Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
90 articles
Medibank Private suffered a ransomware breach attributed to REvil, with Armenia detaining a Russian tourist allegedly linked to the attack. The incident underscores ongoing international law enforcement efforts and potential mistaken identity concerns.
Land and Agricultural Development Bank of South Africa and 186 other government organizations were hit by ransomware, causing widespread service disruption. Notably, attackers demanded $3.1 million from the South African bank.
Thyssenkrupp Marine Systems and its subsidiary Atlas Elektronik suffered a ransomware attack by The Gentlemen, resulting in over 1TB of data exfiltrated. The breach was contained to an isolated North American unit, limiting classified data exposure.
Transport for London suffered a critical ransomware attack in 2024, compromising personal and financial data of 5,000 individuals and disrupting 148 systems. Attackers Owen Flowers and Thalha Jubair were sentenced to 5.5 years for their roles.
Progress has directed ShareFile customers to immediately shut down Storage Zone Controllers following a credible ransomware threat. No unauthorized access or data compromise has been confirmed, but account access has been restricted as a precaution.
Langflow suffered a critical ransomware incident when the JadePuffer campaign exploited CVE-2025-3248, leading to the autonomous encryption and deletion of 1342 Alibaba Nacos service configurations. The attack was fully orchestrated by a large language model, compressing multi-stage operations into minutes and leaving no possibility of data recovery.
DigitalMint suffered a critical ransomware incident after an insider leaked confidential negotiation data to BlackCat, resulting in higher extortion demands. The breach also implicated Sygnia Cybersecurity Services and led to $1.2 million in losses.
Multiple U.S. organizations, including a Michigan company, an Oregon technology firm, and a Texas school, suffered data encryption and operational disruption after Ryuk ransomware attacks orchestrated by Karen Serobovich Vardanyan. Victims paid over $15 million in Bitcoin ransoms.
Multiple organizations worldwide were compromised through Citrix NetScaler appliances, with at least one suffering DragonForce ransomware deployment following privilege escalation via CitrixBleed 2.
The Gentlemen ransomware group compromised over 580 organizations worldwide, including 103 manufacturing firms, using custom malware and zero-day exploits. Their attacks caused widespread operational disruption and leveraged a Ransomware-as-a-Service model.
A targeted organization suffered a GodDamn ransomware attack in June 2026, with threat actors using the PoisonX driver to disable endpoint defenses and facilitate widespread data encryption.
Bandai Channel suffered a critical ransomware attack orchestrated by the autonomous AI JadePuffer, resulting in service disruption and nearly 47,000 anime streaming subscriptions being cancelled. The incident marks a significant escalation in the use of AI for fully automated cyberattacks.