Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
62 articles
iRhythm suffered a ransomware attack resulting in the theft of patient data and a ransom demand. The incident highlights the ongoing targeting of healthcare organizations in North America.
Standard Bank suffered a ransomware attack by the Prinz Eugen group, resulting in encryption and exfiltration of data. Attackers prioritized recent files and left no ransom note, complicating response.
The Gentlemen ransomware-as-a-service operation compromised hundreds of organizations globally by deploying the GentleKiller EDR framework, disabling 400 security processes prior to ransomware deployment.
Romanian energy provider Oltenia suffered a ransomware attack by the Gentlemen group, who used multiple EDR killer tools—including the custom GentleKiller utility—to disable security defenses and enable widespread data encryption.
An unnamed US services firm suffered a critical ransomware attack by DragonForce, resulting in data encryption and exfiltration. The attackers leveraged Microsoft Teams relay servers for covert command-and-control.
An unnamed major U.S. services company suffered a critical ransomware attack by DragonForce, who leveraged Microsoft Teams TURN relays to hide command-and-control traffic. Attackers exfiltrated data and encrypted systems using custom malware and BYOVD techniques.
A global malicious infrastructure distributed EtherRAT ransomware and phishing pages, leveraging the Ethereum blockchain for resilient C2 communication. Attackers gained full remote access to compromised systems.
Conti ransomware operators, including Oleksii Lytvynenko, targeted over 1,000 computers and networks worldwide, leading to system encryption and data theft. The attacks resulted in at least $150 million in ransom payments and widespread operational disruption.
California Water Service suffered a ransomware attack by the Iran-linked Handala group, exposing 5GB of sensitive customer data and administrative credentials. The breach included compromise of the RTKBase GNSS platform and lateral movement to billing systems.
Conti ransomware operations, led in part by Oleksii Oleksiyovych Lytvynenko, compromised data from over 1,000 organizations worldwide, including healthcare, government, and enterprises. The group extorted over $150 million in ransoms and caused significant operational disruption.
The Gentlemen ransomware group, led by LARVA-368, compromised 478 organizations globally using worm-like propagation and double extortion tactics. Enterprise environments, especially in Thailand, the UK, Brazil, Germany, and India, were heavily impacted.
SilabRAT ransomware campaigns have enabled threat actors to hijack user sessions and steal cryptocurrency by bypassing multi-factor authentication. The malware’s use of browser profile cloning and hidden remote desktop access has resulted in high-severity financial theft globally.