Ransomware Update 2026: Disclosure, Response, and Open Questions
Learn how 2026 ransomware evidence affects disclosure timing, incident response, recovery, and federal reporting duties.
Category Ransomware Attacks
Ransomware incidents and attacks
Ransomware Attack: Common Scams and Follow-Up Threats
Learn how ransomware begins, why threats can continue after payment, and which immediate steps can limit further damage.
Ransomware Operators Exploit Windows Directory Replication to Launch Qilin Attacks
This method, documented in attacks throughout H1 2026, allows attackers who have already gained network access to harvest the password hashes of every...
Code Repository Attack Unleashes Advanced Botnet Malware Across Systems
Miasma botnet malware reached developers through compromised open-source packages, stealing credentials and cloud access tokens from infected machines across three coordinated campaigns in 2026.
Sophisticated Daxin Malware Reemerges in Taiwan with Additional Backdoor Capability
Daxin and its new Stupig backdoor persisted undetected for 13 years, exploiting outdated Java software to infiltrate Taiwan's high-tech manufacturing sector.
Popular npm Package Compromised: Malware Injection Affects 2 Million Users Each Week
Millions of developers received malware through compromised npm packages; rotate credentials and audit systems immediately if your projects depend on AsyncAPI, Keyv, Axios, or @ctrl/tinycolor.
US Treasury Issues First Sanctions Against VPN Operators Supporting Ransomware Gangs
Treasury sanctions VPN operator and cybercriminal suppliers for enabling 25+ ransomware groups targeting U.S. hospitals, governments, and financial firms.
Ransomware incidents surge 20 percent during first half 2026
Large enterprises and U.S. healthcare organizations face accelerating ransomware targeting, with enterprise attacks up 74% and healthcare enduring 2.3 attacks daily in H1 2026.
Hackers distribute credential-stealing malware via fake software repositories
The attack exploits developer trust in open-source repositories.
Malware evades security tools through Windows symbolic link exploit
Attackers can hijack Windows Defender using symbolic links, requiring only admin access and built-in Windows commands, leaving minimal forensic traces.