Files on a central cloud server used by the ransomware group highlight a systematic, aggressive attack on network backups as a key TTP.

Ransomware remains one of the most pervasive and evolving threats to organizational data security. As attacks grow more sophisticated, many businesses implement cyber-resilience strategies based on ...

EDR killers are a fundamental part of modern ransomware intrusions; affiliates prefer a short, reliable window to run encryptors rather than constantly modifying payloads. Affiliates, not operators, ...

In 2022, the ALPHV Ransomware as a Service group attacked the city of Alexandria, La., with its malware. Two years later, LockBit ransomware bandits attacked Wichita, Kans. Once novel RaaS gangs are ...

Ransomware actors are ditching Cobalt Strike in favor of native Windows tools, as payment rates hit record lows and data theft surges.

Connecting the dots: Ransomware has become one of the most devastating threats in the digital era, locking away critical files and demanding costly payouts. When combined with AI and cloud computing, ...

For years, organizations treated ransomware as a technical threat, but that mindset is now dangerously outdated as ransomware ...

About 90% of healthcare organizations are insecurely connected to the internet and running systems vulnerable to exploitation by ransomware gangs, according to research released this week by ...

On 29 August 2025, Huntress analysts encountered a previously unseen ransomware variant called “Obscura.” This name was taken from the ransom note (README_Obscura.txt), which also made several ...

In the realm of cybercrime, change is arguably the only constant. While cyber-extortion as a broader category of crime has proved its staying power, ransomware – its arguably most damaging ‘flavor’ – ...

For much of the past year, the trail of destruction and mayhem left behind by ransomware hackers was on full display. Digital extortion gangs paralyzed hundreds of US pharmacies and clinics through ...

Why it matters: Ransomware is a type of malicious software that cybercriminals use to encrypt data or lock a victim's system, holding it hostage until a ransom is paid. The attackers typically demand ...