Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
22 matching stories
RansomwarePalo Alto Unit 42: 405 AI-enabled malware samples show 12 in production
Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.
LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay
LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.
Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery
Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.
StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577
A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.
Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs
Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.
Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.
Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.
DragonForce Ransomware Hits Saudi Chemical Manufacturer
The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.
CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors
CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN/Cenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.
AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'
AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.
Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims
AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.
Acronis TRU details INC ransomware evolution with 800+ victims and YARA rules
Acronis Threat Research Unit publishes a detailed analysis of INC ransomware, tracing its evolution from an emerging RaaS operation to a top-tier group with 800+ victims since 2023, including full attack chain, YARA rules, and IOCs.
Interlock Ransomware Exploits Cisco FMC Zero-Day for Unauthenticated Root RCE
Interlock ransomware is actively exploiting a critical Cisco FMC zero-day (CVE-2026-20131) that allows unauthenticated remote attackers to execute arbitrary Java code as root, with double extortion and custom tooling.
FortiBleed: 75k Fortinet FortiGate firewalls with cracked admin passwords leaked by Russian ransomware group
FortiBleed leaks 75,000 Fortinet FortiGate firewalls with cracked admin passwords, with a Russian ransomware group behind the credential harvesting and GPU brute-forcing.
RansomEXX deploys ESXiArgs ransomware against VMware ESXi hypervisors
RansomEXX is running a new ESXiArgs ransomware campaign targeting VMware ESXi hypervisors, featuring a multiplatform variant and a fresh wave of infections across France and other regions.
U-Bomb Rware Runs Active Leak Site with Proton Mail and BRC4/Sliver/Cobalt Strike Lateral Movement
U-Bomb ransomware, active since March 2023, operates a data leak site at a .onion address last visited 2026-04-28, delivers payloads via phishing email, and uses BRC4, Sliver, and Cobalt Strike for lateral movement before encrypting Windows and Linux targets.
CISA Issues #StopRansomware Advisory for Gunra Ransomware
CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.
Blacktor Ransomware Group Claims 4 Victims via Infostealer Infections
Blacktor is a low-profile ransomware group with a Tor-based leak site claiming 4 victims across Indonesia, Italy, Venezuela, and the US, driven by Infostealer infections per Hudson Rock.
SatanLock ransomware group shuts down after six months, claims 67 victims
SatanLock, a double-extortion ransomware group, has ceased operations after roughly six months, claiming 67 compromised organizations and leaking stolen data.
New Ransomware Group Linkc Targets H2O.ai with Extortion Claims
A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.
Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims
Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.
GDLockerSec Claims Attacks on Nigerian Agency and AWS, but Evidence Suggests Amateur Operation
The GDLockerSec ransomware group has claimed responsibility for attacks on a Nigerian government agency and Amazon Web Services in January 2025, yet forensic analysis indicates the operation is amateurish and relies on exaggerated narratives to inflate its reputation within the cybercrime ecosystem.
Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics
Trend Micro has detailed the sophisticated tactics of The Gentlemen ransomware group, which leverages legitimate driver abuse and Group Policy Object manipulation to compromise manufacturing, healthcare, and construction sectors globally.
