Tootfinder

»Schweizer Unternehmen Trisa AG Opfer der LYNX Ransomware? AI-gestützte Angriffe auf AWS binnen Minuten erfolgreich«
— von @…
Ich gehe mal davon aus, dass AWS (Amazon) sich wider raus redet. Denn anscheinend sei ihr Host falsch von Konden konfiguriert zu sein. Anderseits, weshalb benötigt man Daten um Zähne zu putzen & Haare zu kämmen? Die KI Angriffe…

Schweizer Unternehmen Trisa AG Opfer der LYNX Ransomware? AI-gestützte Angriffe auf AWS binnen Minuten erfolgreich
Die in der Schweiz beheimatete Trisa AG ist als Gruppe im Bereich der Mund- (Zahnbürsten), Haar- (Bürsten) und Schönheitspflege unterwegs. Mir vorliegenden Berichten soll das Unternehmen Opfer der…

Wenn Cybercrime zeigt, dass wirklich niemand verschont bleibt. 🫠 Ein Ransomware-Angriff auf die Werkstatt Bremen hat auch Auswirkungen auf die IT-Systeme der polizeilichen Beweisstückstelle.
Zum Artikel: https://heise.de/-11165825?wt_mc=sm.re

Phobos ransomware leader facing 20 years in prison after pleading guilty to hacking charges https://therecord.media/phobos-ransomware-leader-facing-20-years

Check out today's Metacurity for the most crucial infosec developments you should know, including
--Italy says it foiled Russian cyberattacks on foreign ministries, Olympics websites,
--NFL deploys cyber squad to secure Super Bowl,
--ShinyHunters takes credit for UPenn and Harvard attacks,
--Ransomware gangs are exploiting high-severity VMware ESXi sandbox escape vulnerability,
--Canada Computers & Electronics breach reached 1,300,
--SystemBC malwar…

Italy says it foiled Russian cyberattacks on foreign ministries, Olympics websites
NFL deploys cyber squad to secure Super Bowl, ShinyHunters takes credit for UPenn and Harvard attacks, Ransomware gangs are exploiting high-severity VMware ESXi sandbox escape vulnerability, Canada Computers & Electronics breach reached 1,300, SystemBC malware affects 10K IP addresses, much more

»Ransomware-Angriffe in der DACH-Region steigen deutlich:
Die Bedrohung durch Ransomware wächst weiter. Kaspersky registrierte 2025 in Deutschland 384 Angriffe – ein deutlicher Anstieg im Vergleich zu 233 im Jahr 2024.«
Betreffen kann dies uns alle aber das min die E-Mails kryptografisch signiert sind wenn nicht verschlüsselt, wäre ein Punkt mehr für mehr Sicherheit und setzt nicht blind ua auf Microschrott.
🔓

Ransomware-Angriffe in der DACH-Region steigen deutlich
Die Bedrohung durch Ransomware wächst weiter. Kaspersky registrierte 2025 in Deutschland 384 Angriffe – ein deutlicher Anstieg im Vergleich zu 233 im Jahr 2024.

CISA updated ransomware intel on 59 bugs last year without telling defenders
https://www.theregister.com/2026/02/03/greynoise_cisa_ransomware_gripe/

CISA updated ransomware intel on 59 bugs last year without telling defenders
: GreyNoise's Glenn Thorpe counts the cost of missed opportunities

Total on-chain ransomware payments fell 8% YoY to $820M in 2025, despite a record 50% rise in claimed victims; the median payment grew 368% YoY to nearly $60K (Chainalysis)
https://www.chainalysis.com/blog/crypto-ransomware-2026/

Crypto Ransomware: 2026 Crypto Crime Report
In 2025, total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%.

"Opfer der Sicarii-Ransomware sollten besser kein Lösegeld zahlen. Die Daten lassen sich aufgrund eines Fehlers ohnehin nicht mehr entschlüsseln."
Schöne neue Welt. 🤦
https://www.golem.de/news/vibe-coding-verda…

Vibe-Coding-Verdacht: Ransomware-Panne mündet in totalem Datenverlust - Golem.de
Opfer der Sicarii-Ransomware sollten besser kein Lösegeld zahlen. Die Daten lassen sich aufgrund eines Fehlers ohnehin nicht mehr entschlüsseln.

