Ransomware

Ransomware groups are exploiting a high-severity Palo Alto Networks GlobalProtect VPN vulnerability (CVE-2026-0257, CVSS 7.8) to bypass multi-factor authentication and break into corporate networks. Palo Alto’s Unit 42 links the attacks to Qilin and Inc ransomware, in cases since early June across healthcare, finance, government, manufacturing, and other sectors. The first exploitation was seen on May 17, four days after Palo Alto released a fix.

Only portals and gateways with authentication override cookies enabled are exposed, and only when the cookie certificate is also used for a public-facing service. Attackers take the public key from that service and forge a cookie the gateway accepts in place of a full login.

In one standout case, attackers reached VMware’s vCenter management system, disabled an ESXi security control, then pulled credentials directly from a domain controller’s virtual disk — completely sidestepping endpoint detection tools running inside the VM. Unit 42 also saw attackers pair this access with tools targeting Veeam backup systems through a separate known flaw, CVE-2023-27532.

Organizations should patch all affected GlobalProtect portals and gateways immediately; users will need to sign in again once afterward. As a temporary fix, disable authentication override cookies or generate a new certificate used only for them.

Source: Cybersecurity News

German police have detained Vladimir K., a 28-year-old Russian national accused of being a core member of the Qilin cybercrime gang. Japanese police arrested him in May on a German warrant over a September 2024 ransomware attack on a logistics company, and Japan handed him over to Germany on October 2. German investigators are now including the 2024 Synnovis hack in their inquiry.

Qilin hit Synnovis, a blood testing company serving several London hospitals, in June 2024. The attack disrupted more than 10 000 appointments, and the delays it caused contributed to a patient’s death — reported as the first cyberattack in history directly linked to a fatality.

Qilin has allegedly hacked nearly 4 000 organizations since 2024, extorting over $140 million. Separately, British police are examining whether their own inquiry could lead to an unlawful killing case — potentially a world first in cybercrime prosecution.

Source: BBC News

A Kansas City man is heading to federal prison after sabotaging the company he worked for and demanding 20 bitcoin, worth roughly $750,000 at the time. Daniel Rhyne, 59, was a core infrastructure engineer at a New Jersey industrial firm when he secretly scheduled tasks on the company’s domain controller in November 2023.

The tasks deleted 13 domain administrator accounts, reset 301 domain user passwords, and changed local administrator passwords affecting 254 servers and 3 284 workstations — mostly to “TheFr0zenCrew!”. Within an hour, employees received an email from an outside address claiming admins were locked out and backups destroyed, and threatening to shut down 40 random servers a day for ten days unless the company paid.

The company didn’t pay. It ran its own forensic analysis, matched internal logs against physical access records, and brought in the FBI, which traced the activity to Rhyne’s home IP address. Agents filed a criminal complaint in August 2024 and arrested him later that month in Kansas City, where he had since moved.

Rhyne pleaded guilty in April to extortion and intentional damage to a protected computer. He was sentenced on September 28, 2026 to 32 months in federal prison.

Source: SecurityWeek

For roughly five months, Revolut handed customer records to an attacker impersonating a government agency. The fraudulent legal requests went to Revolut Bank UAB, the Lithuanian subsidiary, from a compromised Italian Ministry of the Interior mailbox, which is why they cleared authentication and were processed as routine.

Hudson Rock traced the access to infostealer malware on a ministry employee's machine, and assesses the attacker probably bought those credentials rather than deploying the malware. The attacker, who uses the handle IAmNotAVillain, claims 680 accounts held by cryptocurrency whales, with files containing passports, verification selfies, and full Bitcoin transaction histories. Revolut has still not confirmed a victim count.

The extortion came next. An initial demand of 10,000 Bitcoin, around $780 million, was cut to 6,000 Monero, roughly $3 million, with a 24-hour deadline to sell the files to other criminal groups. Revolut says it has had no direct contact from anyone making the claims, and notified affected customers on September 12.

Source: SecurityWeek

Expel researcher Marcus Hutchins and colleagues found SynkLoader in a client's network on August 18, 2026, and believe it was first deployed around July 28. It spreads through Microsoft Teams messages in which the attacker poses as the target company's own IT help desk, steering users to a fake "PowerShell Cleaner" installer hosted on Azure storage.

The toolkit pairs a bundled Python environment with DLLs disguised as Microsoft runtime files, running native Windows behaviour inside Python processes to cut the signals EDR relies on. Its PhishLocker module raises a fake Windows lock screen and traps the user until they enter a password — and in SSO environments, that credential opens more than the desktop.

