for the month.

Inside Cloud Malware Analysis: Techniques and Real-World Use Cases

Cloud environments power modern business, but they also attract sophisticated malware. Attackers target cloud storage, virtual machines, and APIs to hide malicious code and steal sensitive data. This guide explains cloud malware analysis in clear terms. It covers key techniques and real examples to help security teams spot and stop these threats.