Victims of ransomware attacks are now facing an entirely new scheme: shortly after an attack, an unknown company reaches out, already aware of the stolen data, and offers - for a fee - to delete that data from the original criminals' hands. Specialists at GuidePoint Security believe that behind these self-styled "helpers," calling themselves Ransom Busters, lies a participant involved in several distinct criminal operations simultaneously.

Discover how Gunra ransomware exploits Fortinet and Schneider Electric vulnerabilities, highlighting the need for cyber threat monitoring and proactive defense.

Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in …

https://www.osintinvestigate.com Can you trust cybercriminals when they claim they've deleted your stolen data? In this episode, we analyze the ransomware attack against River Bank and River Financial Corporation, exploring how modern double extortion attacks work, why organizations sometimes negotiate with hackers, and why a promise to delete stolen information can never be independently verified. We also examine the legal consequences, the SEC filings, and the cybersecurity lessons every financial institution—and every organization—should learn from this incident.

Settra claimed responsibility after a weeklong systems outage at American Color Imaging. The Iowa photo lab has not confirmed a cyberattack.

 England Hockey, the national governing body for field hockey in England, is grappling with a serious cybersecurity incident as the ransomware group AiLock claims responsibility for stealing 129GB of sensitive data.The organization, which supports over 800 clubs, 150,000 players, and thousands of coaches and officials, confirmed it is investigating the potential breach alongside law enforcement to assess system compromises and data impacts. AiLock listed England Hockey on its data leak site, threatening to publish the stolen files unless a ransom is paid, following a classic double-extortion tactic.  This attack highlights the growing menace of ransomware targeting sports organizations, where vast databases of member information become prime targets.AiLock, a ransomware operation first observed in 2025 and documented by Zscaler researchers, employs sophisticated methods including ChaCha20 and NTRUEncrypt encryption, appending .AILock extensions to files and dropping ransom notes across directories.The group pressures victims with strict deadlines—72 hours to start negotiations and five days for payment—or faces data leaks and recovery tool destruction, often exploiting privacy law violations for leverage.  England Hockey has prioritized data security in its response, engaging internal teams and external cybersecurity experts to evaluate the breach's scope amid ongoing uncertainty. While specifics on affected data remain undisclosed due to the investigation, the sheer volume of 129GB suggests potential exposure of personal records, club details, and operational files. The organization emphasized that understanding any data impacts is its top priority, urging caution without commenting further.  Ransomware incidents like this expose organizations to immediate and secondary risks, including phishing, credential theft, and social engineering attacks fueled by leaked data claims. Sports bodies, often resource-constrained compared to corporate giants, face heightened vulnerabilities as cybercriminals increasingly target non-profits with high-profile memberships.AiLock's rise in 2025-2026 underscores a trend of newer groups adopting aggressive playbooks to infiltrate networks, exfiltrate data, and encrypt systems swiftly.  As England Hockey navigates this crisis, the episode serves as a stark reminder for enhanced cybersecurity in amateur and community sports sectors. Proactive measures like regular backups, multi-factor authentication, and employee training could mitigate future threats, preventing disruptions to grassroots programs. With global warnings of AI-driven attacks on sporting events rising, swift collaboration with authorities may limit damage and deter further extortion. Ultimately, transparency post-investigation will be key to rebuilding trust among its vast community.

Die Ransomware-Verschlüsselungsrate in der Fertigung ist laut Sophos so niedrig wie seit fünf Jahren nicht mehr. Doch Angreifer weichen verstärkt auf Datendiebstahl und Double Extortion aus, mehr als ...

County website came back Sept. 22 after days offline. On Oct. 14, Qilin claimed the county; no link to the outage has been confirmed.

  Cybersecurity researchers have identified a dangerous new twist to the notorious ClickFix malware tactic. The evolved variant—called FileFix—is now being weaponized in active ransomware campaigns, further advancing the threat landscape. ClickFix typically lures users by showing them a bogus issue—like a fake CAPTCHA or a misleading virus alert—and then offers a “solution” that involves copying and pasting a command from a compromised website into the Windows Run dialog. This command often triggers the download and execution of malicious software. However, the new FileFix technique modifies that approach. Instead of using the Run command, it instructs users to paste a string into the File Explorer address bar. Though it appears as a legitimate file path, the string is actually a disguised PowerShell command, cleverly masked using comment syntax. In recent attacks observed in the wild, executing this PowerShell string installs a PHP-based version of the Interlock Remote Access Trojan (RAT). Once active, the RAT performs a range of actions—scanning system and network configurations, identifying backup systems, navigating through local file directories, probing Active Directory environments, and even inspecting domain controllers. Eventually, the RAT leads to the deployment of the Interlock ransomware encryptor. Interlock first appeared in September 2024 and was publicly detected by November the same year. It stood out by targeting both Windows and FreeBSD systems. Some high-profile victims include Wayne County (Michigan), Texas Tech University Health Sciences Center, Heritage Bank & McCormick–Priore, and Kettering Health. The ransomware employs the typical double extortion approach—stealing sensitive data before locking systems with encryption to demand ransom. As of mid-2025, Interlock has been linked to at least 14 confirmed incidents, with healthcare entities making up about one-third of the total. This shift in delivery method suggests active development of the malware and underscores its ongoing threat to global organizations.

Inside the Tactical Playbook of Threat Actors Weaponizing Remote Access Software Vulnerabilities to Orchestrate Multi-Layered Extortion Campaigns

Interlock is a 2024 ransomware strain targeting both Windows and FreeBSD systems, making it more versatile than typical ransomware.

Prophet Spider and Gold Melody read more about ToyMaker Uses LAGTOY to Sell Access to CACTUS Ransomware Gangs for Double Extortion

Explore BlackLock ransomware's double-extortion tactics and its impact on cybersecurity in 2025.

 The Lee Enterprises attack that caused disruptions on February 3 has been linked to the Qilin ransomware group, which has released samples of data they claim were stolen from the enterprise. The ransomware actors have now threatened to release all of the…

Double extortion ransomware: hoe cybercriminelen winst maken door losgeld én datalekken. Ontdek risico’s, trends en hoe bedrijven zich kunnen beschermen.

Explore the Sarcoma ransomware attack on Unimicron, highlighting its tactics, industry impact, and cybersecurity implications.

  Play ransomware, also known as Balloonfly or PlayCrypt, has become a significant cybersecurity threat since its emergence in June 2022. Responsible for over 300 global attacks, this ransomware employs a double extortion model — stealing sensitive data…