Skip to main content
Customer Support Customer Support

Ransomware Spotlight

Dedicated exclusively to all things related to ransomware

  • 60 Topics
  • 42 Replies

LockBit’s Latest Taunt: A Challenge to the FBI and a Resurgence Signal

  • 4
  • 4
Takedown

LockBit Saga Continues: Return of the FBI

  • 7
  • 4
Blog

LockBit Ransomware Strikes Back: A Resilient Threat Amidst Law Enforcem...

  • 4
  • 7
60 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
DragonForce expands ransomware model with white-label branding scheme

April 26, 2025 By Ionut Ilascu The ransomware scene is re-organizing, with one gang known as DragonForce working to gather other operations under a cartel-like structure. DragonForce is now incentivizing ransomware actors with a distributed affiliate branding model, providing other ransomware-as-a-service (RaaS) operations a means to carry out their business without dealing with infrastructure maintenance cost and effort. A group's representative told BleepingComputer that they’re purely financially motivated but also follow a moral compass and are against attacking certain healthcare organizations. Typically, a RaaS operation has its own affiliates or partners, and the ransomware developer provides the file-encrypting malware and the infrastructure. Affiliates would build a variant of the encrypting package, breach victim networks, and deploy the ransomware. They would also manage the decryption keys and usually negotiate with the victim for a ransom payment. The developer also mainta

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Kidney dialysis firm DaVita hit by weekend ransomware attack

April 14, 2025 By Bill Toulas Kidney dialysis firm DaVita disclosed Monday it suffered a weekend ransomware attack that encrypted parts of its network and impacted some of its operations. DaVita is a major provider of kidney care services in the United States, operating over 2,600 outpatient treatment centers that provide dialysis to those suffering from kidney disease. It is a Fortune 500 organization with 76,000 employees in 12 countries and an annual revenue that surpasses $12.8 billion. The company disclosed today in an SEC FORM-8K filing that it suffered a ransomware attack on Saturday that encrypted some of the systems on its network. It is common for ransomware gangs to deploy encryptors over the weekend when IT teams are understaffed and less likely to respond quickly. "On April 12, 2025, DaVita Inc. became aware of a ransomware incident that has encrypted certain elements of our network," reads the 8-K filing. >>Full Article<<

153
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Ransomware Gangs Innovate With New Affiliate Models

Secureworks research shows two ransomware operators offering multiple business models with ransomware-as-a-service, mimicking the structures and processes of legitimate businesses. April 24, 2025 By Alexander Culafi The ransomware-as-a-service model is perpetually troubling for dropping the barrier to entry for aspiring ransomware actors, and two threat actors are innovating in the space with additional affiliate models. Extended detection and response vendor Secureworks (owned by Sophos) published research today detailing expanded affiliate models belonging to ransomware-as-a-service (RaaS) gangs DragonForce and Anubis. As a model, ransomware-as-a-service (RaaS) has gained significant popularity in recent years. A threat actor typically sells or leases many of the tools a less experienced cybercriminal (or affiliate) would need to conduct a ransomware attack; the affiliate typically shares the proceeds from subsequent attacks with the operator. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
CrazyHunter Hacker Group Using Open-Source Tools from GitHub to Attack Organizations

April 17, 2025 By Tushar Subhra Dutta A sophisticated ransomware group known as CrazyHunter has emerged as a significant threat to organizations, particularly those in Taiwan’s critical infrastructure sectors. This newly identified threat actor has been conducting targeted attacks against healthcare facilities, educational institutions, and industrial organizations since early 2025, showcasing a concerning level of operational sophistication. The campaign leverages readily available open-source tools from GitHub, significantly lowering the barrier to entry for conducting complex ransomware operations. >>Full Article<<

30
Jasper_The_Rasper
Moderator
C
Administrator
ConnorMThreat Research Analyst
published in Ransomware Spotlight
Cyber News Rundown: Port of Seattle reveals 90,000 individuals affected by ransomwareNews

