European Union
Global standards
US
UK
Australia
Netherlands
Ticker feed: Ransomware
On November 10, 2026, Recorded Future’s Insikt Group detailed GhostFrame, a new control panel and implant for VMware ESXi hypervisors. TAG-218, a group whose activity overlaps with Settra ransomware, uses it. GhostFrame exploits no bug, so operators need root on the host first. One panel can then switch off, snapshot, or remotely view the host’s VMs.
Its credential theft stands out. A module called sdkmon is built to capture later ESXi logins, and the bundled open-source VMkatz can pull NTLM hashes, Kerberos tickets, and NTDS.dit data from VM memory snapshots and disks, with no malware inside Windows guests. The implant also kills the ESXi firewall and execInstalledOnly about every five seconds, undoing admin fixes.
From late August to October 2026, TAG-218 servers targeted mostly SonicWall, Palo Alto Networks, and Fortinet VPN devices in the US and Europe, and four of the targeted organizations later appeared on Settra’s leak site. Insikt says other financially motivated groups will highly likely pick up GhostFrame or similar tools, and advises locking down ESXi management access, checking /etc/rc.local.d/local.sh, and flagging hosts that fire six near-simultaneous connections at one address.
Source: Cybersecurity News
On November 10, 2026, Recorded Future’s Insikt Group detailed GhostFrame, a new control panel and implant for VMware ESXi hypervisors. TAG-218, a group whose activity overlaps with Settra ransomware, uses it. GhostFrame exploits no bug, so operators need root on the host first. One panel can then switch off, snapshot, or remotely view the host’s VMs.
Its credential theft stands out. A module called sdkmon is built to capture later ESXi logins, and the bundled open-source VMkatz can pull NTLM hashes, Kerberos tickets, and NTDS.dit data from VM memory snapshots and disks, with no malware inside Windows guests. The implant also kills the ESXi firewall and execInstalledOnly about every five seconds, undoing admin fixes.
From late August to October 2026, TAG-218 servers targeted mostly SonicWall, Palo Alto Networks, and Fortinet VPN devices in the US and Europe, and four of the targeted organizations later appeared on Settra’s leak site. Insikt says other financially motivated groups will highly likely pick up GhostFrame or similar tools, and advises locking down ESXi management access, checking /etc/rc.local.d/local.sh, and flagging hosts that fire six near-simultaneous connections at one address.
Source: Cybersecurity News
Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN.
About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords.
OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password.
Source: SecurityWeek
Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN.
About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords.
OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password.
Source: SecurityWeek
Ransomware groups are exploiting a high-severity Palo Alto Networks GlobalProtect VPN vulnerability (CVE-2026-0257, CVSS 7.8) to bypass multi-factor authentication and break into corporate networks. Palo Alto’s Unit 42 links the attacks to Qilin and Inc ransomware, in cases since early June across healthcare, finance, government, manufacturing, and other sectors. The first exploitation was seen on May 17, four days after Palo Alto released a fix.
Only portals and gateways with authentication override cookies enabled are exposed, and only when the cookie certificate is also used for a public-facing service. Attackers take the public key from that service and forge a cookie the gateway accepts in place of a full login.
In one standout case, attackers reached VMware’s vCenter management system, disabled an ESXi security control, then pulled credentials directly from a domain controller’s virtual disk — completely sidestepping endpoint detection tools running inside the VM. Unit 42 also saw attackers pair this access with tools targeting Veeam backup systems through a separate known flaw, CVE-2023-27532.
Organizations should patch all affected GlobalProtect portals and gateways immediately; users will need to sign in again once afterward. As a temporary fix, disable authentication override cookies or generate a new certificate used only for them.
Source: Cybersecurity News
Ransomware groups are exploiting a high-severity Palo Alto Networks GlobalProtect VPN vulnerability (CVE-2026-0257, CVSS 7.8) to bypass multi-factor authentication and break into corporate networks. Palo Alto’s Unit 42 links the attacks to Qilin and Inc ransomware, in cases since early June across healthcare, finance, government, manufacturing, and other sectors. The first exploitation was seen on May 17, four days after Palo Alto released a fix.
Only portals and gateways with authentication override cookies enabled are exposed, and only when the cookie certificate is also used for a public-facing service. Attackers take the public key from that service and forge a cookie the gateway accepts in place of a full login.
In one standout case, attackers reached VMware’s vCenter management system, disabled an ESXi security control, then pulled credentials directly from a domain controller’s virtual disk — completely sidestepping endpoint detection tools running inside the VM. Unit 42 also saw attackers pair this access with tools targeting Veeam backup systems through a separate known flaw, CVE-2023-27532.
