2025-05-13 05:00 UTC
Security Journalism
Security Journalism
Time to Ransom is Money
During ransomware attacks, the average time-to-ransom for attackers is almost 17 hours. Learn more about what this means for businesses.
P15
LATEST
Aggregated cybersecurity reporting, advisories and research. 208 matching records.
AUTO-POLL // 2026-10-04 09:45 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P9 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 4
RANSOMWARE
P9
COOL // 5 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
WED
Sep 30
RANSOMWARE
P10
WARM // 59 ARTICLES
TUE
Sep 29
RANSOMWARE
P4
COOL // 68 ARTICLES
MON
Sep 28
RANSOMWARE
P7
COOL // 52 ARTICLES
2025-04-30 06:00 UTC
Other
Other
Ransomware debris: an analysis of the RansomHub operation
This blog on RansomHub provides an overview into how this Ransomware-as-a-Service (RaaS) group operates, including its extortion tactics, affiliate recruitment strategies, and the features of its affiliate panel.
P15
2025-04-10 05:00 UTC
Security Journalism
Security Journalism
Ransomware Initial Access Brokers Exposed
Discover how a seemingly simple brute force attack led to the uncovering of a suspected ransomware-as-a-service operation. This ecosystem appears to be leveraged by initial access brokers, driving an illicit and complex network of cybercrime.
P15
2025-04-02 06:02 UTC
Other
Other
The beginning of the end: the story of Hunters International
Learn about technical details on the ransomware and Storage Software tool, how the criminals use the affiliate panel as well as information on the Hunters International ransomware group from its emergence to the end of the operation.
P15
2025-03-04 00:00 UTC
Security Journalism
Security Journalism
Uncover Tomorrow’s Cyber Threats Today | Huntress
Explore 2024's top cyber threats, including ransomware trends, advanced phishing tactics, and targeted industries. Stay ahead—download the Huntress 2025 Cyber Threat Report now!
P15
2025-02-12 06:59 UTC
Other
Other
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware
Discover how ransomware has evolved into a sophisticated cyber threat, with groups like RansomHub leading the charge. Learn more about their adaptability, TTPs, and the rise of Ransomware-as-a-service in this first-of-three-part trilogy.
P15
2025-02-11 00:00 UTC
Security Journalism
Security Journalism
2025 Cybersecurity Threat Report | Huntress
Huntress’ 2025 Cyber Threat Report is here! Explore the year's biggest threats—RATs, phishing, ransomware—and how evolving tactics demand smarter defense.
P15
2025-01-28 06:43 UTC
Other
Other
Cat’s out of the bag: Lynx Ransomware-as-a-Service
In this blog, we observed how the Lynx Ransomware-as-a-Service (RaaS) group operates, detailing the workflow of their affiliates within the panel, their cross-platform ransomware arsenal, customizable encryption modes, and advanced technical capabilities.
P15
2024-10-17 07:26 UTC
Other
Other
Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group
In this blog, we observed how the Cicada3301 Ransomware-as-a-Service (RaaS) group operates, detailing the workflow of their affiliates within the panel and examining the Windows, Linux, ESXi, and PowerPC variants of the ransomware.
P15
2024-09-25 07:00 UTC
Other
Other
Inside the Dragon: DragonForce Ransomware Group
In this blog, we look at the DragonForce ransomware group, which poses a severe threat with two variants—a LockBit fork and a customized Conti fork with advanced features and SystemBC malware.
P15
2024-09-22 16:48 UTC
Security Journalism
Security Journalism
ReadText34 Ransomware Incident | Huntress
Huntress analysts see a number of attacks on a daily and weekly basis, some of which include ransomware attacks. Now and again, Huntress analysts will observe a ransomware attack that stands out in some novel manner.
P15
2024-09-20 00:00 UTC
Security Journalism
Security Journalism
Akira Ransomware Indicators | Huntress
Tracking various indicators associated with different attacks, Huntress analysts have been able to identify specific indicators (threat actor workstation names, passwords associated with new user account creation or current account modification, CloudFlare tunnel tokens) that are associated with Akira ransomware infections. By detecting these indicators much earlier in the attack chain, organizations can inhibit or even obviate file encryption malware deployment.
P15
2024-08-28 06:52 UTC
Other
Other
RansomHub ransomware-as-a-service
Learn why RansomHub's new affiliate program and its advanced ransomware tactics—recruiting former Scattered Spider members, exploiting unprotected RDP services, and exfiltrating large data volumes—are critical for staying ahead of modern cyber threats.