In the months following a cybersecurity incident that disrupted the operations at the Port of Seattle, officials have confirmed that the Rhysida ransomware group had successfully exfiltrated data for nearly 90,000 individuals. Officials for the Port of Seattle initially entered negotiations with the threat actors, but after refusing to pay the demanded ransom, the stolen data was published to the group’s leak site. The compromised information includes a large amount of personally identifiable information (PII), and could be used for additional attacks, including phishing attacks and identity fraud. Clop ransomware adds WK Kellogg to list of Cleo victims Following the exploitation of a vulnerability in the Cleo file transfer software back in December of last year, officials for the WK Kellogg cereal company have recently confirmed that a significant amount of sensitive employee data had been compromised. The threat actors behind the Clop ransomware group added WK Kellogg to their list o

223
ProTruckDriver
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Data Poisoning: The Next Evolution of Ransomware That No One is Ready For

April 15, 2025 By Kaaviya For many years, ransomware has been associated with online extortion, causing businesses to become immobilized as they attempt to recover encrypted data. With cybersecurity teams preparing for these direct attacks, organizations have become accustomed to the risk of frozen systems and locked databases. However, a new and much more pernicious threat is showing up that does more than just prevent access to data; it also alters it without leaving any overt indications of compromise. The future of ransomware lies in reality-distortion rather than denial of service. Consider the financial turmoil that would result from a company’s records being covertly changed to prevent audits. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Microsoft: Windows CLFS zero-day exploited by ransomware gang

April 8, 2025 By Sergiu Gatlan Microsoft says the RansomEXX ransomware gang has been exploiting a high-severity zero-day flaw in the Windows Common Log File System to gain SYSTEM privileges on victims' systems. The vulnerability, tracked as CVE-2025-29824, was patched during this month's Patch Tuesday and was only exploited in a limited number of attacks. CVE-2025-29824 is due to a use-after-free weakness that lets local attackers with low privileges gain SYSTEM privileges in low-complexity attacks that don't require user interaction. While the company has issued security updates for impacted Windows versions, it delayed releasing patches for Windows 10 x64 and 32-bit systems and said they would be released as soon as possible. "The targets include organizations in the information technology (IT) and real estate sectors of the United States, the financial sector in Venezuela, a Spanish software company, and the retail sector in Saudi Arabia," Microsoft revealed today. "Customers runnin

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Everest ransomware's dark web leak site defaced, now offline

April 7, 2025 By Sergiu Gatlan The dark web leak site of the Everest ransomware gang has apparently been hacked over the weekend by an unknown attacker and is now offline. The unknown attacker replaced the website's contents with the following sarcastic message: "Don't do crime CRIME IS BAD xoxo from Prague." The Everest operation has since taken down its leak site, which no longer loads and now displays an "Onion site not found" error. While it's unknown how the attacker gained access to Everest's website or if it was even hacked, some security experts, like Flare Senior Threat Intelligence Researcher Tammy Harper, point to a potential WordPress vulnerability that could've been exploited to deface the ransomware operation's leak site. "It is worth mentioning that Everest was using a Wordpress template for their blog. I would not be surprised if that was how this happened," Harper said. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Port of Seattle says 90,000 people impacted in 2024 ransomware attack

April 4, 2025 By Jonathan Greig About 90,000 people had information accessed by ransomware hackers who breached the systems of the Port of Seattle last year. The organization — which runs Seattle-Tacoma International Airport, several parks, container terminals and more — said it is sending breach notification letters to those affected, including about 71,000 people in Washington state. “The threat actors accessed and downloaded some personal information from previously used Port systems for employee, contractor, and parking data. The Port holds very little information about airport or maritime passengers, and systems processing payments were not affected,” officials said in a notice on Thursday. Those impacted had some combination of names, dates of birth, Social Security numbers, driver’s licenses, ID cards and some medical information stolen. Victims will receive one year of free credit monitoring services. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Hunters International Ransomware Gang Rebranding, Shifting Focus

The notorious cybercrime group Hunters International is dropping ransomware to focus on data theft and extortion. April 3, 2025 By Ionut Arghire Hunters International, a notorious ransomware group that recently claimed an attack on Indian engineering firm Tata Technologies, is rebranding itself and moving to exfiltration-only tactics, threat intelligence firm Group-IB reports. Active since late 2023, Hunters is a ransomware-as-a-service (RaaS) group that adapted many of the tools and techniques associated with Hive, the ransomware gang disrupted by law enforcement in January 2023. According to Group-IB, evidence suggests that Hunters is a rebrand of Hive: affiliates and operators of other ransomware groups refer to the RaaS as Hive and some of the individuals involved with the operation were contacted by Hunters’ administrators from the same accounts as Hive. >>Full Article<<

