IntelDigest

Filtered security headlines, refreshed every six hours. Links out, always.

50 items from 13 sources · newest 2026-08-10 17:42 UTC

headlines only — every link goes to the original

BleepingComputer
New StormEncryptor ransomware used by former Medusa affiliate
2026-08-10 17:42 UTCindicators1 ip · 2 hashesthreat actorA financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]
The Hacker News
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw
2026-08-10 16:38 UTCcampaignthreat actorMicrosoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from…
Microsoft Security
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
2026-08-10 15:00 UTCindicators1 ip · 7 hashesransomwareMicrosoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data…
BleepingComputer
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
2026-08-10 14:34 UTCindicators1 ip · 2 hashesransomwareCISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. [...]
CISA
#StopRansomware: Gunra Ransomware
2026-08-10 12:00 UTCindicators17 ip · 8 hashesransomwareAdvisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical…
BleepingComputer
Critical Progress LoadMaster flaw now actively exploited in attacks
2026-08-10 09:49 UTCindicators4 ip · 2 hashesactively exploitedThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. [...]
The Hacker News
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
2026-08-08 06:58 UTCindicatorsexploited inMetabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0),…
BleepingComputer
Metabase SQLi zero-day exploited in customer data-theft attacks
2026-08-07 20:14 UTCindicators1 ip · 2 hashesexploited inA critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]
The Hacker News
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
2026-08-07 18:29 UTCtechniquemalwareClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused…
CISA
CISA Adds One Known Exploited Vulnerability to Catalog
2026-08-07 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability This type of…
The Hacker News
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails
2026-08-07 10:38 UTCcampaigncampaignCybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to…
The Hacker News
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
2026-08-07 10:09 UTCexploitedzero-dayPortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync…
The Hacker News
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
2026-08-07 08:52 UTCothermalwareEntra ID researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The…
The Hacker News
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
2026-08-07 06:50 UTCcampaigncampaignA new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising internet-facing infrastructure for years…
The Hacker News
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
2026-08-05 18:44 UTCtechniquemalwareA macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had…
Microsoft Security
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
2026-08-05 15:48 UTCindicators1 ip · 6 hashescampaignA macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. The change makes malicious infrastructure harder to detect while giving defenders new…
CISA
CISA Adds One Known Exploited Vulnerability to Catalog
2026-08-05 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability…
Microsoft Security
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET
2026-08-04 17:54 UTCindicators1 ip · 6 hashescompromisedMicrosoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread. The post 128 Seconds to disruption: Microsoft Defender…
Unit 42
The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software
2026-08-04 13:00 UTCexploitedzero-dayFrontier AI is reshaping vulnerability discovery. Learn how our NOVA system found 14,000+ unknown vulnerabilities across the open-source software supply chain. The post The Frontier AI Vulnerability Burst:…
Fortinet
QuickFox Supply Chain Attack Used to Deploy FDMTP Implant
2026-08-04 13:00 UTCindicators58 ip · 36 hashesincident responseThe FortiGuard Labs Incident Response team analyzes a QuickFox supply chain attack that used trojanized Windows installers, selective targeting, and an evolving FDMTP implant
CISA
CISA Adds Three Known Exploited Vulnerabilities to Catalog
2026-08-04 12:00 UTCexploitedknown exploitedCISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able…
CISA
CISA Adds One Known Exploited Vulnerability to Catalog
2026-08-03 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or…
Malware Traffic Analysis
2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT
2026-07-31 20:54 UTCindicators1 ip · 2 hashescampaign
Securelist
OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia
2026-07-30 11:00 UTCindicators11 ip · 58 hashescampaignOur experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.
Unit 42
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
2026-07-30 10:00 UTCindicatorsthreat actorUnit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more. The post Chinese-Speaking Threat Actor Harnesses AI Models for…
Securelist
Toy Ghouls’ new toy: the GenieLocker ransomware
2026-07-30 08:00 UTCindicators1 ip · 50 hashesextortionKaspersky experts dissect GenieLocker: new custom ransomware variants for Windows, Linux, and ESXi systems. We found this family in attacks by Toy Ghouls, a financially motivated extortion group.
CISA
CISA Adds One Known Exploited Vulnerability to Catalog
2026-07-29 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password…
Zscaler ThreatLabz
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor
2026-07-27 14:51 UTCindicators8 ip · 12 hashesthreat actorIntroductionZscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging…
Elastic Security Labs
New North Korean campaign uses fake coding interviews to steal developer credentials
