Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
62 articles
Thai Seng International Co. Ltd suffered a ransomware attack by the nightspire group, resulting in the encryption of administration and marketing data. Client information was compromised and business operations were disrupted.
Turkish manufacturer iw steelTEC Makine San. ve Tic. A.,Ş. suffered a ransomware attack by Doommageddon, resulting in a 100 GB data leak. The group set a ransom deadline for March 8, 2026.
Jubilee Jobs, a Nigerian professional services firm, suffered a high-severity ransomware attack by the Qilin group. The incident resulted in data encryption and significant disruption to company systems.
Bank of Baroda suffered a critical ransomware attack by the Triple X group, exposing up to 1TB of sensitive customer data. The breach includes banking records, netbanking access details, and identity documents, impacting hundreds of thousands of customers.
Record Go Alquiler, a hospitality company in Argentina, suffered a ransomware attack by the Play group. System access was blocked and data encrypted, causing significant operational disruption.
Recsa, a Costa Rican organization, was targeted by the Qilin ransomware group, resulting in unauthorized access and file encryption. The incident was publicly claimed by Qilin, though Recsa has not confirmed the breach.
Langflow suffered a critical ransomware attack exploiting CVE-2025-3248, allowing the JADEPUFFER group to deploy ENCFORGE and encrypt AI model files, vector indexes, and training datasets. The attack leveraged a remote code execution flaw to disrupt AI infrastructure with no evidence of data exfiltration.
SonicWall customers experienced ransomware attacks after threat actors exploited two critical zero-day vulnerabilities in SMA1000 appliances. At least seven organizations suffered root compromise and credential theft.
Medibank Private suffered a ransomware breach attributed to REvil, with Armenia detaining a Russian tourist allegedly linked to the attack. The incident underscores ongoing international law enforcement efforts and potential mistaken identity concerns.
Land and Agricultural Development Bank of South Africa and 186 other government organizations were hit by ransomware, causing widespread service disruption. Notably, attackers demanded $3.1 million from the South African bank.
Thyssenkrupp Marine Systems and its subsidiary Atlas Elektronik suffered a ransomware attack by The Gentlemen, resulting in over 1TB of data exfiltrated. The breach was contained to an isolated North American unit, limiting classified data exposure.
Transport for London suffered a critical ransomware attack in 2024, compromising personal and financial data of 5,000 individuals and disrupting 148 systems. Attackers Owen Flowers and Thalha Jubair were sentenced to 5.5 years for their roles.