The Interlock ransomware gang has been increasingly targeting education organizations in the U.S. and UK over the past year. These attacks are marked by a stealthier approach, making it harder for institutions to detect and respond to the threats. The group is known for encrypting files and demanding ransom payments, which can disrupt educational operations and compromise sensitive data. This trend raises concerns about the security of educational institutions, particularly as they often have limited resources to defend against such attacks. Protecting these organizations is crucial, as a successful ransomware attack can have lasting repercussions for students and staff alike.
The Cybersecurity and Infrastructure Security Agency (CISA) has been updating software vulnerabilities related to ransomware without notifying cybersecurity defenders, as pointed out by Glenn Thorpe of GreyNoise. This lack of transparency could lead to missed ransomware intrusions, as defenders may not be aware of the vulnerabilities that have been patched. The updates affected numerous software vulnerabilities last year, raising concerns about the potential risks for organizations relying on these systems. The situation emphasizes the need for better communication between CISA and cybersecurity professionals to ensure that all parties are informed about critical updates that could impact security posture.
The ransomware group DragonForce is adopting tactics reminiscent of organized crime, focusing on collaboration and coordination among different ransomware gangs. This shift suggests a more organized approach to cybercrime, potentially increasing the effectiveness and reach of their attacks. As these groups work together, they may create more sophisticated ransomware strains and exploit vulnerabilities in various systems. This trend raises concerns for businesses and individuals alike, as it could lead to a rise in ransomware incidents and more significant financial losses. Companies should be vigilant and enhance their cybersecurity measures to defend against these increasingly coordinated threats.
CISA has reported that ransomware gangs are now exploiting a serious vulnerability in VMware ESXi, which allows attackers to escape sandboxes and gain unauthorized access to systems. This vulnerability, which had previously been used in zero-day attacks, poses a significant risk to organizations using affected VMware products. Companies relying on VMware ESXi for virtualization need to be particularly vigilant, as attackers are actively targeting this flaw. The exploitation of such vulnerabilities can lead to severe data breaches and financial losses. Organizations should prioritize patching their systems to mitigate this risk and protect sensitive data from potential ransomware attacks.
The Federal Communications Commission (FCC) is urging telecom companies to enhance their cybersecurity practices in response to a rise in ransomware attacks. The FCC emphasizes that implementing basic security measures, such as regularly updating software, using multifactor authentication, and segmenting networks, can greatly reduce the risk of falling victim to these attacks. This guidance comes as ransomware continues to pose a significant threat to the telecommunications sector, which plays a crucial role in national infrastructure. By adopting these recommended practices, telecom providers can better protect sensitive customer data and ensure the reliability of their services. The FCC's advice serves as a timely reminder for the industry to stay vigilant against evolving cyber threats.
Researchers have identified a new ransomware-as-a-service (RaaS) variant known as 'Vect'. This operation stands out due to its custom malware, which poses a significant threat to organizations. The Vect RaaS allows attackers to easily deploy ransomware attacks, potentially affecting a wide range of victims, from small businesses to larger enterprises. The introduction of this variant raises concerns about the increasing sophistication of ransomware operations, making it crucial for companies to bolster their cybersecurity measures. Users are advised to stay vigilant and regularly update their security protocols to defend against such evolving threats.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Everest ransomware has claimed responsibility for a data breach involving legacy Polycom systems, which are now part of HP Inc. The attackers allege that they have stolen 90GB of internal data from these systems. This incident raises concerns about the security of older technology that may not receive regular updates or patches, leaving them vulnerable to exploitation. Organizations using such legacy systems should assess their security measures and consider upgrading to more secure solutions. The breach not only threatens sensitive internal information but also highlights the risks associated with maintaining outdated technology in a rapidly evolving cybersecurity landscape.
