64 casos · pág. 2/4
The UK Information Commissioner's Office (ICO) has issued reprimands, not fines, to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) over a ransomware attack on 1 November 2024 (theregister.com, infosecurity-magazine.com). The intruder entered Data Cymru's network through a forgotten test account, Test2 (…
SOCRadar's Threat Research Unit (STRU) found open directories on 45.227.254.43 in late September 2026. They led to six more adversary servers tied to INC Ransom and The Gentlemen affiliates. The servers held 8,257 AI messages across 133 sessions, source code, stolen credentials, victim workspaces and 46 victim-specific INC encryptor build…
An $80 million settlement has been proposed to resolve the consolidated class action In Re Conduent Business Services Data Breach Litigation, pending in the U.S. District Court for the District of New Jersey. The suit stems from the 2024 breach at Conduent Business Services, LLC, in which an unauthorized party had network access from Octo…
Huntress reports that manufacturing accounted for about 17% of cyber attacks in 2025, up from 9% in 2024, citing its own cyber threat report. The article is a vendor trends piece rather than an incident report. It argues that ransomware operators now target production uptime and operational technology (OT), not just data, because manufact…
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …
F5 Labs analyzed exploitation of CVE-2026-24423, a CVSS 9.8 unauthenticated remote code execution flaw in SmarterTools SmarterMail (CWE-306). CISA added it to the KEV catalog on February 2, 2026 and notes it has been used in ransomware campaigns. Despite public write-ups, F5 sensors saw only one IP, 193.24.123.58 (ASN 200593, Russian ISP …
SentinelOne argues that "EDR killer" covers four different techniques, and a single driver-load rule leaves blind spots. The four are bring-your-own-vulnerable-driver (BYOVD), bring-your-own-installer, admin-to-kernel, and driverless suspension. The article gives hunt logic for each and recommends rolling them out in order of signal quali…
Episode 484 of the Smashing Security podcast, hosted by Graham Cluley with guest Danny Palmer, covers several security stories. The lead item is audio fingerprinting: a user named Matt found that an open AliExpress page, playing silent audio at zero volume, kept his multipoint Bluetooth headphones from switching to his phone. The episode …
A court in Zurich sentenced an unnamed 52-year-old Ukrainian man to 12 years and nine months in prison and banned him from Switzerland for ten years. The court found him to be the lead developer of the LockerGoga, MegaCortex and Nefilim ransomware families. Victims include Norsk Hydro, Stadler Rail (500 GB stolen in 2020, reported US $6 m…
Forescout's Vedere Labs has documented ROMULUS, a previously unknown malware delivery platform used in ClickFix campaigns, and new delivery techniques for loaders tied to Vice Society ransomware activity. The server hosting the ROMULUS panel was found during an incident investigation, and six IP addresses exposed the same authentication i…
A joint StopRansomware advisory (AA26-293A) from CISA, the FBI, the USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026 (cisa.gov). The group has been active since August 2024 and has compromised …
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
A Flare analysis argues that Scattered Spider, LAPSUS$ and ShinyHunters are distinct intrusion clusters within The Com, a decentralized, mostly English-speaking cybercriminal subculture, and not interchangeable names for one group. It describes SP1D3R HUNTERS (also called Scattered LAPSUS$ Hunters, SLH) as a shared brand and coordination …
In July 2026, 77 large healthcare data breaches (500+ individuals) were reported to the HHS Office for Civil Rights (OCR), a 10% month-over-month increase and the third consecutive monthly rise. At least 33,485,970 individuals were affected, up 642% from June and 154% above the 12-month average. January-July 2026 totals 67.4 million affec…
A Semperis survey, covered by HIPAA Journal, finds ransomware groups increasingly threatening victims' employees and their families as the share of victims paying ransoms falls from 78% in 2024 to 69% in 2025 and 59% in 2026. Of the attacks surveyed, 37% involved threats against friends or family of staff, and 41% of respondents said they…
Central Ohio Primary Care Physicians, a large physician-owned primary care group based in Westerville, Ohio, with more than 80 locations, disclosed a breach affecting about 1.4 million current and former patients. In August 2026, an unauthorized third party used a voice phishing (vishing) attack to obtain credentials that gave access to i…
The Semperis 2026 Ransomware Risk Report, published on October 14, warns that ransomware operators are increasingly threatening the physical safety of CISOs, executives and other senior staff at victim organizations to force payment. The report says a quarter of ransomware campaigns now involve psychological or physical threats against em…
Flashpoint's weekly Middle East brief for October 9-15 describes sustained kinetic escalation alongside cyber and information operations. Ansarallah (Houthis) ran a multi-day missile, drone and cruise-missile campaign against King Khalid International Airport in Riyadh. It killed at least 14 people and closed the airport through at least …
A Huntress vendor blog post lists 10 endpoint security trends. It reports no specific incident, vulnerability or campaign. The themes are agentic AI and the hijacking of non-human identities, ransomware shifting to double and triple extortion, incident response (IR) readiness, EDR-to-XDR consolidation, identity-first security and zero tru…