Romania’s oil pipeline operator confirms cyberattack as hackers claim data theft https://therecord.media/romania-conpet-oil-pipeline-ransomware-attack

The US federal government might consider decriminalising ransomware in order to help shore up Bitcoin.

This is a neat event that DOE hosts every year: A full-scale cyber training event designed to strengthen U.S. energy grid resilience on Plum Island, New York, across an 840-acre grid that mirrors real utility environments.

DOE’s Liberty Eclipse simulates ransomware and stealth attacks to prepare utilities for real-world grid cyber threats - Industrial Cyber
DOE’s Liberty Eclipse simulates ransomware and stealth attacks to prepare utilities for real-world grid cyber threats, build resilience.

Etwas mehr der heute besonders häufig geteilten #News:
39C3: CCC-Hacker fordern Bundesdatensicherungsspiele gegen Ransomware-Albträume

Conduent Data Breach Notification Letters Sent to Millions
as Ransomware Group Claims
⚡️ 8 Terabytes Stolen in One of the Largest U.S. Incidents.
Letters began reaching affected individuals this month detailing a major data breach at #Conduent Business Services, LLC,
a government technology contractor that processes payments, healthcare claims, and back-office services for clients n…

Conduent Data Breach - Largest Data Breach in U.S. History As Ransomware Group Stolen 8 TB of Data
Conduent Data Breach Notification Letters Sent to Millions as Ransomware Group Claims 8 Terabytes Stolen in One of the Largest U.S. Incidents.

Fertiger Luxshare: Ransomware-Gruppe will Apple-Daten erbeutet haben
Neben Foxconn ist Luxshare Precision mittlerweile einer der wichtigsten Produzenten von Apple-Hardware. Dort soll es einen Datenabfluss gegeben haben.

Noch einige der zuletzt hier besonders häufig geteilten #News:
39C3: CCC-Hacker fordern Bundesdatensicherungsspiele gegen Ransomware-Albträume

»Vibe-Coding-Verdacht — Ransomware-Panne mündet in totalem Datenverlust:
Opfer der Sicarii-Ransomware sollten besser kein Lösegeld zahlen. Die Daten lassen sich aufgrund eines Fehlers ohnehin nicht mehr entschlüsseln.«
Nun ja ist eben so und alles andere als überraschend. Ich frage mich weshalb immer noch Firmen attackiert werden, lassen die ihre Fenster offen?!??
🤷

Vibe-Coding-Verdacht: Ransomware-Panne mündet in totalem Datenverlust - Golem.de
Opfer der Sicarii-Ransomware sollten besser kein Lösegeld zahlen. Die Daten lassen sich aufgrund eines Fehlers ohnehin nicht mehr entschlüsseln.

You won't want to miss today's insanely packed Metacurity for the latest news across the cybersecurity sectors, including
--Russian space vehicles are tapping comms from key European satellites, report,
--Incognito Market operator sentenced to 30 years,
--CISA silently tweaked CVEs used for ransomware attacks,
--Russian hackers reportedly disabled critical Ukraine military registration platforms,
--Hackers and trolls are targeting ICE spotting apps,

Russian space vehicles are tapping comms from key European satellites, report
Incognito Market operator sentenced to 30 years, CISA silently tweaked CVEs used for ransomware attacks, Russian hackers reportedly disabled critical Ukraine military registration platforms, Hackers and trolls are targeting ICE spotting apps, Coinbase confirms new insider breach, more

University of Hawaiʻi Cancer Center confirms data leak following ransomware attack https://therecord.media/university-of-hawaii-ransomware-data-breach

Ransomware payments dropped in 2025 as attack numbers reached record levels: Chainalysis
https://therecord.media/ransomware-payments-chainalysis-cybercrime

Ransomware payments dropped in 2025 as attack numbers reached record levels: Chainalysis
The rate at which ransomware victims paid cybercriminals fell last year while the overall number of attacks ballooned, Chainalysis found.

