Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
62 articles
A luxury jewelry retailer suffered a ransomware attack by Scattered Spider in May 2025, resulting in $2 million in losses from business disruption. The group demanded an $8 million ransom, which was not paid.
Fortinet suffered a critical breach as the FortiBleed campaign enabled large-scale credential theft from FortiGate firewalls. Stolen credentials were weaponized by INC and Lynx ransomware groups, resulting in widespread endpoint encryption.
Check Point Research identified InfernoGrabber v9.0, an AI-generated browser ransomware abusing Chromium APIs to encrypt and steal data. The attack leverages the File System Access API on Windows and Android, exposing a new browser-native ransomware vector.
Marks & Spencer, Co-op Group, and Jaguar Land Rover were among over 300 UK firms hit by ransomware between April 2025 and March 2026. Manufacturing, scientific, and education sectors saw significant operational and financial disruption.
Multiple Mexican government agencies, including SEDENA and SICT, suffered ransomware attacks and data breaches between 2022 and 2025, resulting in sensitive data leaks and operational disruptions.
KongTuke leveraged the Mistic backdoor to compromise organizations in insurance, education, IT, and professional services. The attack enabled persistent, covert access for ransomware deployment.
KongTuke-affiliated threat actors deployed the Mistic backdoor in ransomware campaigns targeting insurance, education, IT, and professional services sectors, enabling memory-resident code execution and stealthy long-term access.
Over 2,000 organizations in European manufacturing and IT services suffered ransomware attacks via third-party suppliers, with Qilin group exploiting supply chains to expose personal data of over one million individuals.
Transport for London suffered a high-severity ransomware attack by the Scattered Spider group in August 2024, causing service disruptions and operational compromise. Two men have pleaded guilty in the UK for their roles in the incident.
Woodgnat, an initial access broker, leveraged the new Mistic RAT to compromise organizations globally, enabling ransomware groups to infiltrate networks. The campaign targeted education, insurance, IT, and professional services sectors using advanced social engineering and lateral movement.
FFmpeg and downstream projects suffered a critical ransomware incident exploiting CVE-2026-8461, allowing remote code execution via crafted media files. Attackers leveraged the MagicYUV decoder flaw to compromise major media platforms.
The Gentlemen Ransomware-as-a-Service group deployed the GentleKiller framework to disable over 400 security products, including Microsoft Defender and CrowdStrike, prior to ransomware deployment. This allowed their attacks to bypass endpoint protection and increase impact across Southeast Asia, South America, and Western Europe.