Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransom
Zeppelin (Buran-Zeppelin) Ransomware ([random 9 char] = .126-A9A-0E9) Support
Page 1 of 9 - Zeppelin (Buran-Zeppelin) Ransomware ([random 9 char] = .126-A9A-0E9) Support - posted in Ransomware Help & Tech Support: Most files that are encrypted with Zeppelin (Buran-Zeppelin) Ransomware will have a [random 9 hexadecimal Victim ID] extens
Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims
A newly formed ransomware group has claimed that if its victims dont give into their extortion demands and pay a ransom, that they will destroy their backup infrastructure, in a move which could prev
3 Cyber Threats That Defined the Summer of 2026
This installment of the Reporters' Notebook video series discusses the impact of AI agents breaching Hugging Face, Fairlife's ransomware attack, and Iranian-linked threat actors compromising a dozen US water systems. It was a busy summer.
MedusaLocker .fr3nds67
posted in Ransomware Help & Tech Support: Good morning. I wanted to share with you the ordeal that began on Monday, September 15th, and the approach, system, and logic I used to recover the data wiped out by this ransomware.First of a
Ukrainian ransomware developer jailed for nearly 13 years
A court in Zurich has sentenced a Ukrainian man to 12 years and nine months in prison, and banned him from Switzerland for ten years, for developing ransomware that blackmailed companies around the world.
US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks
Karen Vardanyan has also been ordered to pay over $1.2 million in restitution to victims.
CISA: Ransomware gangs now exploiting critical TeamCity flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July.
Someone's attacking a critical 0-day RCE in F5 BIG-IP APM
F5 has fixed a critical zero-day bug in its BIG-IP Access Policy Manager (APM) that unknown miscreants are exploiting to remotely execute malicious code. BIG-IP APM is a centralized access management and security proxy that allows users to connect to enterprise networks, applications, APIs, and clou
Help eChOraix
(eCh0raix QNAP-NAS-Encrypt) - posted in Ransomware Help & Tech Support: Ransom note filename: README_FOR_DECRYPT.txtt (confirmed with double t) Confirmed via ID Ransomware: eCh0raix / QNAPCrypt Ransom demand: 0.0139 BTC BTC payment address: 154T
ShinyHunters claims FBI breach was revenge for “false” report
Extortion group ShinyHunters is not afraid to make enemies. Now it claims to have breached the FBI. After reportedly taking over ransomware group Clops leak site, ShinyHunters says it attacked the F
Ransomware Attacks Reach Record High for 2026
Over 1000 organizations globally were hit with ransomware attacks during August, as the number of cyber extortion campaigns reached a new high for 2026, analysis of incidents has warned. According t