Two ex-staffers of cybersecurity incident response companies Sygnia and DigitalMint plead guilty to targeting US companies in 2023's BlackCat ransomware attacks (Sergiu Gatlan/BleepingComputer)
https://www.bleepingcomputer.com/news/secu<…

Picus Security, an interesting security vendor I only recently became aware of, has a report out on the Fog Ransomware group. An easy protective control to put in place based on this group's TTPs is to block *.netlify.app. This is the domain used by Netlify's free tier apps and is being abused. Note that most legitimate business customers of Netlify will use their own domains to access Netlify apps, so blocking their free tier domain is not likely to impact your users.

This time we look at why you may not be able to hand your household chores over to robots just yet, Delhi Police’s dystopian turn and Japan’s biggest port under ransomware attack.
https://www.computing.co.uk/news/2026/are-you-ready-for-the…

Are you ready for the humanoid robot bubble? - Asian Tech Roundup

Ich teile mal hier diese interessante Diskussion auf administrator.de #administrator #cybersecurity #depol

https://www.theguardian.com/technology/2025/dec/29/ransomware-negotiations-extortion-cyber-attacks
“S-RM now claims the UK’s largest cyber-incident response team. Its first-responder service is comprised of about 150 experts world…

‘Why should we pay these criminals?’: the hidden world of ransomware negotiations
Cybersecurity experts reveal what they do for high-profile clients targeted by hackers such as Scattered Spider

Ransomware responders plead guilty to using ALPHV in attacks on US organizations https://therecord.media/ransomware-responders-guilty-plea-using-alphv-blackcat-us-attacks

Ransomware payments dropped in 2025 as attack numbers reached record levels: Chainalysis https://therecord.media/ransomware-payments-chainalysis-cybercrime

Nike prüft möglichen Cyberangriff
Eine Ransomware-Bande behauptet, Daten von Nike erbeutet zu haben. Das Unternehmen untersucht den Vorfall. Angeblich wurden auch Designprototypen gestohlen.
https://www.he…

Sedgwick confirms cyber incident affecting its major federal contractor subsidiary https://therecord.media/sedgwick-cyber-incident-ransomware

This takes cojones, if true.
A Moscow resident has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service (FSB).
https://therecord.media/moscow-man-accused-of-extorting-conti-gang…

Moscow man accused of posing as FSB officer to extort Conti ransomware gang
A Moscow resident has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service, according to local media reports.

On ransomware and under-funded GLAMs: 'At no point was the British Library particularly negligent or unprepared. Instead, it was hindered by vulnerabilities shared by the majority of cultural institutions. In this respect, the attack doesn’t just represent an isolated failure – it’s a warning to the whole sector.'

Cybersicherheit: Von Ninjas, die durchs Dachfenster kommen – bei offenen Türen
Ransomware, KI-Spear-Phishing und Angst im Mittelstand: Zac Warren, Chief Security Advisor bei Tanium, über die aktuelle Lage – und Besonderheiten in der EU.

Ransomware: software que secuestra sus datos.
Randomware: software que hace lo que le da la gana y secuestra sus esperanzas.
#shitpost

Two more banks notifying thousands of victims about Marquis Software ransomware attack https://therecord.media/banks-marquis-software-ransomware

Ukrainian national Artem Aleksandrovych Stryzhak pleaded guilty to his role in launching Netflix ransomware attacks. He faces a maximum penalty of ten years in prison.
https://www.justice.gov/opa/pr/ukrainian-national-…

Ukrainian National Pleads Guilty to Conspiracy to Use Nefilim Ransomware to Attack Companies in the United States and Other Countries
A Ukrainian national pleaded guilty today to one count of conspiracy to commit computer fraud for his role in a series of international ransomware attacks.

In 2025, the top 5 known exploited vulnerability (#KEV) vendors as of https://cyble.com/blog/cisa-kev-2025-exploited-vulnerabilities-growth/ were:
Microsoft (39)
<…

Ransomware gangs advancing Moscow’s geopolitical aims, Romanian cyber chief warns https://therecord.media/ransomware-gangs-advancing-moscow-geopolitical-interests-warns-romania

UAE claims it stopped ‘terrorist’ ransomware attack https://therecord.media/uae-claims-it-stopped-terrorist-ransomware-attack

Yet another major Korean cyber incident
Kyowon Group shuts down internal network after suspected ransomware attack
https://koreajoongangdaily.joins.com/news/2026-01-12/business/tech/Kyo…

Kyowon Group shuts down internal network after suspected ransomware attack
Kyowon Group said on Monday it had shut down parts of its internal network after detecting what it believes to be a ransomware attack and is investigating whether any customer data was compromised.

