Ransomware
Curated coverage and analysis in this editorial area.
Fairlife Halts All U.S. Milk Production: The Ransomware the SEC Didn't Classify as Material
On July 16, 2026, Fairlife, a ~$4 billion Coca-Cola subsidiary, suspended every U.S. plant after ransomware hit 'production-related sy…
The Gentlemen Climbs RaaS Rankings: 90% Payout and 580 Victims in One Year
The Gentlemen, tracked as Storm-2697, has become the second most active RaaS operation of 2026 with over 6x growth and a 90% affiliate…
GodDamn Ransomware Uses Microsoft-Signed Driver to Disable EDR
The GodDamn ransomware, a rebrand of the Hyadina family, leverages the PoisonX driver — signed with a valid Microsoft Windows Hardware…
LVM: Weeks of Blackout After Ransomware Hits System Unpatched for Two Years
Latvia's state-owned forestry company Latvijas valsts meži (LVM) remains paralyzed weeks after a June 22 ransomware attack. Roughly tw…
Hyadina Strikes with GodDamn: Microsoft-Signed Driver Disables EDR in 24 Hours
The Hyadina ransomware-as-a-service group deploys a new locker, GodDamn, using the Microsoft-signed PoisonX kernel driver to neutraliz…
Mount Royal University Confirms Breach With Double Extortion: Data Theft and Deletion
The CMD Organization ransomware group claimed responsibility for the attack on Mount Royal University, demanding a $1.9 million ransom…
The Gentlemen: Go Backdoor and BYOVD in New RaaS That Spies on EDR
Kaspersky analyzes The Gentlemen, a ransomware-as-a-service group active since early 2026. Custom Go backdoor with persistent C2, five…
A U.S. Local Government Paid $1 Million for an Illusion of Control
A U.S. government entity paid roughly $1 million in bitcoin to the Kairos ransomware group on June 13, 2025, to prevent the release of…
Interpol Ransomware: Small Businesses Targeted via Social Engineering
Threat actors are impersonating Interpol in a ransomware campaign hitting small businesses across pharmaceutical, food, agriculture, t…
AI-Generated Ransomware Attacks via Browser: No Payload, Just Chrome Permissions
Check Point analyzed a DeepSeek-generated sample that encrypts local files by abusing Chrome's File System Access API. No exploit, no…
Blackfield Demands $2 Million from Nidec: Inside the Ransomware Price Menu
The Blackfield ransomware gang has claimed an attack on Nidec's Taiwanese subsidiary, Chaun Choung Technology, demanding $2 million to…
Ransomware: Europe Overtakes US as Top Target With 55% Surge in Attacks
Black Kite's first Europe-focused report reveals 684 ransomware attacks in the first four months of 2026, a 55.1% year-over-year incre…