Ransomware Security News

Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.

Ransomware encrypts: or threatens to leak, an organization's data until a ransom is paid. It has grown into an industrialized criminal ecosystem with named extortion groups, leak sites and affiliate programs. Expect new attack claims, victim disclosures, law-enforcement takedowns, and the occasional free decryptor release: the same group often rebrands or splinters within months.

Recent Ransomware items

Gootloader Disrupted: Police Cut Malware Delivery Routes Police have cut into Gootloader’s malware delivery network by cleaning compromised websites and taking over criminal domains. The November 12 a...
@topcybersecurity · Nov 13, 2026
Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes https://securelist.com/esxi-ransomware/121959/
@PentestingNews · Nov 13, 2026
AI Set to Revolutionize Ransomware Following “Stagnant” Few Years 📔 TrendAIs Bob McArdle said ransomware techniques will change significantly in the next year, with AI making attacks more dangerous an...
@cibsecurity · Nov 13, 2026
AI Set to Revolutionize Ransomware Following “Stagnant” Few Years 📔 TrendAIs Bob McArdle said ransomware techniques will change significantly in the next year, with AI making attacks more dangerous an...
@cibsecurity · Nov 13, 2026
Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes https://ift.tt/l7HJidh
@ctinow · Nov 13, 2026
Hackers Deploy Beast Ransomware to Disable Backup Services, Delete Shadow Copies, and Encrypt Network Drives https://gbhackers.com/beast-ransomware-attack/
@PentestingNews · Nov 13, 2026
CVE-2026-128091 When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h was an empty stub....
@cveNotify · Nov 13, 2026
CVE-2026-127928 In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c), decrypt_image_inplace() and boot_image_validate_encrypted() each keep a stack-loca...
@cveNotify · Nov 13, 2026
Microsoft uncovers 59 Linux kernel bugs, including 8 with working root exploits. Also in this week's #ThreatsDay : • Falcon browser spyware • GSocket backdoor surge • Europol server takedown • $6.43B...
@thehackernews · Nov 12, 2026
Qilin Ransomware Gang Leader Allegedly Identified as 36-Year-Old Russian Man https://gbhackers.com/qilin-ransomware-gang-leader/
@PentestingNews · Nov 12, 2026
Cyber Alert ‼️ 🇯🇵 Japan - Eicoh The Gentlemen ransomware group claims to have breached Eicoh. Threat actor: The Gentlemen Sector: ICT Data exposure (claimed): Not specified Data type: Not specified Ob...
@hackmanac_cybernews · Nov 12, 2026
A 12-person bank SOC team was overwhelmed by alerts and couldn’t see what suspicious files did. ✅ In week one with #ANYRUN Interactive Sandbox, it processed alerts 2× faster. Email API integration aut...
@anyrun_app · Nov 12, 2026
Who Runs the Ransomware Group Qilin? https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/
@PentestingNews · Nov 12, 2026
the vx-underground timeline: Creation saga: tl;dr make site, meet ThugCrowd, get hosting, start collecting malware papers AND samples - ThugCrowd Arc - Hosting Arc - Malware collection Arc Growth saga...
@vxunderground · Nov 12, 2026
Who Runs the Ransomware Group Qilin? https://ift.tt/YI0Bbk9
@ctinow · Nov 11, 2026
Maersk confirms data breach as WhiteArmor ransomware demands $5 million Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisitio...
@bleepingcomputer · Nov 11, 2026
Maersk confirms data breach as WhiteArmor ransomware demands $5 million https://ift.tt/I58izoU
@ctinow · Nov 11, 2026
Cyber Alert ‼️ 🇰🇼 Kuwait - 𝗡𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗜𝗻𝘃𝗲𝘀𝘁𝗺𝗲𝗻𝘁𝘀 𝗖𝗼𝗺𝗽𝗮𝗻𝘆 The Gentlemen ransomware group claims to have breached National Investments Company. Threat actor: The Gentlemen Sector: Financial Data exposure...
@hackmanac_cybernews · Nov 11, 2026
Cyber Alert ‼️ 🇸🇦 Saudi Arabia - 𝗨𝗻𝗶𝘁𝗲𝗱 𝗣𝗵𝗮𝗿𝗺𝗮𝗰𝘆 The Gentlemen ransomware group claims to have breached United Pharmacy. Threat actor: The Gentlemen Sector: Wholesale / Retail Data exposure (claimed):...
@hackmanac_cybernews · Nov 11, 2026
Citrus Ransomware Spreads Through Fake Security Deployment Citrus ransomware operators entered corporate networks with stolen contractor credentials, then disguised the rollout of their encryptor as a...
@topcybersecurity · Nov 11, 2026
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand https://securelist.com/citrus-ransomware/121879/
@PentestingNews · Nov 11, 2026
Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand https://ift.tt/crmLwny
@ctinow · Nov 11, 2026
Vanderbilt University reels following ransomware attack claimed by BYOD group https://cyberscoop.com/vanderbilt-university-ransomware-attack-byod/
@PentestingNews · Nov 11, 2026
Vanderbilt University reels following ransomware attack claimed by BYOD group https://ift.tt/QbWSqgn
@ctinow · Nov 10, 2026
Ransomware recovery is now a client retention metric Recovering from ransomware doesn't guarantee an MSP will retain its clients, especially when delays, poor communication, and unexpected costs under...
@bleepingcomputer · Nov 10, 2026
Ransomware recovery is now a client retention metric https://ift.tt/pAnyOxK
@ctinow · Nov 10, 2026
GhostFrame: A new ESXi Implant Linked to Settra Ransomware https://ift.tt/tEbB1lX
@ctinow · Nov 10, 2026
Vanderbilt University hit in BYOD ransomware attack, data theft claimed Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypte...
@bleepingcomputer · Nov 10, 2026
Vanderbilt University hit in BYOD ransomware attack, data theft claimed https://ift.tt/wLWIDTF
@ctinow · Nov 9, 2026
Apparently, a blank password can still ruin someone's week. And that's just the beginning. ⚡ This week in cybersecurity RECAP: • SSHole exploit attempts • $6.43B crypto theft • 1,000 switches hacked •...
@thehackernews · Nov 9, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.
Patch
Vendor patches, security updates and fix releases for previously disclosed vulnerabilities.