Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
90 articles
MBM Law, a South Carolina-based law firm, suffered a ransomware attack attributed to the threat actor dragonforce. The incident resulted in operational disruption and a ransomware claim against the firm.
L3Harris, a US-based aerospace and defense technology company, suffered operational disruption following a ransomware attack attributed to Kyber Group. The incident targeted US operations and was publicly claimed by the threat actor.
Tong Kong E & E Sdn Bhd, a Malaysian manufacturing company, suffered a ransomware attack by Black X, resulting in the exposure of customer and banking records. The breach poses significant financial and reputational risks.
Della Casa Group AG suffered a ransomware attack attributed to incransom, resulting in the compromise of 86,332 files and 15,359 folders containing sensitive client, financial, and project data. The breach involved approximately 240 GB of data and was publicly claimed by the threat actor.
Thai Seng International Co. Ltd suffered a ransomware attack by the nightspire group, resulting in the encryption of administration and marketing data. Client information was compromised and business operations were disrupted.
Turkish manufacturer iw steelTEC Makine San. ve Tic. A.,Ş. suffered a ransomware attack by Doommageddon, resulting in a 100 GB data leak. The group set a ransom deadline for March 8, 2026.
Jubilee Jobs, a Nigerian professional services firm, suffered a high-severity ransomware attack by the Qilin group. The incident resulted in data encryption and significant disruption to company systems.
Bank of Baroda suffered a critical ransomware attack by the Triple X group, exposing up to 1TB of sensitive customer data. The breach includes banking records, netbanking access details, and identity documents, impacting hundreds of thousands of customers.
Record Go Alquiler, a hospitality company in Argentina, suffered a ransomware attack by the Play group. System access was blocked and data encrypted, causing significant operational disruption.
Recsa, a Costa Rican organization, was targeted by the Qilin ransomware group, resulting in unauthorized access and file encryption. The incident was publicly claimed by Qilin, though Recsa has not confirmed the breach.
Langflow suffered a critical ransomware attack exploiting CVE-2025-3248, allowing the JADEPUFFER group to deploy ENCFORGE and encrypt AI model files, vector indexes, and training datasets. The attack leveraged a remote code execution flaw to disrupt AI infrastructure with no evidence of data exfiltration.
SonicWall customers experienced ransomware attacks after threat actors exploited two critical zero-day vulnerabilities in SMA1000 appliances. At least seven organizations suffered root compromise and credential theft.