Tag ransomware

Moldovan Police Detain Suspect Linked to €4.5 Million Ransomware Attack on Dutch Research Institution

May 13, 2025
Cybercrime / Ransomware

Authorities in Moldova have arrested a 45-year-old foreign national suspected of orchestrating multiple ransomware attacks against Dutch businesses in 2021. “He is wanted internationally for various cybercrimes, including ransomware attacks, blackmail, and money laundering targeting firms in the Netherlands,” officials stated on Monday. As part of the operation, police confiscated over €84,000 ($93,000) in cash, an electronic wallet, two laptops, a mobile phone, a tablet, six bank cards, two data storage devices, and six memory cards. While the suspect’s identity remains undisclosed, he was apprehended during a search of his residence in Moldova. Notably, he is accused of launching a ransomware attack on the Netherlands Organization for Scientific Research (NWO) in February 2021, resulting in damages estimated at €4.5 million. This incident also led to the leak of internal documents.

Moldovan Authorities Apprehend Suspect Linked to €4.5 Million Ransomware Assault on Dutch Research Agency On May 13, 2025, Moldovan law enforcement announced the arrest of a 45-year-old foreign national believed to be intricately involved in a series of ransomware attacks that targeted companies in the Netherlands during 2021. This individual,…

Read More

Moldovan Police Detain Suspect Linked to €4.5 Million Ransomware Attack on Dutch Research Institution

May 13, 2025
Cybercrime / Ransomware

Authorities in Moldova have arrested a 45-year-old foreign national suspected of orchestrating multiple ransomware attacks against Dutch businesses in 2021. “He is wanted internationally for various cybercrimes, including ransomware attacks, blackmail, and money laundering targeting firms in the Netherlands,” officials stated on Monday. As part of the operation, police confiscated over €84,000 ($93,000) in cash, an electronic wallet, two laptops, a mobile phone, a tablet, six bank cards, two data storage devices, and six memory cards. While the suspect’s identity remains undisclosed, he was apprehended during a search of his residence in Moldova. Notably, he is accused of launching a ransomware attack on the Netherlands Organization for Scientific Research (NWO) in February 2021, resulting in damages estimated at €4.5 million. This incident also led to the leak of internal documents.

Ransomware Groups Exploit Unpatched SimpleHelp Vulnerabilities for Double Extortion Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported on Thursday that ransomware criminals are taking advantage of unpatched SimpleHelp Remote Monitoring and Management (RMM) systems to compromise clients of an unnamed utility billing software provider. “This incident highlights a growing trend of ransomware groups exploiting unpatched versions of SimpleHelp RMM since January 2025,” the agency stated in an advisory. Earlier this year, SimpleHelp identified several vulnerabilities (CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726) that could lead to information disclosure, privilege escalation, and remote code execution. These vulnerabilities have been actively exploited, including by ransomware groups like DragonForce, to breach specific targets. In a recent report, Sophos revealed that a Managed Service Provider’s SimpleHelp system was compromised by threat actors using these flaws.

Ransomware Groups Exploit Unpatched SimpleHelp Vulnerabilities, Targeting Utility Billing Software Clients On June 13, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported a growing threat posed by ransomware actors leveraging unpatched vulnerabilities in SimpleHelp Remote Monitoring and Management (RMM) software to compromise victims associated with an unnamed utility…

Read More

Ransomware Groups Exploit Unpatched SimpleHelp Vulnerabilities for Double Extortion Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported on Thursday that ransomware criminals are taking advantage of unpatched SimpleHelp Remote Monitoring and Management (RMM) systems to compromise clients of an unnamed utility billing software provider. “This incident highlights a growing trend of ransomware groups exploiting unpatched versions of SimpleHelp RMM since January 2025,” the agency stated in an advisory. Earlier this year, SimpleHelp identified several vulnerabilities (CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726) that could lead to information disclosure, privilege escalation, and remote code execution. These vulnerabilities have been actively exploited, including by ransomware groups like DragonForce, to breach specific targets. In a recent report, Sophos revealed that a Managed Service Provider’s SimpleHelp system was compromised by threat actors using these flaws.