Hackread – Cybersecurity News, Data Breaches, AI, and More
Everest ransomware has claimed responsibility for a data breach affecting legacy Polycom systems owned by HP Inc. The attackers allege that they have stolen around 90GB of internal data. HP has yet to confirm the breach or provide details about the incident. This situation raises concerns about the security of legacy systems, which often have vulnerabilities that can be exploited by cybercriminals. As organizations increasingly rely on such systems, the potential for significant data theft becomes a pressing issue that companies need to address.
Tulsa International Airport has reportedly been compromised by the Qilin ransomware group, which claims to have stolen more than a dozen files from the airport's internal systems. This incident raises concerns about the security of critical infrastructure, as airports handle sensitive data and operations that are vital for public safety and travel. The breach could potentially disrupt airport operations or expose personal information of employees and travelers. As ransomware attacks continue to target essential services, this incident serves as a reminder for organizations to bolster their cybersecurity measures against increasing threats from cybercriminals. The situation is still developing, and further details regarding the extent of the breach and its implications are awaited.
A new wave of automated data extortion attacks is targeting exposed MongoDB instances. Cybercriminals are scanning for these unsecured databases and demanding low ransoms from their owners to restore access to the data. This trend raises concerns for businesses and individuals who may not have secured their databases properly, leaving them vulnerable to these attacks. The attackers exploit the lack of security measures in place, making it crucial for database administrators to implement proper configurations and safeguards. Without these protections, organizations risk losing important data and facing financial repercussions from ransom demands.
Marquis Software Solutions, a financial services provider based in Texas, reported that a ransomware attack in August was linked to a breach in its firewall provider, SonicWall. The attack affected several banks and credit unions across the United States. SonicWall's security issues came to light a month after the attack, raising concerns about the vulnerabilities in third-party security providers. This incident illustrates the risks that companies face when relying on external vendors for cybersecurity. It also highlights the necessity for organizations to continuously monitor and assess the security measures of their partners to prevent similar attacks in the future.
Marquis Software Solutions, a financial services provider based in Texas, has linked a ransomware attack that compromised its systems in August 2025 to a subsequent security breach involving SonicWall's cloud backup services. This incident impacted several U.S. banks and credit unions, raising concerns about the security of financial data and the potential for widespread disruption in banking services. The breach reportedly allowed attackers to exploit vulnerabilities in SonicWall's systems, leading to the ransomware attack on Marquis. This situation not only emphasizes the interconnected nature of cybersecurity risks but also highlights the importance of robust security measures for third-party services that handle sensitive financial information. As organizations increasingly rely on cloud solutions, ensuring their security is crucial to protect against similar incidents in the future.
According to researchers from ReliaQuest, the number of ransomware victims increased significantly in the fourth quarter of 2025, even though there were fewer active extortion groups at that time. The report indicates that data leaks also saw a dramatic rise of 50%. This situation suggests that while the number of groups engaging in ransomware attacks has decreased, the effectiveness and impact of those that remain have intensified. Companies and organizations need to be vigilant and enhance their cybersecurity measures, as the rise in victims and data leaks indicates that attackers are still finding ways to exploit vulnerabilities. This trend raises concerns about the overall security posture of businesses and the potential exposure of sensitive information.
As ransomware attacks become more aggressive, Chief Information Security Officers (CISOs) are urged to shift their focus towards enhancing business resilience. This includes taking immediate action to patch vulnerabilities, increasing user education to prevent successful phishing attempts, and implementing multi-factor authentication to secure access points. The rise in violent tactics used by attackers signals a need for companies to rethink their cybersecurity strategies and prioritize defense measures that can minimize disruptions. By proactively addressing these areas, organizations can better protect their assets and ensure continuity in the face of potential ransomware threats.
The article discusses the ongoing risk of password reuse, which is often overlooked by security teams focused on more obvious threats like phishing or malware. Many users tend to use similar passwords across different accounts, creating a vulnerability that can be exploited by attackers. This practice allows cybercriminals to gain access to sensitive information if they compromise one account. Organizations are urged to take this risk seriously and implement stronger password policies and user education to mitigate the problem. The article emphasizes that even seemingly minor password habits can lead to significant security breaches, making it crucial for companies to address these issues proactively.