Recent findings from cybersecurity firm Silent Push indicate that Russian ransomware groups have introduced a sophisticated new threat known as CountLoader. This malware is not merely a conventional virus; it functions as a loader, specifically designed to infiltrate devices and install more dangerous software, including ransomware. CountLoader serves as a…
This week, significant developments in cybersecurity illustrate the evolving threat landscape. Researchers have uncovered hidden connections among ransomware groups, highlighting a shift from individual operations to a more collaborative underground marketplace. Prominent cyber incidents included major data breaches at financial institutions and luxury brands, underscoring the risks posed by insider…
Upon arriving at the office and starting your computer, an unsettling panic washes over you. Every file is inaccessible, and your systems have ground to a halt. A cryptic ransom note appears on your screen, demanding payment of $2 million in Bitcoin within 48 hours or risk losing everything. This…
Rise of RansomHub: A Resurgent Threat in Cybercrime The RansomHub ransomware-as-a-service (RaaS) group has emerged as a significant player in the cybercrime landscape, capitalizing on previously patched vulnerabilities in Microsoft Active Directory and the Netlogon protocol to facilitate unauthorized access to victim networks. Recent analyses highlight the group’s ability to…
Emerging Cyber Threat: Collaboration Between Head Mare and Twelve Targets Russian Entities Recent intelligence from Kaspersky has revealed that two threat groups, known as Head Mare and Twelve, appear to have aligned their efforts to launch cyberattacks against Russian organizations. The firm’s analysis indicates that Head Mare has adopted tools…
In 2024, a total of 5,414 ransomware attacks occurred worldwide, representing an 11% increase compared to 2023. Following a gradual start, ransomware incidents surged in the second quarter and peaked in the fourth, accounting for 1,827 incidents—approximately 33% of the total for the year. Notably, law enforcement actions against prominent…
In a rapidly shifting cybersecurity landscape, threat actors are adapting and evolving their tactics, as evidenced by recent attacks targeting various organizations and individuals. Notable this week is the activity of the hacking group UNC3886, which has successfully exploited end-of-life MX Series routers manufactured by Juniper Networks. These devices, due…
Bridgestone has confirmed that a cyberattack has disrupted operations at some of its manufacturing facilities. This article examines the implications for employees, includes expert insights, and highlights the suspected hacking group, Scattered Lapsus$ Hunters. Bridgestone, the leading tire manufacturer globally by output, has launched an investigation into a cyberattack affecting…
RansomHub Disappears on April 1; Affiliates Shift to Qilin as DragonForce Takes Over
April 30, 2025
Cybercrime / Threat Intelligence
Cybersecurity experts have reported that RansomHub’s online operations unexpectedly went offline on April 1, 2025, raising alarm among its affiliates in the ransomware-as-a-service (RaaS) ecosystem. According to Singaporean cybersecurity firm Group-IB, this disruption has likely led to affiliates migrating to Qilin, with evidence showing that disclosures on its data leak site have surged since February. RansomHub, which debuted in February 2024, has reportedly compromised data from over 200 victims. It quickly eclipsed prominent RaaS groups LockBit and BlackCat, attracting affiliates like Scattered Spider and Evil Corp with enticing profit-sharing models. “After potentially acquiring the web application and source code for Knight (formerly Cyclops), RansomHub swiftly gained traction in the ransomware landscape, leveraging a feature-rich multi-platform encryptor and a robust, affiliate-friendly approach…”
RansomHub Disappears from the Cyber Landscape; Affiliates Shift to Qilin While DragonForce Claims Leadership April 30, 2025 In a significant turn of events within the cybercriminal ecosystem, the ransomware-as-a-service (RaaS) operation known as RansomHub has unexpectedly gone offline as of April 1, 2025. This abrupt disappearance has raised alarms among…
RansomHub Disappears on April 1; Affiliates Shift to Qilin as DragonForce Takes Over
April 30, 2025
Cybercrime / Threat Intelligence
Cybersecurity experts have reported that RansomHub’s online operations unexpectedly went offline on April 1, 2025, raising alarm among its affiliates in the ransomware-as-a-service (RaaS) ecosystem. According to Singaporean cybersecurity firm Group-IB, this disruption has likely led to affiliates migrating to Qilin, with evidence showing that disclosures on its data leak site have surged since February. RansomHub, which debuted in February 2024, has reportedly compromised data from over 200 victims. It quickly eclipsed prominent RaaS groups LockBit and BlackCat, attracting affiliates like Scattered Spider and Evil Corp with enticing profit-sharing models. “After potentially acquiring the web application and source code for Knight (formerly Cyclops), RansomHub swiftly gained traction in the ransomware landscape, leveraging a feature-rich multi-platform encryptor and a robust, affiliate-friendly approach…”
