Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
90 articles
Transport for London suffered a high-severity ransomware attack by the Scattered Spider group in August 2024, causing service disruptions and operational compromise. Two men have pleaded guilty in the UK for their roles in the incident.
Woodgnat, an initial access broker, leveraged the new Mistic RAT to compromise organizations globally, enabling ransomware groups to infiltrate networks. The campaign targeted education, insurance, IT, and professional services sectors using advanced social engineering and lateral movement.
FFmpeg and downstream projects suffered a critical ransomware incident exploiting CVE-2026-8461, allowing remote code execution via crafted media files. Attackers leveraged the MagicYUV decoder flaw to compromise major media platforms.
The Gentlemen Ransomware-as-a-Service group deployed the GentleKiller framework to disable over 400 security products, including Microsoft Defender and CrowdStrike, prior to ransomware deployment. This allowed their attacks to bypass endpoint protection and increase impact across Southeast Asia, South America, and Western Europe.
iRhythm suffered a ransomware attack resulting in the theft of patient data and a ransom demand. The incident highlights the ongoing targeting of healthcare organizations in North America.
Standard Bank suffered a ransomware attack by the Prinz Eugen group, resulting in encryption and exfiltration of data. Attackers prioritized recent files and left no ransom note, complicating response.
The Gentlemen ransomware-as-a-service operation compromised hundreds of organizations globally by deploying the GentleKiller EDR framework, disabling 400 security processes prior to ransomware deployment.
Romanian energy provider Oltenia suffered a ransomware attack by the Gentlemen group, who used multiple EDR killer tools—including the custom GentleKiller utility—to disable security defenses and enable widespread data encryption.
An unnamed US services firm suffered a critical ransomware attack by DragonForce, resulting in data encryption and exfiltration. The attackers leveraged Microsoft Teams relay servers for covert command-and-control.
An unnamed major U.S. services company suffered a critical ransomware attack by DragonForce, who leveraged Microsoft Teams TURN relays to hide command-and-control traffic. Attackers exfiltrated data and encrypted systems using custom malware and BYOVD techniques.
A global malicious infrastructure distributed EtherRAT ransomware and phishing pages, leveraging the Ethereum blockchain for resilient C2 communication. Attackers gained full remote access to compromised systems.
Conti ransomware operators, including Oleksii Lytvynenko, targeted over 1,000 computers and networks worldwide, leading to system encryption and data theft. The attacks resulted in at least $150 million in ransom payments and widespread operational disruption.