30
Jasper_The_Rasper
Moderator
C
Administrator
ConnorMThreat Research Analyst
published in Ransomware Spotlight
Cyber News Rundown: Clop ransomware breaches Western Alliance BankNews

Officials for Western Alliance Bank have recently begun contacting nearly 22,000 customers after discovering that sensitive information had been exfiltrated from their systems during a cybersecurity incident in October 2024. The breach affected a third-party vendor’s file transfer software and allowed threat actors from the Clop ransomware group to access a significant amount of personal and financial information. Western Alliance Bank was added to Clop’s leak site back in January, and the stolen data has since been published. Eldorado ransomware successfully rebranded as BlackLock Researchers have been tracking the activities of the relatively new ransomware group, BlackLock, and believe that the group is a rebrand of the infamous Eldorado ransomware-as-a-service. The group operates in much the same ways, with fast encryption and the same ransom note being left behind, but is unpredictable with their attack targets, making them difficult to counter. Eldorado likely rebranded due to th

243
Jasper_The_Rasper
Moderator
C
Administrator
ConnorMThreat Research Analyst
published in Ransomware Spotlight
Cyber News Rundown: VanHelsing ransomware platform targets multiple operating systemsNews

Researchers have been tracking the relatively new VanHelsing ransomware-as-a-service platform and have identified it as being capable of victimizing Windows, Linux and ARM operating systems. After first appearing on a dark web forum on March 7th, the operator has already added three victims to their leak site, with an average of $500,000 demanded as a ransom payment. VanHelsing has proven to be unique in that they operate in two modes, normal and stealth, which change how the malware encrypts the victim’s files to either add the ‘.vanhelsing’ extension or avoid doing so to not trigger any system alarms. Operation Red Card shuts down African fraud network Over the last 4 months, multiple international law enforcement agencies have collaborated under the umbrella of Operation Red Card to identify and dismantle a massive cyber-fraud ring across 7 African countries. Hundreds of individuals have been arrested in relation to this fraud ring, along with seizures of dozens of properties and ve

193
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Retail giant Sam’s Club investigates Clop ransomware breach claims

​@ProTruckDriver March 28, 2025 By Sergiu Gatlan ​Sam's Club, an American warehouse supermarket chain owned by U.S. retail giant Walmart, is investigating claims of a Clop ransomware breach. The Walmart division operates over 600 warehouse clubs with millions of members across the United States and Puerto Rico and almost 200 additional locations in Mexico and China. Sam's Club has over 2.3 million employees and reported a total revenue of $84.3 billion for the fiscal year ending January 31, 2023. "We are aware of reports regarding a potential security incident and are actively investigating the matter," a Sam's Club spokesperson told BleepingComputer. "Protecting the privacy and security of our members' information is a top priority at Sam's Club. We take these concerns seriously and will communicate further as appropriate." >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
RedCurl cyberspies create ransomware to encrypt Hyper-V servers

March 26, 2025 By Bill Toulas A threat actor named 'RedCurl,' known for stealthy corporate espionage operations since 2018, is now using a ransomware encryptor designed to target Hyper-V virtual machines. Previously, RedCurl was spotted by Group-IB targeting corporate entities worldwide, later expanding its operations and increasing the victim count. However, as Bitdefender Labs researchers report, the threat actors have started deploying ransomware on compromised networks. "We've seen RedCurl stick to their usual playbook in most cases, continuing with data exfiltration over longer periods of time," reads the Bitdefender report. "However, one case stood out. They broke their routine and deployed ransomware for the first time." As the enterprise increasingly moves to virtual machines to host their servers, ransomware gangs have followed the trend, creating encryptors that specifically target virtualization platforms. While most ransomware operations focus on targeting VMware ESXi serve

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
New Ransomware Group Claims Attack on US Telecom Firm WideOpenWest

