Thursday, April 16, 2026
HomeRansomware

Ransomware

New Chaos RaaS Group Using Voice Social Engineering & RMM Abuse for Data Exfiltration

A sophisticated new ransomware-as-a-service operation called Chaos that emerged in February 2025, employing advanced social engineering tactics and legitimate tools to conduct big-game hunting attacks. The group has demonstrated a concerning evolution in ransomware operations by combining traditional spam campaigns with voice-based manipulation techniques,...

FBI Alerts About Hacker Community Tied to Ransomware-as-a-Service Gangs

The Federal Bureau of Investigation has issued a stark warning about an evolving cybercriminal ecosystem called "Hacker Com," a sophisticated subset of the international threat group known as "The Com." This primarily English-speaking network comprises multiple interconnected criminal organizations whose members, including many minors,...

GLOBAL GROUP Launches Golang-Based Ransomware Targeting Windows, Linux, and macOS Systems

A new ransomware-as-a-service operation, called GLOBAL GROUP, has emerged on cybercrime forums; however, forensic analysis reveals it's a sophisticated rebranding of the defunct Mamona RIP and Black Lock ransomware families. The group, operated by a threat actor known as "$$$," has developed a cross-platform ransomware...

Chinese SM2 Cryptographic Standard Exploited in Windows System Attacks by NailaoLocker Ransomware

A new ransomware variant dubbed NailaoLocker is making waves in cybersecurity circles for its sophisticated deployment of the Chinese SM2 cryptographic standard, a first among ransomware strains targeting Microsoft Windows systems. Discovered by FortiGuard Labs, NailaoLocker raises the stakes in the global cyber threat landscape with...

Windows Management Instrumentation Exploited by New KAWA4096 Ransomware to Erase Shadow Copies

June 2025 has witnessed the emergence of a formidable new ransomware, KAWA4096, which exploits Windows Management Instrumentation (WMI) to erase shadow copies and maximize its destructive impact on victims. Security experts at SpiderLabs have been actively monitoring KAWA4096, which, in less than a month,...

OVERSTEP Ransomware Deployed Through Exploited 0-Day RCE Vulnerability in SonicWall SMA Devices

Google Threat Intelligence Group (GTIG) has uncovered a sophisticated campaign by the financially motivated threat actor UNC6148, targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances. The campaign leverages previously stolen credentials and one-time password (OTP) seeds to maintain persistent access...