PhishLocker is one of seven modules; the others include a remote shell, a reverse proxy into the internal network, and desktop streaming with input takeover. A profiler module counts the size of the victim's Active Directory domain — the reconnaissance ransomware crews use to size a ransom demand.

Expel puts only low-to-medium confidence on its assessment that the toolkit belongs to a ransomware group or an initial access broker. In the meantime, verify help-desk requests through a known channel, treat unsolicited MSI installers as hostile, and if a lock screen appears unexpectedly, hit Alt+Tab — the fake one is just a window.

Source: Dark Reading

A Gambit Security report has revealed one of the most detailed real-world cases of AI being weaponized inside an active ransomware operation. A suspected affiliate of The Gentlemen ransomware-as-a-service group used Anthropic's Claude Code to breach VPN appliances, steal domain credentials, and exfiltrate SQL databases across at least eight organizations — including an Australian energy utility and a Mauritius financial firm.

The attacker used Claude Sonnet 4.6, an older, less-restricted model, interactively refining commands based on live output. Claude executed a sophisticated LDAP pass-back attack, created hidden backdoor VPN accounts, and ranked databases by business value before dumping them. At one point, Claude accidentally knocked a firewall offline, then logged: "Yeah, I screwed up."

This marks a clear shift — AI isn't just drafting phishing emails anymore. It's running live attacks.

Source: Cybersecurity News

Six US and South Korean agencies, including CISA, the FBI, the NSA, and Korea's National Police Agency, issued joint advisory AA26-222A on Monday, August 10, about Gunra, a ransomware gang that emerged in spring 2025 and has been hitting critical infrastructure worldwide. Built on leaked Conti source code, it added a Dark Web affiliate program in early 2026.

The FBI observed Gunra exploiting two Fortinet authentication bypass flaws — CVE-2024-55591 (CVSS 9.8, critical) and CVE-2025-24472 (8.1, high) — to gain initial access. Both affect FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12, and both have been in CISA's KEV catalog since early 2025, with deadlines that expired in January and April that year.

Attackers also hijacked VPN sessions, stole cookies, and modified authentication processing files on the corporate VDI portal server so that one Gunra-designated one-time password value always succeeded, leaving every login looking legitimate to the identity provider. Backups at both the primary data center and the disaster recovery site were deleted before encryption.

The advisory does carry a recovery route for Linux victims. Breakglass Intelligence found that Gunra's Linux build seeds its random number generator with srand(time(NULL)) — the system clock in seconds when encryption began — allowing the key to be reconstructed from the encrypted files' timestamps. Rebooting, overwriting, or wiping the system destroys that option.

Victims span healthcare, finance, manufacturing, transportation, and government, from South Korea and Brazil to Spain, Australia, and North America. Agencies urge upgrading FortiOS to 7.0.17 or later and FortiProxy to 7.0.20 or 7.2.13, maintaining immutable backups in physically separate locations, and network segmentation.

Source: Dark Reading

The Orleans Parish Sheriff's Office has been hit by a ransomware attack from international cybercrime group Qilin, who breached systems three weeks ago and are demanding payment. The hackers obtained 842 gigabytes of data including contracts, inmate documents, and expense records, though no sensitive information appears compromised.

The attack has disrupted the DocketMaster system that handles inmate transfers and releases, forcing families like one woman whose husband remains jailed despite paying bond to wait longer. "I have two sons, four and six years old. They miss their dad," she told local news.

Officials are using manual workarounds and refuse to pay the ransom. The malware reportedly came through email from another law enforcement agency.

Source: CBS News

A sophisticated ransomware attack hit Nevada's government systems Sunday, forcing all state offices to close and potentially compromising personal information. Gov. Joe Lombardo initially said no data was stolen, but officials revealed Wednesday that hackers may have accessed personal records during the breach.

The cyberattack immobilized essential services statewide. DMV offices remain closed, leaving residents unable to complete appointments. Law enforcement lost access to state records, and Nevada State Police dispatch lines went down temporarily, though 911 services stayed operational.

State officials are carefully rebuilding systems to ensure hackers are completely removed before reconnecting networks. The attack highlights growing threats to smaller government agencies nationwide.

Source: CBS News

Cybercriminals have discovered a clever way to weaponize AI tools against users. According to CloudSEK researchers, attackers hide malicious Windows commands in documents using invisible CSS tricks like white-on-white text and zero-width characters.

When AI summarization tools process this content, they get overwhelmed by repeated hidden instructions and include the malicious commands in their summaries. Users then see what appears to be legitimate advice but are actually being tricked into running ransomware.

This "ClickFix" attack turns helpful AI assistants into unwitting accomplices. The malicious content can spread through search engines, forums, and emails, making detection difficult.

Source: Cybernews