Ransomware
"The Gentlemen" Ransomware Claims 478 Victims and Spreads Like a Worm
A ransomware group that spreads like a worm and counts 478 victims — and the Krebs investigation now identifying the people running it.
Vulnerabilities
Veeam Discloses Veeam Backup & Replication Remote Code Execution Vulnerability
A patch cycle on the backup-of-record for the enterprise — high-priority, given the ransomware-response context.
Vulnerabilities
Check Point VPN Zero-Day CVE-2026-50751 Exploited for a Month Before Patch; Qilin Ransomware Involved
A logic-flow weakness in Check Point's Remote Access VPN gave a Qilin ransomware affiliate and other attackers a month to operate before a patch arrived.
Threat Intelligence
Mandiant Documents UNC3753 Extortion Campaign Against US Legal-Services Firms
Mandiant's published findings on a financially motivated campaign give defenders in legal and financial services a sector advisory to act on.
Artificial Intelligence (AI)
Sophos Uncovers an AI-Orchestrated Lab Built to Test and Refine EDR-Evasion Malware
Sophos documented a threat actor using AI agents — including a Claude Opus 4.5 coordinator — to run a lab testing malware against Sophos, CrowdStrike and Microsoft Defender. Notably, the lab's own claims of rising evasion success were not borne out by Sophos's data.
Ransomware
Microsoft Names Storm-2697 Behind The Gentlemen Ransomware: Go Encryptor, Ephemeral Keys
Microsoft Threat Intelligence has named the operators of The Gentlemen ransomware Storm-2697, and its new deep technical analysis dissects a Go encryptor that uses per-file ephemeral keys and an aggressive self-propagation module.
Policy & Government
Europol Dismantles 'First VPN' — the Cybercrime Underground's Most-Used Anonymity Service — and Walks Away With a List of Thousands of Its Users
A Europol- and Eurojust-coordinated operation dismantled First VPN — a service Europol calls the most widely used in the cybercrime underground — arresting an admin, seizing 33 servers, and identifying thousands of cybercrime-linked users. The intelligence yield is the story.
Ransomware
First U.S. Karakurt Sentencing: 8.5 Years for the Negotiator Who Mailed Kids' Records
The DOJ sentenced Latvian national Deniss Zolotarjovs to 102 months in prison on May 4, 2026 — the first U.S. prosecution of a Karakurt member ever. Court documents tie the Conti-affiliated negotiator to extortion of more than 54 organizations, $56 million in losses across 13 victims alone, and a
Ransomware
World Leaks Breaches Pro-Orbán Mediaworks: 15 Million Files Published, Hungarian Outlets Defy Reporting Threat
World Leaks — the rebrand of Hunters International — published 8.5 terabytes and roughly 15 million files from Mediaworks, Hungary's pro-Orbán media giant. Mediaworks asked journalists not to report on the leak, citing criminal data-handling law. At least one Hungarian outlet refused. The data-extortion group World
Trending
Ransomware Negotiators Sentenced: Sygnia and DigitalMint Employees Get 4 Years for Acting as BlackCat Affiliates
Ryan Goldberg (Sygnia) and Kevin Martin (DigitalMint) were sentenced to 4 years in federal prison for acting as BlackCat ransomware affiliates while employed as incident response professionals — attacking the same clients they were hired to help.
Policy & Government
Europol IOCTA 2026: AI, Encryption, and Cybercrime-as-a-Service Are Widening the Velocity Gap Between Criminals and Defenders
Europol's IOCTA 2026 warns that cybercrime has industrialized — AI, encryption, and CaaS are widening the velocity gap between criminal innovation and law enforcement capability, with 120+ ransomware variants and $10.5T in projected 2026 costs.
Ransomware
Inc Ransom Ransomware Breach at Sandhills Medical Exposes 169,017 Patients — Notified 12 Months Later
Sandhills Medical Foundation discloses a ransomware breach by Inc Ransom affecting 169,017 patients — nearly 12 months after the attack was detected and 10 months after stolen data was published publicly.