PsExec

Phishing Abuses RMM Tools for Persistent Access

Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

CISA Warns of Medusa Ransomware-as-a-Service Attacks Over 300 Organizations

Gunra Targets Primary and Disaster-Recovery Backups Before File Encryption

Play Ransomware Scores Just 13% Prevention as Evasion Techniques Bypass Security Controls

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

An analysis of incidents at Brazilian educational institutions

New Cross-Platform Ransomware Encrypts Windows, Linux, and VMware Infrastructure

Toy Ghouls’ new toy: the GenieLocker ransomware

Qilin Ransomware Exploits Palo Alto GlobalProtect Flaw for Initial Access

Spirals Attackers Disable Windows Defender and Kill Backup Services Before Encrypting Systems

The Gentlemen RaaS Turns Infected Hosts Into SMB Distribution Points for Rapid Spread

CrownX Ransomware Embedded Inside Avalon Framework Targets Recovery and Backup Systems

Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects

The Gentlemen are knocking: сustom backdoors and evolving tactics

From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

Kazuar: Anatomy of a nation-state botnet

Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations

Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload

Catch them while you can