2026-07-18 00:00 UTCindicators2 ip · 11 hashescampaignDPRK-aligned hackers hid malware inside SVG flag images to backdoor developer job interview coding tests. Not one antivirus vendor caught it.
Fortinet
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader
2026-07-16 13:00 UTCindicators5 ip · 34 hashescampaignFortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.
Cisco Talos
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
2026-07-16 10:00 UTCindicators2 ipcampaignCisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
Elastic Security Labs
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
2026-07-16 00:00 UTCindicators2 ip · 18 hashesmalwareTELEPUZ is a modular malware that emerged through CLICKFIX-VIDAR attacks in April. We reverse-engineered it to show you the infrastructure and evasion techniques that matter.
Zscaler ThreatLabz
ClaudeFix: Shared Claude Chats Meet ClickFix
2026-07-15 14:39 UTCindicators1 ip · 10 hashesClickFixIntroductionClickFix is a widely employed attack technique, first seen in 2024, where a victim is instructed to paste-and-run instructions on their system to “fix” a problem or install software. The seemingly benign…
Huntress
Threat Actors Achieve Persistence After SQL Injection
2026-07-13 13:00 UTCindicators15 hashesthreat actorSee how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.
Elastic Security Labs
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
2026-07-08 00:00 UTCindicators3 ip · 31 hashesClickFixElastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges.
Unit 42
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
2026-07-07 22:00 UTCindicators4 ip · 107 hashescampaignA cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders…
The DFIR Report
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
2026-06-29 13:07 UTCindicators11 ip · 9 hashesintrusionKey Takeaways This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied to…
Huntress
Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
2026-06-22 12:00 UTCindicators14 hashesphishingMove past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.
Zscaler ThreatLabz
SmartApeSG Launches Okendo Reviews Supply Chain Attack
2026-06-18 14:04 UTCindicators1 ip · 1 hashesthreat actorIntroductionOn May 14, 2026, the Zscaler ThreatLabz team identified unusually high activity associated with the threat actor SmartApeSG to deploy malware. During our examination, we discovered malicious JavaScript code…
Zscaler ThreatLabz
ClickFix Campaign Generated Via AI Delivers SmartRAT
2026-06-17 17:58 UTCindicators3 ip · 5 hashescampaignIntroductionIn March 2026, Zscaler ThreatLabz observed multiple instances of typosquatting domains hosting malicious content generated with AI-powered website creation tools. Threat actors are leveraging website…
Huntress
Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
2026-06-16 14:00 UTCindicators4 ip · 21 hashesloaderA ClickFix infection drops Potemkin loader and RMMProject RAT, leading to browser theft, hidden remote desktop, and lateral movement across over 11 hosts.
Zscaler ThreatLabz
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion
2026-06-12 21:14 UTCindicators1 ip · 4 hashescampaignIntroductionSince Zscaler ThreatLabz published its analysis of Shai-Hulud V2 in November 2025, the campaign has continued to evolve in ways that distinguish it from more typical software supply chain attacks. Over the…
Huntress
Inside Kali365, a Device Code Phishing Ecosystem | Huntress
2026-06-11 18:00 UTCindicators1 ip · 14 hashesphishingHuntress traced device code phishing from Tencent Cloud to Kali365, a Microsoft 365 kit that steals tokens and keeps access even after MFA or password resets.
Zscaler ThreatLabz
Technical Analysis of MLTBackdoor
2026-06-09 16:26 UTCindicators1 ip · 28 hashesthreat actorIntroductionIn May 2026, Zscaler ThreatLabz identified a new malware family that we track as MLTBackdoor that is likely leveraged by a ransomware-related threat actor. MLTBackdoor has been observed by ThreatLabz being…
Fortinet
Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data
2026-05-26 13:00 UTCindicators3 ip · 6 hashescampaignFortiGuard Labs analyzed a new phishing campaign that uses obfuscated JavaScript, PowerShell, process hollowing, and PureLogs to steal sensitive data
Huntress
The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
2026-05-21 07:00 UTCindicators2 ip · 15 hashesransomwareTwo recent incidents involving The Gentlemen ransomware show the use of defense evasion tactics, including logs being cleared and attempts to add antivirus exclusions.
Huntress
Threat Actor Defense Evasion: How Attackers Disable AV & EDR
2026-05-18 14:00 UTCindicators14 hashesthreat actorThreat actors are actively targeting your security tools. Learn how threat actors disable antivirus and EDR through vulnerable drivers, tampering attacks, and malicious firewall rules, and how Huntress detects.
The DFIR Report
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware
2026-05-11 14:05 UTCindicators1 ip · 18 hashesransomwareThe EtherRAT malware family was first reported by Sysdig back in December 2025. At that time, the initial access vector was exploitation of CVE-2025-55182 (React2Shell) targeting Linux servers. In March 2026, a Windows…
The DFIR Report
Apache ActiveMQ Exploit Leads to LockBit Ransomware
2026-02-23 14:09 UTCindicators2 ip · 5 hashesthreat actorKey Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon. This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an…
The DFIR Report
Cat’s Got Your Files: Lynx Ransomware
2025-12-17 19:07 UTCindicators2 ip · 10 hashesintrusionKey Takeaways The DFIR Report Services Contact us today for pricing or a demo! The intrusion began in early March 2025 with a single successful Remote Desktop Protocol (RDP) logon to an internet-exposed system. Notably,…

