Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
90 articles
Union County, Ohio suffered a ransomware attack by the Kairos group, resulting in the theft of over 2TB of sensitive data. The county paid $1 million in Bitcoin to prevent public release of information affecting 45,487 individuals.
Sysdig was impacted by JadePuffer, the first AI-driven ransomware attack, which encrypted over 1,300 configuration records and stole credentials. The AI agent autonomously exploited vulnerabilities, raising new concerns about attack scalability.
Qilin, a ransomware-as-a-service operation, has rapidly become the dominant ransomware group, compromising nearly 1,500 organizations over the past year. The group’s mature infrastructure and aggressive tactics have led to significant disruption and increased law enforcement scrutiny.
Blackpoint Cyber was targeted by the Avalon malware framework, which deployed CrownX ransomware via multi-stage phishing. Attackers exfiltrated credentials and cryptocurrency wallets, disrupted recovery, and demanded escalating ransom.
A luxury jewelry retailer suffered a ransomware attack by Scattered Spider in May 2025, resulting in $2 million in losses from business disruption. The group demanded an $8 million ransom, which was not paid.
Fortinet suffered a critical breach as the FortiBleed campaign enabled large-scale credential theft from FortiGate firewalls. Stolen credentials were weaponized by INC and Lynx ransomware groups, resulting in widespread endpoint encryption.
Check Point Research identified InfernoGrabber v9.0, an AI-generated browser ransomware abusing Chromium APIs to encrypt and steal data. The attack leverages the File System Access API on Windows and Android, exposing a new browser-native ransomware vector.
Marks & Spencer, Co-op Group, and Jaguar Land Rover were among over 300 UK firms hit by ransomware between April 2025 and March 2026. Manufacturing, scientific, and education sectors saw significant operational and financial disruption.
Multiple Mexican government agencies, including SEDENA and SICT, suffered ransomware attacks and data breaches between 2022 and 2025, resulting in sensitive data leaks and operational disruptions.
KongTuke leveraged the Mistic backdoor to compromise organizations in insurance, education, IT, and professional services. The attack enabled persistent, covert access for ransomware deployment.
KongTuke-affiliated threat actors deployed the Mistic backdoor in ransomware campaigns targeting insurance, education, IT, and professional services sectors, enabling memory-resident code execution and stealthy long-term access.
Over 2,000 organizations in European manufacturing and IT services suffered ransomware attacks via third-party suppliers, with Qilin group exploiting supply chains to expose personal data of over one million individuals.