Ransomware

A vector illustration of a shield deflecting a Medusa-head motif over a network of servers, with one flat red alert dot, representing the updated CISA, FBI and HHS ransomware advisory.

Ransomware

CISA, FBI and HHS Update Medusa Ransomware Advisory as Victim Count Passes 500

The FBI, CISA and HHS updated their Medusa ransomware advisory on August 18, 2026, raising the victim count past 500. Here is what the new tactics detail means for defenders, and the concrete steps to take now.

Flat white line-art of a VMware vCenter server tied to encrypted virtual machines, one flat red dot marking the intrusion, on a deep navy background.

Nation-State Cyber Threats

Suspected China-Nexus APT Exploits a VMware vCenter Flaw to Plant Babuk-Derived Ransomware

Researchers attribute exploitation of VMware vCenter CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in Broadcom's control plane, to a suspected China-nexus APT deploying Babuk-derived ransomware on ESXi hosts. Patching alone may not evict an established intruder.

Flat white line-art firewall appliance with an open padlock and one flat red dot on a solid navy background.

Ransomware

Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA Using Leaked Conti Code

A joint U.S.-South Korea advisory ties the Gunra ransomware-as-a-service crew to a repeatable break-in: two unpatched Fortinet authentication-bypass flaws, defeated MFA, and an encryptor built from leaked Conti code. The fixes have been available since early 2025.

Flat white line-art of an industrial gear and a locked padlock on a crimson background — PTC Windchill flaw exploited in a Cl0p ransomware campaign.

Vulnerabilities

PTC Windchill Vulnerability Exploited in Cl0p Ransomware Campaign

From advisory to active ransomware — the PTC Windchill flaw is on the wire this week, and reporting now ties the exploitation to a Cl0p-style extortion campaign.

Flat white line-art of an official document with a check-mark beside a sealed vault and a warning tag, on a deep violet background — Coca-Cola confirms the Fairlife breach.

Data Breaches

Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack

Confirmed at the parent, claimed by Anubis — Fairlife lands on the leak wire this week.

Flat white line-art of a factory gear, an open blueprint drawer, and a sealed envelope, on a teal background — Cl0p PTC Windchill and FlexPLM data-extortion campaign.

Ransomware

Cl0p Affiliates Chain PTC Windchill and FlexPLM Flaws for Unauthenticated RCE in Fresh Data-Extortion Campaign

Cl0p is back with a PTC Windchill and FlexPLM chain — a defender review for industrial-lifecycle customers this weekend.

Flat white line-art of one control panel routing several tiles into a central hub, on a deep teal background — a centralized RaaS operator portal.

Ransomware

PRODAFT Documents "DevMan" Ransomware-as-a-Service Portal Operated by "Funky Mantis"

Another named RaaS operator profile from PRODAFT — defender-team pattern-tracking this weekend.

Flat white line-art of a jackal emblem, a sealed data vault, and a warning tag on a deep teal background — Anubis's 1 TB leak threat to Fairlife.

Ransomware

Anubis Ransomware Group Threatens to Leak 1 TB of Data Stolen From Coca-Cola's Fairlife

The Fairlife incident escalates with an Anubis leak threat — food-industry ransomware continuation this week.

Flat white line-art of a refrigerated warehouse door reopening beside a hanging padlock tag, on a deep teal background — Nichirei recovery and extortion claim.

Ransomware

Nichirei Logistics Reports Recovery as Extortion Group Claims Responsibility for Cyberattack

The Nichirei cold-chain cyberattack closes with recovery and an extortion-group claim — supply-chain continuation this week.

Ransomware

Sysdig Reports JadePuffer Deploys ENCFORGE Ransomware Purpose-Built to Wipe AI Model Files

The first purpose-built AI-model ransomware lands from JadePuffer — a defender review for organizations hosting AI infrastructure this week.

Editorial illustration of a banner planted on a breached gateway appliance, marking attribution of SonicWall SMA zero-day exploitation to INC Ransomware.

Ransomware

Dark Reading Attributes SonicWall SMA Zero-Day Exploitation to INC Ransomware Operation

INC Ransomware named as the SonicWall SMA zero-day exploiter — defender teams stay in accelerated verification posture this weekend.

Editorial illustration of an airport departure gate holding a passport with a mismatched photo, marking Armenia's detention of Aleksandr Ermakov on a US REvil request.

Ransomware

Armenia Detains Russian National Aleksandr Ermakov on US REvil Extradition Request; Family Disputes Identity

A cross-border REvil extradition drama - an identity dispute and the Armenian judicial process take center stage this week, with a Russian tourist detained on a US warrant his lawyers say names a different man.

See all