|New StormEncryptor ransomware used by former Medusa affiliate

|China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

|DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

|CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

|#StopRansomware: Gunra Ransomware

|Critical Progress LoadMaster flaw now actively exploited in attacks

|Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

|Metabase SQLi zero-day exploited in customer data-theft attacks

|ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

|CISA Adds One Known Exploited Vulnerability to Catalog

|Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

|AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

|Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

|TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

|Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

|From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

|CISA Adds One Known Exploited Vulnerability to Catalog

|128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

|The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software

|QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

|CISA Adds Three Known Exploited Vulnerabilities to Catalog

|CISA Adds One Known Exploited Vulnerability to Catalog

|2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT

|OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

|Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

|Toy Ghouls’ new toy: the GenieLocker ransomware

|CISA Adds One Known Exploited Vulnerability to Catalog

|Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

|New North Korean campaign uses fake coding interviews to steal developer credentials

|The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

|UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

|TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

|ClaudeFix: Shared Claude Chats Meet ClickFix

|Threat Actors Achieve Persistence After SQL Injection

|ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

|Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

|From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

|Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

|SmartApeSG Launches Okendo Reviews Supply Chain Attack

|ClickFix Campaign Generated Via AI Delivers SmartRAT

|Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

|Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion

|Inside Kali365, a Device Code Phishing Ecosystem | Huntress

|Technical Analysis of MLTBackdoor

|Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data

|The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress

|Threat Actor Defense Evasion: How Attackers Disable AV & EDR

|Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

|Apache ActiveMQ Exploit Leads to LockBit Ransomware

|Cat’s Got Your Files: Lynx Ransomware

New StormEncryptor ransomware used by former Medusa affiliate

China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

#StopRansomware: Gunra Ransomware

Critical Progress LoadMaster flaw now actively exploited in attacks

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase SQLi zero-day exploited in customer data-theft attacks

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

CISA Adds One Known Exploited Vulnerability to Catalog

Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

CISA Adds One Known Exploited Vulnerability to Catalog

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software

QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA Adds One Known Exploited Vulnerability to Catalog

2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Toy Ghouls’ new toy: the GenieLocker ransomware

CISA Adds One Known Exploited Vulnerability to Catalog

Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

New North Korean campaign uses fake coding interviews to steal developer credentials

The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

ClaudeFix: Shared Claude Chats Meet ClickFix

Threat Actors Achieve Persistence After SQL Injection

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

SmartApeSG Launches Okendo Reviews Supply Chain Attack

ClickFix Campaign Generated Via AI Delivers SmartRAT

Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion

Inside Kali365, a Device Code Phishing Ecosystem | Huntress

Technical Analysis of MLTBackdoor

Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data

The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress

Threat Actor Defense Evasion: How Attackers Disable AV & EDR

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

Apache ActiveMQ Exploit Leads to LockBit Ransomware

Cat’s Got Your Files: Lynx Ransomware