North Korean state hackers seen using Medusa ransomware in attacks on US, Middle East https://therecord.media/north-korean-hackers-using-medusa-ransomware

A lot happened over the weekend. Check out today's Metacurity for the most critical infosec developments you might have missed, including
--Proposed Israeli cyber law calls for cyber incident reporting in real time,
--Russia is likely the source of wiper malware that targeted Poland's energy sector,
--Russian national pleads guilty to targeting 50 victims with ransomware,
--DPRK group Konni is targeting blockchain engineers with malware,
--Critical flaw i…

Proposed Israeli cyber law calls for cyber incident reporting in real time
Russia is likely the source of wiper malware that targeted Poland's energy sector, Russian national pleads guilty to targeting 50 victims with ransomware, DPRK group Konni is targeting blockchain engineers with malware, Critical flaw in Solana's validator client fixed, much more

Ransomware gang threatens Cheyenne and Arapaho Tribes after shutting down schools https://therecord.media/cheyenne-arapaho-ransomware-rhysida

Romanian national water agency hit by BitLocker ransomware attack https://therecord.media/romania-national-water-agency-ransomware-attack

Nefilim ransomware hacker pleads guilty to computer fraud https://therecord.media/nefilim-ransomware-hacker-fraud

Polish police detain alleged cybercriminal with Phobos ransomware ties https://therecord.media/poland-phobos-ransomware-arrest

Great little story here about how a small town in Spain was hit with a ransomware attack, with the attackers demanding $5,000 in Bitcoin.
The town told the obviously small-time cybercriminals to go pound sand because they had sufficient backups to restore everything.
https://www.cryptopolitan…

So much infosec news, so little time. Check out today's Metacurity for the most critical cybersecurity developments you need to know, including
--ID documents for billionaires and top pols at Abu Dhabi conference were exposed online,
--Angola journalist was hacked with Intellexa spyware,
--Poland arrests Phobos ransomware affiliate,
--Severe flaw found in Dell RecoverPoint for Virtual Machine,
--Hacker who paid only a penny for a luxury hotel room was busted …

ID documents for billionaires and top politicians at Abu Dhabi conference were exposed online
Angola journalist was hacked with Intellexa spyware, Poland arrests Phobos ransomware affiliate, Severe flaw found in Dell RecoverPoint for Virtual Machine, Hacker who paid only a penny for a luxury hotel room busted in Spain, Oz financial technology company YouX suffered a massive breach, much more

Leading Japanese semiconductor supplier responding to ransomware attack https://therecord.media/leading-japanese-semiconductor-supplier-ransomware

Moscow man accused of posing as FSB officer to extort Conti ransomware gang https://therecord.media/moscow-man-accused-of-extorting-conti-gang

Don't miss today's Metacurity for a concise round-up of the most critical infosec developments you should know, including
--UK's NCSC warns of Russian-aligned hacktivist groups,
--UK and China enter a forum to discuss cyberattacks,
--Makina Finance lost $4.2m in an exploit,
--Ingram Micro report ransomware attack affecting 42k,
--Minnesota DHS breach affected 304k,
--SK Telecom appeals $91m fine,
--NexShield malvertising campaign crashes b…

UK's NCSC warns of Russian-aligned hacktivist groups
UK and China enter a forum to discuss cyberattacks, Makina Finance lost $4.2m in an exploit, Ingram Micro report ransomware attack affecting 42k, Minnesota DHS breach affected 304k, SK Telecom appeals $91m fine, NexShield malvertising campaign crashes browsers, much more

Air Côte d'Ivoire confirms cyberattack following ransomware claims https://therecord.media/air-cote-divoire-confirms-cyberattack

Payment tech provider for Texas, Florida governments working with FBI to resolve ransomware attack https://therecord.media/payment-tech-provider-texas-florida-govs-ransomware-attack

It's finally Friday, so before you stop working for the week, check out today's Metacurity for the most crucial cybersecurity developments you should know, including
--Trump cuts off US access to organizations seeking to strengthen cybersecurity,
--Prisoner swap sends alleged ransomware payment negotiator back to Russia,
--CISA retires ten emergency directives at once,
--Cambodian cybercrime kingpin extradited to China,
--Fugitive wanted for Desjardins br…

