Ransomware
Curated coverage and analysis in this editorial area.
Ransomware Hits Vicksburg: Mayor Shuts Down IT Systems, FBI and DHS Investigating
Mayor Willis Thompson confirmed a ransomware attack on the city of Vicksburg, Mississippi, on October 1, 2026. IT systems were taken o…
Warlock: The Chinese Ransomware That Weaponizes Active Directory
The Warlock group exploits Active Directory's SYSVOL replication to spread its payload. This living-off-the-land technique makes the a…
Keio Ransomware: Trains Run On Time, Hotels and Retail in Chaos
Keio Corporation confirmed a ransomware attack on September 26, 2026. Train operations were unaffected, but the group's hotel and reta…
MedImpact Data Breach: 11 Months of Silence and the Shadow of Qilin
MedImpact Healthcare Systems took 11 months to notify individual members after a data breach attributed to the Qilin ransomware group.…
Ryuk: 24 Months for Core Affiliate Highlights Federal Sentencing Disparity
Karen Vardanyan, a core member of the Ryuk ransomware group, was sentenced to 24 months in federal prison. The sentence reignites deba…
Ransomware: Record 1,073 Victims in August, but Payment Rate Plunges to 23%
Ransomware hit 1,073 organizations in August 2026, an all-time high. The payment rate collapsed to 23%, while the median ransom demand…
PAYLOAD: The Ransomware That Turned Active Directory Itself Into a Weapon
A Middle East attack delivered ransomware impact without malware or encryption, weaponizing Active Directory Group Policy alone.
PAYLOAD: A Malicious GPO Replaces Ransomware on Windows
The PAYLOAD group used an Active Directory Group Policy Object to distribute ransom notes and alter wallpapers across all workstations…
JADEPUFFER Encrypts AI Weights with ENCFORGE: Phantom Ransom, Broken Payment Mechanism
The agentic ransomware group JADEPUFFER struck Langflow infrastructure with ENCFORGE, a payload that encrypts AI models without a func…
RansomHouse Hits Namibia's Defence Ministry: The September 19 Case
Nam-CSIRT has confirmed the RansomHouse ransomware attack on Namibia's Ministry of Defence and Veterans Affairs. The leak-site listing…
Settra: The Log Typo That Confirmed Traces of a New Ransomware
The Settra ransomware variant, observed since June 2026, hit two targets in the retail and manufacturing sectors using rigorously stan…
Switzerland: Ukrainian Ransomware Developer Sentenced to 12 Years, 9 Months
A Zurich district court sentenced a 52-year-old Ukrainian developer to 12 years and 9 months in prison for creating the LockerGoga, Me…