VulnHub

A new strain of ransomware known as Vect 2.0 is being deployed against organizations affected by the TeamPCP supply chain attacks. However, security experts warn that paying for a decryptor might not be wise, as a design flaw in the ransomware makes it function more like a wiper than traditional ransomware. This means that instead of simply encrypting files for ransom, it may permanently erase data. Companies that have been impacted need to be cautious, as the ramifications of this ransomware could lead to significant data loss. Organizations should prioritize data backups and consider their recovery options before engaging with the attackers.

Recent attacks attributed to Trigona ransomware are making headlines due to their use of a custom command-line tool designed to expedite data theft from compromised systems. This tool allows attackers to extract sensitive information more quickly and efficiently than traditional methods. Organizations that fall victim to these attacks may find their data exposed or held for ransom, leading to potential financial losses and reputational damage. The emergence of such tailored tools signifies a growing trend among cybercriminals to enhance their tactics, making it crucial for companies to bolster their defenses. As these incidents continue to rise, understanding the methods employed by ransomware groups becomes essential for effective cybersecurity strategies.

The 2026 InsurSec Report from At-Bay reveals a significant increase in cyber insurance claims, with a 7% rise in frequency and an average claim severity reaching $221,000. Ransomware attacks are notably costly, with an average severity of $508,000, marking a 16% increase from the previous year. A key finding is that remote access services were the entry point for 87% of ransomware claims in 2025, indicating a major vulnerability for organizations. This rise in claims underscores the growing threat of cyber incidents, particularly ransomware, and highlights the need for businesses to strengthen their security measures. As cyber threats evolve, companies must prioritize securing remote access points to mitigate risks and potential financial losses.

Citizens Financial Group and Frost Bank, two significant U.S. banks, have reportedly fallen victim to the Everest ransomware group. This operation has claimed to have stolen large volumes of sensitive data from both institutions and is threatening to release this information by April 26. The breach is concerning not only for the banks but also for their customers, as it raises fears about the exposure of personal and financial information. Ransomware attacks on financial institutions can lead to severe consequences, including financial loss and damage to customer trust. As the situation develops, both banks will need to respond quickly to mitigate the impact of this breach and reassure their clients.

Recent research from Check Point has revealed that the command-and-control server associated with the SystemBC malware has been connected to over 1,570 victims of The Gentlemen ransomware operation. SystemBC is a type of proxy malware that allows attackers to establish network tunnels for malicious activities. This discovery underscores the scale of the threat posed by this ransomware-as-a-service operation, which has been actively targeting various organizations. The findings indicate that victims may be vulnerable to further exploitation, as the botnet can facilitate additional attacks. Organizations need to be vigilant and take steps to secure their networks against such threats.

The hacking group ShinyHunters claims to have breached nine well-known companies, including Zara, 7-Eleven, and Carnival Corporation. They are threatening to release over 9 million records that contain personal information and internal data unless a ransom is paid by April 21. This situation raises significant concerns for the affected brands as it puts customer data at risk and could lead to identity theft or other malicious activities. The release of such a large volume of sensitive information could also damage the reputation of these companies and erode consumer trust. As the deadline approaches, it remains crucial for these organizations to enhance their security measures and communicate transparently with their customers about the potential breach.

The Seiko USA website was hacked over the weekend, resulting in a defacement that included a message from the attackers claiming to have stolen customer data from its Shopify database. The hackers threatened to release this data unless a ransom is paid. This incident raises concerns for customers who may have shared their personal information with Seiko USA, as it could lead to identity theft or fraud if the data is leaked. The event highlights the ongoing risks that e-commerce platforms face from cybercriminals looking to exploit vulnerabilities for financial gain. As a reputable brand, Seiko USA's breach could also damage its reputation and customer trust if the claims are verified.

The Payouts King ransomware group is using the QEMU emulator to create hidden virtual machines on infected systems, allowing them to set up reverse SSH backdoors. This tactic helps the attackers circumvent traditional endpoint security measures, making it harder for victims to detect and respond to the intrusion. By utilizing these hidden VMs, the ransomware can operate stealthily, increasing the likelihood of successful data exfiltration and ransom demands. Organizations that fall victim to this ransomware may face significant operational disruptions and financial losses. It's crucial for companies to enhance their security protocols to guard against such sophisticated attacks.

Hackers have been exploiting the QEMU machine emulator in at least two separate campaigns aimed at deploying ransomware and remote access tools. This abuse allows attackers to bypass security measures, making it harder for organizations to detect their malicious activities. The implications are significant, as this could potentially lead to data breaches and unauthorized access to sensitive information. Companies using QEMU should be vigilant and assess their defenses against these types of attacks to safeguard their systems. Researchers are urging affected organizations to review their security protocols and update their defenses accordingly.

According to Infosecurity Magazine, ransomware attacks on automotive manufacturers have surged dramatically, with incidents more than doubling from 2024 to 2025. This alarming trend signals a growing vulnerability within the automotive sector, which has increasingly integrated digital technologies into its operations. As attackers target these manufacturers, the potential for significant disruptions in production and supply chains rises, posing risks not only to the companies involved but also to consumers and the broader economy. The rise in ransomware incidents indicates a pressing need for the automotive industry to enhance its cybersecurity measures and prepare for potential attacks. Companies must prioritize protecting their systems to safeguard against these evolving threats.