Ransomware

Clay-style illustration of a ransom note on a desk beside a revenue chart and an insurance file, with one flat red dot marking the demand figure.

Ransomware

Intel 471: Ransomware Negotiation Is Now a Run-the-Numbers Business Process

Intel 471's intelligence team says ransomware negotiation has become a structured business process: crews research a victim's revenue and insurance, price demands at 1 to 5 percent of annual revenue, and prove their key with a test decryption. Here is what defenders should settle first.

Line-art scene of a government data vault forced open, emergency-plan folders spilling out, with one red dot marking a refused ransom demand.

Ransomware

Rhysida Publishes Berlin State Data After €2M Ransom Refused, and a Second Leak Surfaces

Berlin refused a €2 million ransom, so the Rhysida group published its stolen state data, reportedly including sensitive emergency plans. Days later, a second leak of Berlin government login credentials appeared online, and Germany's BSI warned about the same actor.

Isometric clay diorama of an isolated computer server sealed off from a network of other servers, with a single flat red dot marking the breached standalone machine.

Data Breaches

ATF Confirms Qilin-Claimed Breach Hit System Holding Investigation Targets

The ATF confirms a cyberattack hit a standalone system holding information on its investigation targets. The Qilin ransomware group claimed it, though the agency has not verified that. What is confirmed, what is not, and what defenders should take from the containment claim.

Line-art scene of a government building network split into isolated segments, with one red dot marking a blocked extortion demand.

Ransomware

Berlin Refuses to Pay Extortionists as State-Network Breach Widens

Berlin's state government confirmed it is the target of an extortion attempt after the August compromise of its state administrative network, and says it will not meet the extortionists' demands. Forensics also found new data outflows in the mobility and transport department.

Ransomware

CISA, FBI and HHS Update Medusa Ransomware Advisory as Victim Count Passes 500

The FBI, CISA and HHS updated their Medusa ransomware advisory on August 18, 2026, raising the victim count past 500. Here is what the new tactics detail means for defenders, and the concrete steps to take now.

Flat white line-art of a VMware vCenter server tied to encrypted virtual machines, one flat red dot marking the intrusion, on a deep navy background.

Nation-State Cyber Threats

Suspected China-Nexus APT Exploits a VMware vCenter Flaw to Plant Babuk-Derived Ransomware

Researchers attribute exploitation of VMware vCenter CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in Broadcom's control plane, to a suspected China-nexus APT deploying Babuk-derived ransomware on ESXi hosts. Patching alone may not evict an established intruder.

Flat white line-art firewall appliance with an open padlock and one flat red dot on a solid navy background.

Ransomware

Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA Using Leaked Conti Code

A joint U.S.-South Korea advisory ties the Gunra ransomware-as-a-service crew to a repeatable break-in: two unpatched Fortinet authentication-bypass flaws, defeated MFA, and an encryptor built from leaked Conti code. The fixes have been available since early 2025.

Flat white line-art of an industrial gear and a locked padlock on a crimson background — PTC Windchill flaw exploited in a Cl0p ransomware campaign.

Vulnerabilities

PTC Windchill Vulnerability Exploited in Cl0p Ransomware Campaign

From advisory to active ransomware — the PTC Windchill flaw is on the wire this week, and reporting now ties the exploitation to a Cl0p-style extortion campaign.

Flat white line-art of an official document with a check-mark beside a sealed vault and a warning tag, on a deep violet background — Coca-Cola confirms the Fairlife breach.

Data Breaches

Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack

Confirmed at the parent, claimed by Anubis — Fairlife lands on the leak wire this week.

Flat white line-art of a factory gear, an open blueprint drawer, and a sealed envelope, on a teal background — Cl0p PTC Windchill and FlexPLM data-extortion campaign.

Ransomware

Cl0p Affiliates Chain PTC Windchill and FlexPLM Flaws for Unauthenticated RCE in Fresh Data-Extortion Campaign

Cl0p is back with a PTC Windchill and FlexPLM chain — a defender review for industrial-lifecycle customers this weekend.

Flat white line-art of one control panel routing several tiles into a central hub, on a deep teal background — a centralized RaaS operator portal.

Ransomware

PRODAFT Documents "DevMan" Ransomware-as-a-Service Portal Operated by "Funky Mantis"

Another named RaaS operator profile from PRODAFT — defender-team pattern-tracking this weekend.

Flat white line-art of a jackal emblem, a sealed data vault, and a warning tag on a deep teal background — Anubis's 1 TB leak threat to Fairlife.

Ransomware

Anubis Ransomware Group Threatens to Leak 1 TB of Data Stolen From Coca-Cola's Fairlife

The Fairlife incident escalates with an Anubis leak threat — food-industry ransomware continuation this week.

See all