P15
2024-08-14 06:45 UTC
Other
Other
Deciphering the Brain Cipher Ransomware
Deep dive into Brain Cipher ransomware group's activities and techniques, and how they are seemingly linked to other ransomware groups such as EstateRansomware and SenSayQ
P15
2024-07-17 06:00 UTC
Other
Other
Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks
Discover the insidious tactics of the Qilin ransomware group, notorious for their $50 million attack on the healthcare sector, impacting key NHS hospitals.
P15
2024-07-10 05:55 UTC
Other
Other
Patch or Peril: A Veeam vulnerability incident
Delaying security updates and neglecting regular reviews created vulnerabilities that were exploited by attackers, resulting in severe ransomware consequences.
P20
2024-07-03 05:59 UTC
Other
Other
Eldorado Ransomware: The New Golden Empire of Cybercrime?
All about Eldorado Ransomware and how its affiliates make their own samples for distribution.
P15
2024-06-08 06:00 UTC
Security Journalism
Security Journalism
Examining the Impact of Ransomware on the Healthcare | Huntress
Learn what’s causing a surge in ransomware attacks on healthcare organizations and find out how new guidelines from HHS are addressing the problem.
P15
2024-06-06 00:00 UTC
Security Journalism
Security Journalism
Healthcare in the Crosshairs | Huntress
Explore the latest ransomware and BEC threats targeting healthcare today. And learn how to navigate emerging threats with insights from our 2024 Cyber Threat Report.
P15
2024-05-22 00:00 UTC
Security Journalism
Security Journalism
Insights from Our 2024 Cyber Threat Report | Huntress
Explore the interesting changes in the world of ransomware and more key findings from Huntress' 2024 Cyber Threat Report.
P15
2024-05-03 00:00 UTC
Security Journalism
Security Journalism
Healthcare Held Hostage: Fighting the Plague of Ransomware | Huntress
Ransomware is spreading like wildfire. Learn about its growing threat to healthcare, its impact on patient care, and how Huntress managed solutions can better protect your organization from cyberattacks.
P15
2024-05-01 00:00 UTC
Security Journalism
Security Journalism
LOLBin to INC Ransomware
Huntress has observed INC ransomware deployed in the past but recent activity indicates a possible continued shift in/or improvement of tactics employed by these threat actors.
P15
2024-03-13 00:00 UTC
Security Journalism
Security Journalism
Using Backup Utilities for Data Exfiltration | Huntress
“Double extortion” attacks, often perpetrated by ransomware threat actors, include data exfiltration prior to file encryption. Huntress analysts have observed various means of data exfiltration, but recently observed the use of a legitimate backup application seen by others to be associated with a Noberus/ALPHV ransomware affiliate.
P15
2024-02-29 00:00 UTC
Security Journalism
Security Journalism
Attacking MSSQL Servers, Pt. II | Huntress
The publication of the first blog post led a Huntress SOC analyst to identify and escalate a second, similar incident. A deeper investigation into the activity made it clear that the Huntress SOC had obviated several Trigona ransomware attacks, protecting customers from the impact of a ransomware infection.
P15
2024-02-28 00:00 UTC
Security Journalism
Security Journalism
BlackCat Ransomware Affiliate TTPs | Huntress
This blog post provides a detailed look at the TTPs of a ransomware affiliate operator. In this case, the endpoint had been moved to another infrastructure (as illustrated by various command lines, and confirmed by the partner), so while Huntress SOC analysts reported the activity to the partner, no Huntress customer was impacted by the ransomware deployment.
P15
2024-01-17 00:00 UTC
Security Journalism
Security Journalism
Ransomware Deployment Attempts Via TeamViewer | Huntress
Huntress analysts continue to observe access to endpoints via legacy TeamViewer installations, and/or compromised TeamViewer credentials.
P15
2023-11-08 07:59 UTC
Other
Other
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware
Take a deep dive into the operations of one of the most active players in the Ransomware-as-a-Service market.
P15
2023-11-07 00:00 UTC
Security Journalism
Security Journalism
Confluence to Cerber: Exploitation of CVE-2023-22518
CVE-2023-22518 is being exploited in Confluence for Cerber ransomware deployment. Read up on Huntress’ observations and mitigation guidance.
P20
2023-09-26 07:55 UTC
Other
Other
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?
No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new ransomware-as-a-service affiliate.
P15
2023-08-11 00:00 UTC
Security Journalism
Security Journalism
Investigating New INC Ransom Group Activity | Huntress
The Huntress team investigated a ransomware attack of a new INC Ransom threat actor group. Here is the activity we observed.
P15