Accounting Firm Settles for $175K with Federal Authorities Over HIPAA Ransomware Breach

Data Privacy, Data Security, Healthcare <span class=”article-sub-title”>Settlement Includes Corrective Action Plan Aimed at Enhancing Risk Analysis</span> <span class=”article-byline”> <a class=”author-link” href=””>Marianne Kolbasuk McGee</a> (<a href=””><i class=”fa fa-twitter”/>HealthInfoSec</a>) • <span class=”text-nowrap”>August 18, 2025</span> <a href=””/> </span> <figure> <img src=”” alt=”Accounting Firm Pays Feds $175K for HIPAA Ransomware Breach” class=”img-responsive”/> <figcaption>Image: BST</figcaption>…

Read MoreAccounting Firm Settles for $175K with Federal Authorities Over HIPAA Ransomware Breach

NY State Imposes $2M Fine on Dental Plan Company for Phishing Breach

Data Privacy, Data Security, Healthcare Healthplex, a UnitedHealth Group Subsidiary, Fined for Lacking MFA on Compromised Email Account Marianne Kolbasuk McGee (HealthInfoSec) • August 18, 2025 New York State fined a dental plan administrator owned by insurer UnitedHealth Group $2 million for failing to protect data with multifactor authentication. (Image:…

Read MoreNY State Imposes $2M Fine on Dental Plan Company for Phishing Breach

WarLock Ransomware Group Claims Cyber Breach at Colt Telecom and Hitachi

WarLock ransomware has reportedly breached Colt and Hitachi, prompting an investigation and efforts to restore systems at Colt while cybersecurity experts examine the alleged data breach. A new ransomware group, WarLock, which emerged just two months ago, is seeking to establish its credibility by targeting prominent organizations. Recently, it added…

Read MoreWarLock Ransomware Group Claims Cyber Breach at Colt Telecom and Hitachi

Iranian Hacker Admits Guilt in $19 Million Robbinhood Ransomware Attack Targeting Baltimore

Date: May 28, 2025
Category: Ransomware / Data Breach

An Iranian national has acknowledged his involvement in a major ransomware and extortion operation linked to the Robbinhood ransomware in the U.S. Sina Gholinejad (also known as Sina Ghaaf), 37, along with his accomplices, infiltrated the computer networks of multiple U.S. organizations, encrypting files and demanding Bitcoin ransoms. Arrested in North Carolina in early January, Gholinejad pleaded guilty to charges of computer fraud and abuse, as well as conspiracy to commit wire fraud. He faces up to 30 years in prison, with his sentencing set for August 2025. The U.S. Department of Justice reported that these cyberattacks led to significant disruptions and financial losses exceeding $19 million for cities like Greenville, North Carolina, and Baltimore, Maryland.

Iranian Hacker Pleads Guilty in $19 Million Robbinhood Ransomware Attack on Baltimore May 28, 2025 In a significant development in the realm of cybersecurity, an Iranian national, Sina Gholinejad, has entered a guilty plea in the United States for his role in an extensive ransomware operation that leveraged the notorious…

Read More

Iranian Hacker Admits Guilt in $19 Million Robbinhood Ransomware Attack Targeting Baltimore

Date: May 28, 2025
Category: Ransomware / Data Breach

An Iranian national has acknowledged his involvement in a major ransomware and extortion operation linked to the Robbinhood ransomware in the U.S. Sina Gholinejad (also known as Sina Ghaaf), 37, along with his accomplices, infiltrated the computer networks of multiple U.S. organizations, encrypting files and demanding Bitcoin ransoms. Arrested in North Carolina in early January, Gholinejad pleaded guilty to charges of computer fraud and abuse, as well as conspiracy to commit wire fraud. He faces up to 30 years in prison, with his sentencing set for August 2025. The U.S. Department of Justice reported that these cyberattacks led to significant disruptions and financial losses exceeding $19 million for cities like Greenville, North Carolina, and Baltimore, Maryland.

Microsoft Flags Storm-0501 as a Significant Threat in Hybrid Cloud Ransomware Operations

September 27, 2024
Ransomware / Cloud Security

Microsoft has identified the cyber group Storm-0501 as a noteworthy threat, targeting key sectors such as government, manufacturing, transportation, and law enforcement in the United States. Their sophisticated, multi-stage attack strategy is designed to infiltrate hybrid cloud environments, allowing attackers to move laterally from on-premises systems to the cloud. This approach leads to data exfiltration, credential theft, tampering, persistent backdoor access, and ransomware deployment. According to Microsoft’s threat intelligence team, Storm-0501 operates as a financially driven cybercriminal organization, utilizing both commodity and open-source tools for their ransomware activities. Active since 2021, they initially focused on educational institutions with the Sabbath ransomware before transitioning to a ransomware-as-a-service (RaaS) model, distributing various ransomware variants including Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo ransomware.