Organizations should patch all affected GlobalProtect portals and gateways immediately; users will need to sign in again once afterward. As a temporary fix, disable authentication override cookies or generate a new certificate used only for them.
Source: Cybersecurity News
German police have detained Vladimir K., a 28-year-old Russian national accused of being a core member of the Qilin cybercrime gang. Japanese police arrested him in May on a German warrant over a September 2024 ransomware attack on a logistics company, and Japan handed him over to Germany on October 2. German investigators are now including the 2024 Synnovis hack in their inquiry.
Qilin hit Synnovis, a blood testing company serving several London hospitals, in June 2024. The attack disrupted more than 10 000 appointments, and the delays it caused contributed to a patient’s death — reported as the first cyberattack in history directly linked to a fatality.
Qilin has allegedly hacked nearly 4 000 organizations since 2024, extorting over $140 million. Separately, British police are examining whether their own inquiry could lead to an unlawful killing case — potentially a world first in cybercrime prosecution.
Source: BBC News
German police have detained Vladimir K., a 28-year-old Russian national accused of being a core member of the Qilin cybercrime gang. Japanese police arrested him in May on a German warrant over a September 2024 ransomware attack on a logistics company, and Japan handed him over to Germany on October 2. German investigators are now including the 2024 Synnovis hack in their inquiry.
Qilin hit Synnovis, a blood testing company serving several London hospitals, in June 2024. The attack disrupted more than 10 000 appointments, and the delays it caused contributed to a patient’s death — reported as the first cyberattack in history directly linked to a fatality.
Qilin has allegedly hacked nearly 4 000 organizations since 2024, extorting over $140 million. Separately, British police are examining whether their own inquiry could lead to an unlawful killing case — potentially a world first in cybercrime prosecution.
Source: BBC News
A Kansas City man is heading to federal prison after sabotaging the company he worked for and demanding 20 bitcoin, worth roughly $750,000 at the time. Daniel Rhyne, 59, was a core infrastructure engineer at a New Jersey industrial firm when he secretly scheduled tasks on the company’s domain controller in November 2023.
The tasks deleted 13 domain administrator accounts, reset 301 domain user passwords, and changed local administrator passwords affecting 254 servers and 3 284 workstations — mostly to “TheFr0zenCrew!”. Within an hour, employees received an email from an outside address claiming admins were locked out and backups destroyed, and threatening to shut down 40 random servers a day for ten days unless the company paid.
The company didn’t pay. It ran its own forensic analysis, matched internal logs against physical access records, and brought in the FBI, which traced the activity to Rhyne’s home IP address. Agents filed a criminal complaint in August 2024 and arrested him later that month in Kansas City, where he had since moved.
Rhyne pleaded guilty in April to extortion and intentional damage to a protected computer. He was sentenced on September 28, 2026 to 32 months in federal prison.
Source: SecurityWeek
A Kansas City man is heading to federal prison after sabotaging the company he worked for and demanding 20 bitcoin, worth roughly $750,000 at the time. Daniel Rhyne, 59, was a core infrastructure engineer at a New Jersey industrial firm when he secretly scheduled tasks on the company’s domain controller in November 2023.
The tasks deleted 13 domain administrator accounts, reset 301 domain user passwords, and changed local administrator passwords affecting 254 servers and 3 284 workstations — mostly to “TheFr0zenCrew!”. Within an hour, employees received an email from an outside address claiming admins were locked out and backups destroyed, and threatening to shut down 40 random servers a day for ten days unless the company paid.
The company didn’t pay. It ran its own forensic analysis, matched internal logs against physical access records, and brought in the FBI, which traced the activity to Rhyne’s home IP address. Agents filed a criminal complaint in August 2024 and arrested him later that month in Kansas City, where he had since moved.
Rhyne pleaded guilty in April to extortion and intentional damage to a protected computer. He was sentenced on September 28, 2026 to 32 months in federal prison.
Source: SecurityWeek
For roughly five months, Revolut handed customer records to an attacker impersonating a government agency. The fraudulent legal requests went to Revolut Bank UAB, the Lithuanian subsidiary, from a compromised Italian Ministry of the Interior mailbox, which is why they cleared authentication and were processed as routine.
Hudson Rock traced the access to infostealer malware on a ministry employee's machine, and assesses the attacker probably bought those credentials rather than deploying the malware. The attacker, who uses the handle IAmNotAVillain, claims 680 accounts held by cryptocurrency whales, with files containing passports, verification selfies, and full Bitcoin transaction histories. Revolut has still not confirmed a victim count.
The extortion came next. An initial demand of 10,000 Bitcoin, around $780 million, was cut to 6,000 Monero, roughly $3 million, with a 24-hour deadline to sell the files to other criminal groups. Revolut says it has had no direct contact from anyone making the claims, and notified affected customers on September 12.
