Thus Spoke…The Gentlemen
Key Points Introduction The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. Its operators advertise the service across multiple underground f
Results for "ransomware"
The State of Ransomware – Q1 2026
Key Findings Ransomware in Q1 2026: Consolidation at Scale During the first quarter of 2026, we monitored more than 70 active data leak sites (DLS) that collectively listed 2,122 new victims. This fig
One compromise, a thousand victims: why ransomware is turning to supply chain attacks
With an extortion toll running to tens of billions of dollars, few experts would dispute that ransomware is the most consequential cybercrime business model yet devised. But even the most successful b
VECT: Ransomware by design, Wiper by accident
Key Takeaways Background VECT Ransomware is a Ransomware-as-a-Service (RaaS) program that made its first appearance in December 2025 on a Russian-language cybercrime forum. After claiming their first
DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy
Key Points The Gentlemen RaaS The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. The operators advertise their services across multiple unde
Under pressure, ransomware returnsto its extortion roots
After years of success, it looks as if the era where ransomware gangs could make easy money from data leak extortion might finally have ended. Despite its huge success, extortion-led ransomware is a s
Nitrogen Ransomware: ESXi malware has a bug!
Nitrogen ransomware was derived from the previously leaked Conti 2 builder code, and is similar to Nitrogen ransomware, but a coding mistake in the ESXi malware causes it to encrypt all the files with
Ransomware doesn’t need AI when simple weaknesses leave the door standing ajar
After reading recent reports of AI’s impact on cybercrime, one might assume that the world is about to enter an era of frightening, AI-powered ransomware attacks. As Trend Micro put it in its November
Is Africa the next ransomware hotspot?
Between October and November 2025, one of the biggest cybercrime operations in Interpol history saw the arrest of 574 people suspected of business email compromise (BEC), digital extortion, and ransom
Obscura Ransomware: A Case Study in Ransomware Data Loss
Discover how Obscura ransomware corrupts encrypted files beyond recovery, and why technical validation is key to smart ransom response decisions
The era of AI ransomware is bad news for everyone – including ransomware criminals
There’s no escaping AI’s tightening grip on the technology industry, and it turns out that ransomware criminals are just as susceptible to the reality-bending excitement as anyone else. According to a
How ransomware turned from a private misery into a national emergency
It’s nearly 20 years since I first encountered ransomware as the security editor of an online computer magazine, although at the time I had no idea what it was and the term had not yet been coined to
Nearly one-third of ransomware victims are hit multiple times, even after paying hackers
More than three-in-ten ransomware victims are being hit multiple times, thanks to ineffective defenses and security fragmentation. According to Barracuda Networks’ Ransomware Insights Report, 57
Interlock ransomware gang is ramping up activity, CISA warns
The Interlock ransomware gang is aggressively targeting businesses and critical infrastructure in North America and Europe, according to a new warning from the US Cybersecurity and Infrastructure Secu
Targeted social engineering is en vogue as ransom payment sizes increase
Several ransomware groups used highly targeted social engineering tactics to create a major impact across several industry sectors in Q2 2025.
Ransomware victims are getting better at haggling with hackers
Nearly half of companies paid a ransom to get their data back last year, according to new research, but they’re taking a hard line with hackers to strike fair deals. In its latest State of Ransomware
It’s been a bad week for ransomware operators
Hundreds of servers have been taken down as part of an international law enforcement operation against ransomware groups. Coordinated by Europol and Eurojust, the action saw key infrastructure dismant
The organizational structure of ransomware threat actor groups is evolving before our eyes
The Ransomware-as-a-service (RaaS) model has not recovered from law enforcement disruption, and the entrance of novice actors along with non-Russian state-linked cybercriminals has led to uncertain ou
Will Law Enforcement success against ransomware continue in 2025?
2024 was a banner year for Law enforcement agency actions against ransomware and cybercrime groups. Will the new administration ensure this momentum continues?
Misleading Metrics: Unraveling Ransom Payment Statistics in Australia
A recent Australian Financial Review (AFR) article contained statistics about ransomware payment trends that require some deeper inspection.