Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ransomware Strikes : Actionable steps Minute 20-60 (Part 3)

In Part 3 of our Ransomware Strikes series, We are going to cover the important steps that one should take within the first 20 minutes to the interval of 60 minutes of a ransomware attack to preserve vital evidence and ensure an effective response. Global ransomware damage costs are projected to reach $20 billion annually by 2025, up from $5 billion in 2021. Organizations of all sizes are vulnerable; in 2023 alone, over 60% of organizations reported experiencing a ransomware incident.

XWorm's Shape-Shifting Arsenal: Loader and Stager Variants in the Wild

XWorm, a popular and actively distributed remote access trojan (RAT), has steadily evolved into a versatile tool in the cybercriminal toolkit. Known for its robust feature set, ranging from keylogging and remote desktop access to data exfiltration and command execution, XWorm continues to attract threat actors due to its ease of use, modularity, and frequent updates by its developers.

To Report or Not to Report Ransom Payments - Possibly Not Worth the Effort

Just a recap - Trustwave in no way endorses ransom payments. We believe the best way to deal with a ransomware situation is to: A: Create a strong defensive posture that will deter, if not stop, an attack. B: Have in place a solid and well-practiced incident response plan that includes backups so an organization can quickly recover from any attack.

To Report or Not to Report Ransom Payments - A Helpful and Useful Idea

Just a recap - Trustwave in no way endorses ransom payments. We believe the best way to deal with a ransomware situation is to: A: Create a strong defensive posture that will deter, if not stop, an attack. B: Have in place a solid and well-practiced incident response plan that includes backups so an organization can quickly recover from any attack.

Scattered Spider Unmasked: How an identity-focused APT is redefining cyber threats

Scattered Spider has emerged as one of the most disruptive advanced persistent threats in recent years, breaching major organizations across telecom, gaming, transportation, and retail. In the last few months, the group has escalated its activity—targeting financial services and launching coordinated ransomware campaigns that have crippled operations and exposed sensitive data.

When Installers Turn Evil: The Pascal Script Behind Inno Setup Malware Campaign

Software installer packages are a cornerstone of user-friendly software distribution. Tools like Inno Setup, NSIS (Nullsoft Scriptable Install System), and InstallShield help developers bundle their applications into a single, streamlined installer that users can run with just a few clicks. These installers often include everything needed to set up a program, files, configurations, and even system dependencies, making software installation seamless and accessible.

Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

Since early June 2025, Arctic Wolf has observed a search engine optimization (SEO) poisoning and malvertising campaign promoting malicious websites hosting trojanized versions of legitimate IT tools such as PuTTY and WinSCP.