FBI, CISA detail SafePay ransomware: 600+ victims since 2024
Joint advisory AA26-293A documents SafePay ransomware: 600+ victims since Aug 2024, five exploited CVEs, and a full IOC set. The .SafePay extension and LockBit code overlap.
Stories tagged: #ransomware
Anne Arundel County confirms breach; Rhysida claims 2.6TB
Anne Arundel County, Maryland confirmed an August breach in which an intruder copied files from county systems; the Rhysida gang claims 2.6 TB of data and demands a $2M ransom.
Germany jails alleged Qilin ransomware core member
Japan's National Police Agency confirmed the arrest and extradition to Germany of a Russian national it ties to the Qilin ransomware operation, first detained at an Osaka hotel in May.
Booba ransomware hits UIC College of Medicine, 344GB claimed
The University of Illinois Chicago College of Medicine was hit by ransomware; the Booba group claims 344GB stolen. UIC says patient care and the main network were unaffected and systems are restored.
Vicksburg, Mississippi shuts down city systems after ransomware
Vicksburg mayor Willis Thompson says a ransomware incident forced the city to take systems offline on Oct 2. Emergency services are unaffected; utility payments are down. FBI and DHS are assisting.
Warlock ransomware hits critical infrastructure via SharePoint
Symantec says the Warlock operator, tracked as Longlegs/Storm-2603, hit a water utility, a telecom, a regional government and a university using ToolShell SharePoint exploits.
KillSec ransomware leak site seized in Operation KillSwitch
Europol's Operation KillSwitch seized KillSec's leak site and 110 TB of stolen data; a 16-year-old suspected administrator was among those detained in Spain.
Arctic Wolf ties CVE-2026-0257 GlobalProtect bypass to Qilin ransomware
Arctic Wolf documented Qilin ransomware deployments through Palo Alto CVE-2026-0257 in June — six weeks after Rapid7 first flagged the auth-bypass exploitation and CISA added the CVE to KEV.
Symantec ties new Mistic backdoor to ransomware broker KongTuke
Symantec links a stealth in-memory backdoor used since April 2026 to KongTuke (Woodgnat), the initial-access broker that has fed Interlock, Rhysida, Akira, 8Base and Black Basta.
Canvas LMS breach: ShinyHunters claims 275M records; Instructure says it paid for deletion
ShinyHunters exfiltrated 3.65 TB from Instructure's Canvas LMS, defaced login pages at 330 schools, then accepted a payment in exchange for 'returning' the data. The data is still out there.