Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation

Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group. "It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters," the Politie Landelijke Opsporing en...

Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their...

ransomwatch

ransomwatch 👀 🦅 ransomwatch はランサムウェアグループが使用する恐喝サイトを追跡し、主張の集約フィードを公開します 新しいグループを提出する際は issue テンプレート をご利用ください ⚠️ ransomwatch.telemetry.ltd、posts.json、groups.json 内のコンテンツと、docs/ および source/ ディレクトリは、実際の脅威アクターのホスティング選択に基づいてほぼリアルタイムで動的に生成されます。 サニタイズ処理は行われていますが、ransomwatch...

CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit

CVE-2025-61882 - Oracle E-Business Suite Pre-Auth RCE Exploit A critical pre-authentication Remote Code Execution RCE flaw in Oracle E-Business Suite versions 12.2.3–12.2.14 allows attackers to gain full control over vulnerable servers via malicious HTTP requests — now actively exploited in the...

Blackash-CVE-2025-61882

🛡️🚨 CVE‑2025‑61882 — Critical Pre‑Auth Remote Code Execution in Oracle E‑Business Suite EBS 🚨🛡️ Short summary: Critical pre‑auth remote code execution in Oracle E‑Business Suite EBS — affects 12.2.3 → 12.2.14, CVSS 9.8 , actively exploited in the wild ransom/ extortion activity reported...

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Executive summary In April 2026, we at Kaspersky's Global Emergency Response Team GERT responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization's Active Directory environment and authored a...

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service SaaS offerings through information technology IT help desk vishing, adversary-in-the-middle AitM token theft, and residential-proxy sign-ins...

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same statement disclosed that forensic work had found further data outflows i...

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Authorities in Australia have arrested two men believed to be members of TeamPCP , a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police AFP said two men...

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the...

DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt

The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data leak operations in a bid to improve operational resilience. "Its recovery ecosystem combines the Session messaging network with blockchain-backed services that...

Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks

Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and...

Canadian Man Pleads Guilty in Snowflake Extortions

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake. Connor Riley Moucka , of Kitchener, Ontario, also...

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin aka Agenda ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation o...

Cybersecurity Negotiator Gets 70 Months for Helping BlackCat Extort Victims

Former ransomware negotiator Angelo Martino gets 70 months in prison for helping BlackCat extort US victims and misuse confidential client data in cyberattacks...

Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks

A 41-year-old former ransomware negotiator has been sentenced to nearly six years i.e., 70 months in prison in the U.S. for their role in conspiring with the now-defunct BlackCat ransomware operators to extort multiple victims and working with two other cybersecurity professionals to target...

U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and the blockchain trail the payment left. The odd part: the group that took the money calls itself Kairos ,...

Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data

Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affected companies...

Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data

Salesforce has revealed that it disabled the Klue Battlecards app integration within its platform in response to a security incident impacting the competitive intelligence company on June 11, 2026. To that end, organizations will be unable to connect to Salesforce via the app until further notice...

PT-2026-49070

🔴 ShinyHunters exploits Oracle PeopleSoft 0-day CVSS 9.8 targeting 100+ organizations Ransomware group ShinyHunters exploited CVE-2025-35273, a critical server-side request forgery vulnerability in Oracle PeopleSoft, for more than two weeks before Oracle disclosed it. The group targeted roughly 3...