A new ransomware group called Arkana claims to have compromised the US telecommunications provider WideOpenWest. March 26, 2025 By Ionut Arghire A new ransomware group claims to have hacked the systems of US telecommunications provider WideOpenWest (WOW!), and to have taken control of critical systems, in addition to stealing customer information. Calling itself Arkana Security, the threat actor claims to be performing penetration testing, hacking into organizations’ networks by exploiting vulnerabilities in corporate systems. They also steal the victims’ data to coerce them into paying a so-called “fee”. The same as other ransomware groups, however, Arkana relies on various tactics to extort its victims, listing their names on its Tor-based leak site and threatening to sell the allegedly stolen data on the dark web and to make it public unless a ransom is paid. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
BlackLock Ransomware Targeted by Cybersecurity Firm

March 26, 2025 By Pierluigi Paganini Resecurity found an LFI flaw in the leak site of BlackLock ransomware, exposing clearnet IPs and server details. Resecurity has identified a Local File Include (LFI) vulnerability in Data Leak Site (DLS) of BlackLock Ransomware. Cybersecurity experts were able to exploit misconfiguration in vulnerable web-app used by ransomware operators to publish victims’ data – leading to clearnet IP addresses disclosure related to their network infrastructure behind TOR hidden services (hosting them) and additional service information acquired from server-side. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
New VanHelsing ransomware targets Windows, ARM, ESXi systems

March 24, 2025 By Bill Toulas A new multi-platform ransomware-as-a-service (RaaS) operation named VanHelsing has emerged, targeting Windows, Linux, BSD, ARM, and ESXi systems. VanHelsing was first promoted on underground cybercrime platforms on March 7, offering experienced affiliates a free pass to join while mandating a deposit of $5,000 from less experienced threat actors. The new ransomware operation was first documented by CYFIRMA late last week, while Check Point Research performed a more in-depth analysis published yesterday. Inside VanHelsing Check Point’s analysts report that VanHelsing is a Russian cybercrime project that forbids targeting systems in systems in CIS (Commonwealth of Independent States) countries. Affiliates are allowed to keep 80% of the ransom payments while the operators take a 20% cut. The payments are handled via an automated escrow system that employs two blockchain confirmations for security. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Albabat Ransomware Expands Targets, Abuses GitHub

New versions of the Albabat ransomware target Windows, Linux, and macOS, and retrieve configuration files from GitHub. March 24, 2025 By Ionut Arghire Newly identified versions of the Albabat ransomware are configured to target all major desktop platforms and to retrieve components from GitHub, cybersecurity firm Trend Micro reports. Active since 2023 and also known as White Bat, Albabat is known for targeting Windows systems through fake activation tools and cheat software, but the first signs of potential expansion to other platforms were seen in early 2024. In January last year, after noticing that the desktop wallpaper that Albabat was dropping on infected systems was mentioning Linux, Fortinet warned that the Rust-written ransomware could be cross-compiled to target more operating systems. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Medusa ransomware uses malicious Windows driver ABYSSWORKER to disable security tools

March 24, 2025 By Pierluigi Paganini Medusa ransomware uses a malicious Windows driver ABYSSWORKER to disable security tools, making detection and mitigation more difficult. Elastic Security Labs tracked a financially driven MEDUSA ransomware campaign using a HEARTCRYPT-packed loader and a revoked certificate-signed driver, ABYSSWORKER, to disable EDR tools. The attackers used a 64-bit Windows PE driver named smuol.sys, disguised as a CrowdStrike Falcon driver, which is VMProtect-protected and signed with a revoked Chinese certificate. Elastic researchers found dozens of samples from August 2024 to February 2025, likely signed with stolen certificates. “All samples are signed using likely stolen, revoked certificates from Chinese companies. These certificates are widely known and shared across different malware samples and campaigns but are not specific to this driver.” reads the report published by Elastic. ABYSSWORKER employs functions with constant return values, using opaque predic

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Ransomware Group Claims Attacks on Ascom, Jaguar Land Rover

The Hellcat ransomware group claims to have stolen tens of gigabytes of data from Ascom and Jaguar Land Rover. March 21, 2025 By Ionut Arghire The Hellcat ransomware group this week claimed responsibility for cyberattacks on Swiss telecommunications provider Ascom and British multinational car manufacturer Jaguar Land Rover (JLR). The attack on Ascom occurred on March 16, and the group added the company to its Tor-based leak site on the same day. The telecoms company confirmed the next day that the attack targeted its technical ticketing system. “The Ascom IT Cybersecurity Team is investigating the incident and immediately closed the ticketing system. Determining the extent of the attack is part of the ongoing investigation,” the company said. >>Full Article<<

