X-Industry

North Korea's state-sponsored Lazarus Group has added yet another ransomware strain to its arsenal. New research from the Symantec and Carbon Black Threat Hunter Team reveals that the group has been observed deploying Medusa ransomware in an attack against an unnamed entity in the Middle East and, separately, attempting an unsuccessful breach of a healthcare organization in the United States.  The findings represent a notable evolution in Lazarus's tactics. The group has previously been linked t

North Korea's state-sponsored Lazarus Group has added yet another ransomware strain to its arsenal. New research from the Symantec and Carbon Black Threat Hunter Team reveals that the group has been observed deploying Medusa ransomware in an attack against an unnamed entity in the Middle East and, separately, attempting an unsuccessful breach of a healthcare organization in the United States.  The findings represent a notable evolution in Lazarus's tactics. The group has previously been linked t

North Korea's state-sponsored Lazarus Group has added yet another ransomware strain to its arsenal. New research from the Symantec and Carbon Black Threat Hunter Team reveals that the group has been observed deploying Medusa ransomware in an attack against an unnamed entity in the Middle East and, separately, attempting an unsuccessful breach of a healthcare organization in the United States.  The findings represent a notable evolution in Lazarus's tactics. The group has previously been linked t

Our friends at SentinelLabs have published a great review on the current status of the malicious cyber capabilities of Iran.  Recent US and Israeli strikes against Iranian targets, followed by Iranian attacks on multiple regional locations, present a highly dynamic geopolitical situation with credible cyber threat implications.  Iran has historically incorporated cyber operations into periods of regional escalation.  Given the rapid escalation of geopolitical tensions, we assess that Iranian sta

As the healthcare sector continues to grapple with the professionalization of cybercrime, the University of Mississippi Medical Center (UMMC) has become the latest high-profile target in a sprawling ransomware attack.  This incident is a reminder of the "identity-first" battlefield and the catastrophic impact of machine-speed exfiltration on clinical operations.  The attack, first disclosed on 19 February 2026, has severely disrupted the state's only academic medical center. UMMC leadership, inc

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

According to a recent report by Check Point Software, the number of publicly disclosed ransomware incidents increased approximately 60% year over year as of December.  In fact, there were nearly 1,000 reported incidents in December alone. This marks a clear increase in the consistency and scale of ransomware growth.

A potential contributor to this increase is the fact that ransomware is becoming more and more of an industrialized business model. Ransomware as a service (RaaS) ecosystems allows

Two US cybersecurity professionals, Ryan Goldberg and Kevin Martin, pleaded guilty to charges tied to their roles in BlackCat/Alphv ransomware attacks that occurred in 2023.  Court records show that Ryan Goldberg, Kevin Martin, and a co-conspirator deployed ALPHV BlackCat ransomware against US victims from April to December 2023, sharing 20% of the ransoms with the operators.  Despite working in cybersecurity, they extorted about $1.2M in Bitcoin from one victim, split the proceeds, and laundere

Ransomware is no longer a niche threat.  It shows up across industries, company sizes, and geographies but some groups remain far more exposed than others.  Ransomware appeared in 44% of breaches analyzed in Verizon’s 2025 DBIR executive summary, up from 32% the previous year.  This sharp rise confirms ransomware’s growing role as a primary breach driver rather than a secondary payload.[1]

Ransomware was a component of 39% of breaches in larger organizations, showing that even mature security pr

CyberVolk is a pro-Russia hacktivist persona Sentinel Labs first documented in late 2024, and it has been tracked using multiple ransomware tools to conduct attacks aligned with Russian government interests.  After seemingly lying dormant for most of 2025 due to Telegram enforcement actions, the group returned in August 2025 with a new RaaS offering called VolkLocker (aka CyberVolk 2.x).

Below, researchers examine the functionality of VolkLocker, including its Telegram-based automation, encrypti

SentinelLABS has been researching how large language models (LLMs) are impacting cybersecurity for both defenders and adversaries.  As part of our ongoing efforts in this area and our well-established research and tracking of crimeware actors, researchers have been closely following the adoption of LLM technology among ransomware operators.  Analysts have observed that three structural shifts appear to be unfolding in parallel.

First, the barriers to entry continue to fall for those intent on cy

Marquis Software Solutions is notifying banks and credit unions of a ransomware attack that leaked their customer data.  The Texas-based digital and physical marketing firm learned of the ransomware cyber-attack on 14 August 2025, after detecting suspicious activity on its network.  It responded by launching an investigation and notifying law enforcement.  The probe determined that the threat actor breached its SonicWall firewall to gain initial access.[1]

After gaining access, the attackers exf

The automobile dealership sector continues to evolve digitally with connected vehicles, cloud-based dealership management systems (DMS), online financing, and electronic sales workflows. But the newly released CDK State of Dealership Cybersecurity 2025 report shows a sector still struggling to keep pace with threat actors who increasingly target these high-value, high-data retail environments.   Despite gains in awareness and investment, dealerships face widening gaps in employee readiness, thir

The cyber threat landscape is constantly evolving, but few threats demand immediate, sector-wide attention like the latest joint advisory on the Akira ransomware.    The US Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and international partners recently issued a crucial advisory (AA24-109A) detailing the tactics, techniques, and procedures (TTPs) of the Akira ransomware group.  Their accompanying press release highlighted the need for decisi

Security solutions firm Sophos has released its fifth annual Sophos State of Ransomware in Retail report.  The report, which surveyed IT and cybersecurity leaders across 16 countries, reveals alarming trends in ransomware incidents affecting the retail sector.  The report highlights that nearly half (46%) of retail ransomware incidents were traced back to an unknown security gap, indicating significant visibility challenges within the retail attack surface.[1]

Among organizations that experience

In the lead-up to Black Friday and Cyber Monday 2025, the retail sector in the US is facing a significant increase in cyber-attacks targeting both online and brick-and-mortar businesses.  Threat actors have and are leveraging sophisticated phishing campaigns, malicious websites masquerading as legitimate retailers, and ransomware attacks timed to disrupt critical sales periods.  According to recent industry reports, cybercriminals are exploiting the surge in online shopping traffic by deploying