Trump ends US participation in organizations devoted to stronger cybersecurity
Prisoner swap sends alleged ransomware payment negotiator back to Russia, CISA retires ten emergency directives at once, Cambodian cybercrime kingpin extradited to China, Fugitive wanted for Desjardins breach arrested in Spain, Trans activists hacked Free Speech Union, much more

Suspected ransomware attack threatens one of South Korea’s largest companies https://therecord.media/kyowon-group-south-korea-suspected-ransomware-attack

The NHS Barts Health Hospital wants to legally ban the publication, use, or sharing of data stolen by the Clop gang by anyone.
https://www.bankinfosecurity.com/uk-hospital-asks-court-to-stymie-ransomware-data-leak-a-30222

More than $2 billion in payments from 4,000 ransomware incidents reported to Treasury in recent years https://therecord.media/fincen-treasury-2-billion-ransomware-payments-report

My sister used to teach courses for the University of Phoenix. Ugh.
University of Phoenix data breach impacts nearly 3.5 million individuals
https://www.bleepingcomputer.com/news/security/university-of-phoenix-data-…

University of Phoenix data breach impacts nearly 3.5 million individuals
The Clop ransomware gang has stolen the data of nearly 3.5 million University of Phoenix (UoPX) students, staff, and suppliers after breaching the university's network in August.

"Ryan Clifford Goldberg, a former incident response supervisor at Sygnia Consulting Ltd., and Kevin Tyler Martin, who was a ransomware negotiator for DigitalMint, pleaded guilty to one count each of conspiracy to interfere with commerce by extortion."
ht…

Apparently ransomware hackers are stealing people now.

Seems like the funeral industry in Korea has failed to meet its cybersecurity requirements. Gotta wonder if this is true everywhere. (not that most organizations aren't bad at cyber -- they are -- but haven't read much about the funeral industry).
Exclusive: Funeral Industry Faces Security Gaps as Top Firms Lack Key Certifications

Exclusive: Funeral Industry Faces Security Gaps as Top Firms Lack Key Certifications
Exclusive: Funeral Industry Faces Security Gaps as Top Firms Lack Key Certifications Despite managing sensitive data of millions, funeral companies remain exempt from information security regulations, raising concerns over data protection and ransomware risks

Notorious Russia-based RAMP cybercrime forum apparently seized by FBI https://therecord.media/notorious-russia-based-ramp-forum-seized

Check out today's Metacurity for the most critical infosec developments you might have missed over the weekend, including
--Trump to hand some offsec ops against adversaries to the private sector, report,
--Canada to probe billboard facial recognition use,
--Pope Leo weighs in on Italian spyware scandal,
--Oracle bug led to theft of sensitive NHS docs,
--Coupang founder will go MIA at parliamentary hearing,
--Asahi will change cyber posture after ransom…

Trump to hand some offsec ops against adversaries to the private sector, report
Canada to probe billboard facial recognition use, Pope Leo weighs in on Italian spyware scandal, Oracle bug led to theft of sensitive NHS docs, Coupang founder will go MIA at parliamentary hearing, Asahi will change cyber posture after ransomware attack, Apple issues emergency updates, much more

FBI takes down alleged money laundering service for ransomware groups https://therecord.media/fbi-takes-down-alleged-money-laundering-operation

So much cybersecurity news, so little time. Check out today's Metacurity for a quick run-down of the most crucial infosec developments you should know today, including
--Hackers claim to be selling Target's internal source code,
--Poland thwarted power system cyberattack,
--Hackers accessed the systems of Spanish energy provider Endesa and Energía XXI,
--Personal finance platform Betterment was hacked through third-party,
--Dutch national sentenced to sev…

Hackers claim to be selling Target's internal source code
Poland thwarted power system cyberattack, Hackers accessed the systems of Spanish energy provider Endesa and Energía XXI, Personal finance platform Betterment was hacked through third-party, Dutch national sentenced to seven years for hacking, Korea's Kyowon Group hit with ransomware, much more

Senegal confirms breach of national ID card department after ransomware claims https://therecord.media/senegal-breach-national-id-agency