10
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
VSCode extensions found downloading early-stage ransomware

March 20, 2025 By Bill Toulas Two malicious VSCode Marketplace extensions were found deploying in-development ransomware, exposing critical gaps in Microsoft's review process. The extensions, named "ahban.shiba" and "ahban.cychelloworld," were downloaded seven and eight times, respectively, before they were eventually removed from the store. It is notable that the extensions were uploaded onto the VSCode Marketplace on October 27, 2024 (ahban.cychelloworld) and February 17, 2025 (ahban.shiba), bypassing safety review processes and remaining on Microsoft's store for an extensive period of time. The VSCode Marketplace is an online platform where developers can find, install, and share extensions for Visual Studio Code (VSCode). It is widely used by software and web developers, data scientists, and programmers. >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
RansomHub ransomware uses new Betruger ‘multi-function’ backdoor

March 20, 2025 By Sergiu Gatlan ​A newly identified custom backdoor deployed in several recent ransomware attacks has been linked to at least one RansomHub ransomware-as-a-service (RaaS) operation affiliate. Symantec researchers who named this malware Betruger describe it as a "rare example of a multi-function backdoor" that was likely engineered for use in ransomware attacks. The malware's capabilities include a wide range of capabilities that overlap with features commonly found in malicious tools dropped before deploying ransomware payloads, including keylogging, network scanning, privilege escalation, credential dumping, screenshotting, and uploading files to a command and control (C2) server. "The functionality of Betruger indicates that it may have been developed in order to minimize the number of new tools dropped on a targeted network while a ransomware attack is being prepared," Symantec's Threat Hunter Team said. >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
RansomHub Taps FakeUpdates to Target US Government Sector

A ransomware activity wave using the SocGholish MaaS framework for initial access also has affected banking and consulting firms in the US, Taiwan, and Japan since the beginning of the year. March 17, 2025 By Elizabeth Montalbano The RansomHub cybercriminal group has teamed with the threat actor behind the FakeUpdates malware-as-a-service (MaaS) framework to deliver its ransomware, in a wave of attacks against US government organizations. In threat activity tracked as "Water Scylla" by researchers at Trend Micro, SocGholish, the actor responsible for FakeUpdates, is delivering the ransomware in a complex, multiple-stage attack involving several threat groups, according to a recent blog post. The attack "involves compromised websites, collaboration with threat actors operating malicious Keitaro TDS instances, SocGholish payload delivery, and post-compromise activity that leads to RansomHub," Trend Micro researchers revealed in the post. >>Full Article<<

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
GPU-powered Akira ransomware decryptor released on GitHub

March 15, 2025 By Bill Toulas Security researcher Yohanes Nugroho has released a decryptor for the Linux variant of Akira ransomware, which utilizes GPU power to retrieve the decryption key and unlock files for free. Nugroho developed the decryptor after being asked for help from a friend, deeming the encrypted system solvable within a week, based on how Akira generates encryption keys using timestamps. The project ended up taking three weeks due to unforeseen complexities, and the researcher spent $1,200 on GPU resources to crack the encryption key, but eventually, he succeeded. Using GPUs to brute force keys Nugroho's decryptor does not work like a traditional decryption tool where users supply a key to unlock their files. Instead, it brute-forces encryption keys (unique for each file) by exploiting the fact that the Akira encryptor generates its encryption keys based on the current time (in nanoseconds) as a seed. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
LockBit ransomware developer Rostislav Panev was extradited from Israel to the U.S.

March 14, 2025 By Pierluigi Paganini The US Justice Department announced that the LockBit ransomware developer Rostislav Panev was extradited from Israel to the U.S. The US Justice Department announced that one of the LockBit ransomware developer, Rostislav Panev (51), has been extradited to the United States. The dual Russian-Israeli national was arrested in Israel in 2024 and faces charges related to his role in the ransomware operation The man is accused of being a LockBit ransomware developer from 2019 through at least February 2024. The leading ransomware group attacked over 2,500 victims worldwide, including 1,800 in the United States, extracted $500M in ransoms, and caused billions in damages. >>Full Article<<

10
Jasper_The_Rasper
Moderator

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions