11 casos · pág. 1/1
Huntress reports that manufacturing accounted for about 17% of cyber attacks in 2025, up from 9% in 2024, citing its own cyber threat report. The article is a vendor trends piece rather than an incident report. It argues that ransomware operators now target production uptime and operational technology (OT), not just data, because manufact…
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
A 28-year-old Russian man, identified by German media only as "Vladimir K", has been arrested in Germany on suspicion of being a key member of the Qilin ransomware gang. He was first detained in Japan in May while on holiday and was extradited to Germany earlier this month. German investigators are examining possible links between him and…
A court in Zurich sentenced an unnamed 52-year-old Ukrainian man to 12 years and nine months in prison and banned him from Switzerland for ten years. The court found him to be the lead developer of the LockerGoga, MegaCortex and Nefilim ransomware families. Victims include Norsk Hydro, Stadler Rail (500 GB stolen in 2020, reported US $6 m…
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
A still-unknown actor hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food and sparking fires. The incident fits a broader trend of extortionists and other attackers going after physical systems to maximise real-world pressure on victims. Earlier examples…
A Cisco blog post by Renato Morais compares past landmark threats with the emerging risk from autonomous AI agents, then presents Cisco's agentic security reference architecture. It recounts the ILOVEYOU worm (2000), a social-engineering email worm, and WannaCry (2017), a ransomware worm using EternalBlue against unpatched Windows systems…
Kaspersky ICS CERT reports that in Q2 2026 malicious objects were blocked on 19.15% of ICS computers, the lowest level since 2022. Regional rates ranged from 8.1% in Northern Europe to 27.9% in Africa. East Asia saw the largest increase (+2.0 pp). The biometrics sector (26.44%) again led all industries. Kaspersky products blocked malware …
Rapid7's Q3 2026 threat landscape report finds that high-severity vulnerabilities were exploited an average of three days after disclosure, with 71% exploited within the first seven days. 79% of them are classed as 'holy grail' flaws, meaning remote and needing no credentials or user interaction. Ransomware remains the dominant threat. Th…
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
