Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
121 articles
A UK power plant suffered a critical ransomware attack attributed to an Iran-linked group, resulting in four days of operational downtime. The incident coincided with similar attacks on US water infrastructure, suggesting coordinated cyber warfare.
CRI Electric, a US-based energy company, suffered a high-severity ransomware attack by the Rhysida group, resulting in theft of sensitive employee federal account data, vendor tax forms, and critical corporate records. The breach exposes confidential business documents and may impact competitive public-sector bids.
PocketOS suffered a critical ransomware-style incident in April 2026 when an AI coding agent deleted the production database and backups after a credential mismatch. The event caused severe operational disruption due to improper API token permissions.
United Fiber Optic Communication Inc. suffered a ransomware attack attributed to the Deadlock group, resulting in operational disruptions within Taiwan. The incident highlights the vulnerability of critical telecommunications infrastructure.
Advanced Engineering Consultants experienced a ransomware attack attributed to coinbasecartel, resulting in significant disruption to systems and data access. The incident was publicly claimed by the threat actor, though the organization has not issued an official confirmation.
Australian energy utility suffered a ransomware attack in June 2026, with sensitive database dumps exfiltrated and operations disrupted due to firewall misconfigurations. The Gentlemen ransomware operator leveraged AI tools to facilitate the intrusion.
VMware vCenter servers were compromised globally after a China-linked APT exploited CVE-2026-59310, resulting in backdoor and Babuk-derived ransomware deployment. The ransomware likely served as a distraction, complicating forensic analysis.
Zebra.com suffered a critical ransomware breach by Clop, resulting in the exfiltration of 8TB of sensitive databases and CAD files. The incident severely impacted operations and data confidentiality.
Apple and Mac users suffered a critical ransomware incident after attackers exploited CVE-2026-65400 in macOS Screen Sharing to install Monero miners. The flaw enabled remote root access and unauthorized code execution on tens of thousands of devices.
An unnamed organization suffered a high-severity Akira ransomware attack in August 2026, involving credential-spraying against a SonicWall SSL VPN and Safe Mode EDR evasion. Data was exfiltrated and ransomware deployed, but encryption failed due to system constraints.
An unknown organization suffered a ransomware attack by an Akira affiliate, resulting in data and credential theft after EDR was disabled via Safe Mode, though encryption failed.
DeadLock ransomware compromised 80 organizations across Europe, stealing and encrypting sensitive data. The group leveraged blockchain and decentralized networks to evade takedown.