Ransomnews

When the internet gets ugly, we go deeper. Cybersecurity, AI, and cyber crime - reported clearly. Reviewed thoroughly.

[Dancho Danchev @dancho_danchev]

https://t.co/4uvZcJEBOL

[Ransomnews @Ransomnews_com]

@FsecIntelEs Btw we have investigated the exploit.[in] db from their early years

https://t.co/Dg3v7otaZa

[Ransomnews @Ransomnews_com]

The rest of the Condé Nast hack is for sale: 32.8M user records for $15,000 on a Russian-language forum. We tested the sample. It is real, it was taken in September and October 2025, and 30.5M of it has never surfaced. Condé Nast still has not said a word. https://t.co/6Ggb2Bf5KO

[Ransomnews @Ransomnews_com]

A UK driving license number encodes your surname, your date of birth and your initials.

That is how we checked whether this dump was real.

877,000 UK driver records listed for $600. In the sample, 98.1% of license numbers matched the surname on their own record.

It checks out.

https://t.co/lT69mdP5AA

[Ransomnews @Ransomnews_com]

@IntelOpsV3 @kernelstub What did he stole exactly?

[Ransomnews @Ransomnews_com]

"Most companies pay when they have something to hide."

A ransomware operator on why extortion works. Not downtime. Exposure.

New on @Ransomnews_com: The Danchev Interviews. @dancho_danchev puts threat actors on the record.

First: RTM Locker.

https://t.co/ST2h03Av8Z

[GangExposed RU @GangExposed_RU]

1/5
I have something new on LockBitSupp.

This is Evgeny Dementyev - the leader of LockBit.
Instagram username: dementev23
Photo from 2019.

Initially, I was skeptical about this finding. 👇

[Ransomnews @Ransomnews_com]

7.3M chess.[com] records leaked last week.

We proved they're real without ever touching chess.[com].

And it's still not a breach.

https://t.co/5IupPjqygh

[Pierluigi Paganini - Security Affairs @securityaffairs]

Alleged #Żabka Breach Exposes Jira Data, Source Code, and API Keys
https://t.co/ZdwS9N2ZSs
#securityaffairs #hacking

[Nicolas Krassas @Dinosn]

Alleged Żabka Breach Exposes Jira Data, Source Code, and API Keys https://t.co/MuHZxXSoyy

[K.O Kryptowaluty @KO_Kryptowaluty]

Podążając za @niebezpiecznik w sieci pojawiła się baza danych pracowników/partnerów żabki i wiele innych.

Ransomnews dostała próbkę danych i ponoć wygląda wiarygodnie, tak czy inaczej jak korzystacie z apki żabki i macie jedno hasło do różnych miejsc, to dla świętego spokoju je zmieńcie.

Co ciekawe trzy dni znalazł się kupiec na spółkę żabki, więc niewykluczone że ktoś próbuje to w jakiś sposób wykorzystać, a sama baza jest tylko baitem.

[Ransomnews @Ransomnews_com]

1.16 BILLION login attempts. 320,777 FortiGate firewalls. One crew.

Inside the FortiBleed operation: mass brute force → hashes cracked on a 45-GPU cluster → SSL VPN session hijacking → straight into Active Directory.

Mapped to MITRE, victims cross-referenced, infra anonymised. @MayhemDayOne 👇

https://t.co/8bpSzhd7JP

[Ransomnews @Ransomnews_com]

Everyone's covering the Novo Nordisk breach wrong.
FulcrumSec stole 1.3 TB, demanded $25M, and Novo Nordisk refused.
But two things nobody's saying:

The credentials were leaking for MONTHS before the breach.

We ran novonordisk through our stealer-log index:
→ 211 employee logins → 580 captured on Novo's own pages → 2,932 live session cookies
The cookies are the killer. Valid cookie = resume a logged-in session. No password. No MFA.
By the time you hit a leak site, the warning was sitting in stealer logs for weeks. Nobody reads them.

They didn't just steal data. They stole the AI.

A 16.7 GB multimodal model checkpoint. The training data. 113 training runs.
That's not a breach. It's the theft of a drug-discovery programme.
A stolen database loses value when it leaks. A trained model doesn't. No ransom, no court order puts it back in the box.

Full breakdown 👇 https://t.co/wRNZ1yyDSH

[Ransomnews @Ransomnews_com]

The US banned Fable 5 and Mythos 5 for all foreign nationals.
But a "US-only" AI model is just a KYC gate, and right now stealer logs already hold:
🔓 34,814 live Claude session cookies
🔓 74,114 for ChatGPT

Replayable. No password, no MFA, no citizenship check.
https://t.co/rTMRoM19SE

[Ransomnews @Ransomnews_com]

The Gentlemen: from unknown to 2026's #2 ransomware brand. 483 victims, 66 countries, run by ~9 people.

We pulled the live tracker and cross-checked victims against infostealer logs. The stolen-cookie access pipeline is the real story.

https://t.co/lDsrMW7wei

[Ransomnews @Ransomnews_com]

Practical takeaways:

- Weight your IR calendar toward Mon/Tue mornings US time
- Treat October as alert season
- Stop tracking the top 10. The long tail of 200 brands is doing the post-2025 work

Full analysis, charts, methodology:
https://t.co/uvi0oeKPu0

[Ransomnews @Ransomnews_com]

24 months of ransomware leak-site data.

16,699 posts. 200 groups.

The finding that broke the popular image: ransomware runs office hours.

84% of leaks land Mon-Fri. 50% in just 8 UTC hours.

Thread on what the data actually shows.

[Ransomnews @Ransomnews_com]

The new flagship: Qilin.

1,690 victims, 2.3 per day average across 731 active days.

Akira sits #2 with 1,124.

RansomHub, the 2024 volume leader, has been dark since April 2025. The Gentlemen, a late-2025 newcomer, has racked up 408 victims in 246 days.