Microsoft Flags Storm-0501 as Significant Threat in Hybrid Cloud Ransomware Incidents On September 27, 2024, Microsoft announced a notable increase in ransomware attacks orchestrated by the threat actor known as Storm-0501, which has predominantly targeted integral sectors such as government, manufacturing, transportation, and law enforcement across the United States. This…

Read More

Microsoft Flags Storm-0501 as a Significant Threat in Hybrid Cloud Ransomware Operations

September 27, 2024
Ransomware / Cloud Security

Microsoft has identified the cyber group Storm-0501 as a noteworthy threat, targeting key sectors such as government, manufacturing, transportation, and law enforcement in the United States. Their sophisticated, multi-stage attack strategy is designed to infiltrate hybrid cloud environments, allowing attackers to move laterally from on-premises systems to the cloud. This approach leads to data exfiltration, credential theft, tampering, persistent backdoor access, and ransomware deployment. According to Microsoft’s threat intelligence team, Storm-0501 operates as a financially driven cybercriminal organization, utilizing both commodity and open-source tools for their ransomware activities. Active since 2021, they initially focused on educational institutions with the Sabbath ransomware before transitioning to a ransomware-as-a-service (RaaS) model, distributing various ransomware variants including Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo ransomware.

Joint Global Operation Leads to Arrests and Sanctions Against LockBit Ransomware and Evil Corp Members

October 3, 2024
Cybercrime / Ransomware

A coordinated international law enforcement effort has resulted in four arrests and the shutdown of nine servers associated with the LockBit (also known as Bitwise Spider) ransomware operation, targeting a once-prominent financially motivated cybercriminal group. Key developments include the apprehension of a suspected LockBit developer in France while on vacation outside Russia, the arrest of two individuals in the UK linked to an affiliate, and the capture of an administrator of a bulletproof hosting service in Spain used by the gang, according to Europol. Additionally, authorities have identified a Russian national, Aleksandr Ryzhenkov (known by several aliases including Beverley and Corbyn_Dallas), as a high-ranking member of the Evil Corp cybercrime group and a LockBit affiliate. Sanctions have been imposed on seven individuals and two entities connected to the e-crime organization. “The United States, in collaboration with our allies…”

LockBit Ransomware and Evil Corp Members Arrested in Global Law Enforcement Operation On October 3, 2024, a coordinated international law enforcement operation resulted in the arrest of four individuals and the dismantling of nine servers associated with the LockBit ransomware group, also known as Bitwise Spider. This initiative represents a…

Read More

Joint Global Operation Leads to Arrests and Sanctions Against LockBit Ransomware and Evil Corp Members

October 3, 2024
Cybercrime / Ransomware

A coordinated international law enforcement effort has resulted in four arrests and the shutdown of nine servers associated with the LockBit (also known as Bitwise Spider) ransomware operation, targeting a once-prominent financially motivated cybercriminal group. Key developments include the apprehension of a suspected LockBit developer in France while on vacation outside Russia, the arrest of two individuals in the UK linked to an affiliate, and the capture of an administrator of a bulletproof hosting service in Spain used by the gang, according to Europol. Additionally, authorities have identified a Russian national, Aleksandr Ryzhenkov (known by several aliases including Beverley and Corbyn_Dallas), as a high-ranking member of the Evil Corp cybercrime group and a LockBit affiliate. Sanctions have been imposed on seven individuals and two entities connected to the e-crime organization. “The United States, in collaboration with our allies…”

North Korean Hackers Initiate New Cyber Attack Against South Korea

Cyberwarfare / Nation-State Attacks, Fraud Management & Cybercrime, Geo Focus: Asia Report: North Korean Hacking Group Incorporates Ransomware into Cyber Operations Chris Riotta (@chrisriotta) • August 14, 2025 Image: Shutterstock Recent findings from South Korean cybersecurity researchers have revealed a robust cyberattack campaign attributed to the North Korean hacker group…

Read MoreNorth Korean Hackers Initiate New Cyber Attack Against South Korea