Source: SecurityWeek
For roughly five months, Revolut handed customer records to an attacker impersonating a government agency. The fraudulent legal requests went to Revolut Bank UAB, the Lithuanian subsidiary, from a compromised Italian Ministry of the Interior mailbox, which is why they cleared authentication and were processed as routine.
Hudson Rock traced the access to infostealer malware on a ministry employee's machine, and assesses the attacker probably bought those credentials rather than deploying the malware. The attacker, who uses the handle IAmNotAVillain, claims 680 accounts held by cryptocurrency whales, with files containing passports, verification selfies, and full Bitcoin transaction histories. Revolut has still not confirmed a victim count.
The extortion came next. An initial demand of 10,000 Bitcoin, around $780 million, was cut to 6,000 Monero, roughly $3 million, with a 24-hour deadline to sell the files to other criminal groups. Revolut says it has had no direct contact from anyone making the claims, and notified affected customers on September 12.
Source: SecurityWeek
Expel researcher Marcus Hutchins and colleagues found SynkLoader in a client's network on August 18, 2026, and believe it was first deployed around July 28. It spreads through Microsoft Teams messages in which the attacker poses as the target company's own IT help desk, steering users to a fake "PowerShell Cleaner" installer hosted on Azure storage.
The toolkit pairs a bundled Python environment with DLLs disguised as Microsoft runtime files, running native Windows behaviour inside Python processes to cut the signals EDR relies on. Its PhishLocker module raises a fake Windows lock screen and traps the user until they enter a password — and in SSO environments, that credential opens more than the desktop.
PhishLocker is one of seven modules; the others include a remote shell, a reverse proxy into the internal network, and desktop streaming with input takeover. A profiler module counts the size of the victim's Active Directory domain — the reconnaissance ransomware crews use to size a ransom demand.
Expel puts only low-to-medium confidence on its assessment that the toolkit belongs to a ransomware group or an initial access broker. In the meantime, verify help-desk requests through a known channel, treat unsolicited MSI installers as hostile, and if a lock screen appears unexpectedly, hit Alt+Tab — the fake one is just a window.
Source: Dark Reading
Expel researcher Marcus Hutchins and colleagues found SynkLoader in a client's network on August 18, 2026, and believe it was first deployed around July 28. It spreads through Microsoft Teams messages in which the attacker poses as the target company's own IT help desk, steering users to a fake "PowerShell Cleaner" installer hosted on Azure storage.
The toolkit pairs a bundled Python environment with DLLs disguised as Microsoft runtime files, running native Windows behaviour inside Python processes to cut the signals EDR relies on. Its PhishLocker module raises a fake Windows lock screen and traps the user until they enter a password — and in SSO environments, that credential opens more than the desktop.
PhishLocker is one of seven modules; the others include a remote shell, a reverse proxy into the internal network, and desktop streaming with input takeover. A profiler module counts the size of the victim's Active Directory domain — the reconnaissance ransomware crews use to size a ransom demand.
Expel puts only low-to-medium confidence on its assessment that the toolkit belongs to a ransomware group or an initial access broker. In the meantime, verify help-desk requests through a known channel, treat unsolicited MSI installers as hostile, and if a lock screen appears unexpectedly, hit Alt+Tab — the fake one is just a window.
Source: Dark Reading
A Gambit Security report has revealed one of the most detailed real-world cases of AI being weaponized inside an active ransomware operation. A suspected affiliate of The Gentlemen ransomware-as-a-service group used Anthropic's Claude Code to breach VPN appliances, steal domain credentials, and exfiltrate SQL databases across at least eight organizations — including an Australian energy utility and a Mauritius financial firm.
The attacker used Claude Sonnet 4.6, an older, less-restricted model, interactively refining commands based on live output. Claude executed a sophisticated LDAP pass-back attack, created hidden backdoor VPN accounts, and ranked databases by business value before dumping them. At one point, Claude accidentally knocked a firewall offline, then logged: "Yeah, I screwed up."
This marks a clear shift — AI isn't just drafting phishing emails anymore. It's running live attacks.
Source: Cybersecurity News
A Gambit Security report has revealed one of the most detailed real-world cases of AI being weaponized inside an active ransomware operation. A suspected affiliate of The Gentlemen ransomware-as-a-service group used Anthropic's Claude Code to breach VPN appliances, steal domain credentials, and exfiltrate SQL databases across at least eight organizations — including an Australian energy utility and a Mauritius financial firm.
The attacker used Claude Sonnet 4.6, an older, less-restricted model, interactively refining commands based on live output. Claude executed a sophisticated LDAP pass-back attack, created hidden backdoor VPN accounts, and ranked databases by business value before dumping them. At one point, Claude accidentally knocked a firewall offline, then logged: "Yeah, I screwed up."
This marks a clear shift — AI isn't just drafting phishing emails anymore. It's running live attacks.
Source: Cybersecurity News
Six US and South Korean agencies, including CISA, the FBI, the NSA, and Korea's National Police Agency, issued joint advisory AA26-222A on Monday, August 10, about Gunra, a ransomware gang that emerged in spring 2025 and has been hitting critical infrastructure worldwide. Built on leaked Conti source code, it added a Dark Web affiliate program in early 2026.
The FBI observed Gunra exploiting two Fortinet authentication bypass flaws — CVE-2024-55591 (CVSS 9.8, critical) and CVE-2025-24472 (8.1, high) — to gain initial access. Both affect FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12, and both have been in CISA's KEV catalog since early 2025, with deadlines that expired in January and April that year.
Attackers also hijacked VPN sessions, stole cookies, and modified authentication processing files on the corporate VDI portal server so that one Gunra-designated one-time password value always succeeded, leaving every login looking legitimate to the identity provider. Backups at both the primary data center and the disaster recovery site were deleted before encryption.
The advisory does carry a recovery route for Linux victims. Breakglass Intelligence found that Gunra's Linux build seeds its random number generator with srand(time(NULL)) — the system clock in seconds when encryption began — allowing the key to be reconstructed from the encrypted files' timestamps. Rebooting, overwriting, or wiping the system destroys that option.
Victims span healthcare, finance, manufacturing, transportation, and government, from South Korea and Brazil to Spain, Australia, and North America. Agencies urge upgrading FortiOS to 7.0.17 or later and FortiProxy to 7.0.20 or 7.2.13, maintaining immutable backups in physically separate locations, and network segmentation.
Source: Dark Reading
Six US and South Korean agencies, including CISA, the FBI, the NSA, and Korea's National Police Agency, issued joint advisory AA26-222A on Monday, August 10, about Gunra, a ransomware gang that emerged in spring 2025 and has been hitting critical infrastructure worldwide. Built on leaked Conti source code, it added a Dark Web affiliate program in early 2026.
The FBI observed Gunra exploiting two Fortinet authentication bypass flaws — CVE-2024-55591 (CVSS 9.8, critical) and CVE-2025-24472 (8.1, high) — to gain initial access. Both affect FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12, and both have been in CISA's KEV catalog since early 2025, with deadlines that expired in January and April that year.
Attackers also hijacked VPN sessions, stole cookies, and modified authentication processing files on the corporate VDI portal server so that one Gunra-designated one-time password value always succeeded, leaving every login looking legitimate to the identity provider. Backups at both the primary data center and the disaster recovery site were deleted before encryption.
The advisory does carry a recovery route for Linux victims. Breakglass Intelligence found that Gunra's Linux build seeds its random number generator with srand(time(NULL)) — the system clock in seconds when encryption began — allowing the key to be reconstructed from the encrypted files' timestamps. Rebooting, overwriting, or wiping the system destroys that option.
Victims span healthcare, finance, manufacturing, transportation, and government, from South Korea and Brazil to Spain, Australia, and North America. Agencies urge upgrading FortiOS to 7.0.17 or later and FortiProxy to 7.0.20 or 7.2.13, maintaining immutable backups in physically separate locations, and network segmentation.
Source: Dark Reading
The Orleans Parish Sheriff's Office has been hit by a ransomware attack from international cybercrime group Qilin, who breached systems three weeks ago and are demanding payment. The hackers obtained 842 gigabytes of data including contracts, inmate documents, and expense records, though no sensitive information appears compromised.
The attack has disrupted the DocketMaster system that handles inmate transfers and releases, forcing families like one woman whose husband remains jailed despite paying bond to wait longer. "I have two sons, four and six years old. They miss their dad," she told local news.
Officials are using manual workarounds and refuse to pay the ransom. The malware reportedly came through email from another law enforcement agency.
Source: CBS News
The Orleans Parish Sheriff's Office has been hit by a ransomware attack from international cybercrime group Qilin, who breached systems three weeks ago and are demanding payment. The hackers obtained 842 gigabytes of data including contracts, inmate documents, and expense records, though no sensitive information appears compromised.
The attack has disrupted the DocketMaster system that handles inmate transfers and releases, forcing families like one woman whose husband remains jailed despite paying bond to wait longer. "I have two sons, four and six years old. They miss their dad," she told local news.
Officials are using manual workarounds and refuse to pay the ransom. The malware reportedly came through email from another law enforcement agency.
Source: CBS News
