Clop Exploits Windchill: JSP Web Shell Steals Credentials and Engineering Data
Analysis of Clop ransomware's exploitation of CVE-2026-12569 in PTC Windchill, using a JSP web shell to steal engineering data and credentials from PLM servers.
Ransomware
More news
Page 4 / 5 · 45 articles
Medusa Ransomware Victims Surpass 500: Healthcare and Critical Infrastructure in the Crosshairs
CISA and FBI report Medusa ransomware has over 500 victims, with attacks on healthcare and critical infrastructure, exploiting vulnerabilities rapidly.
Switzerland Seeks 12-Year Sentence for Developer Linked to LockerGoga, MegaCortex, and Nefilim
Swiss prosecutors demand a 12-year prison term for a Ukrainian developer accused of leading ransomware attacks causing CHF 130M in damages.
Gunra, the Conti-Derived Ransomware Group Now Exploiting Exposed Firewalls and VPNs
CISA advisory on Gunra ransomware group exploiting exposed firewalls and VPNs. Derived from Conti, it uses double extortion and targets multiple sectors.
Akira Disables EDR and Antivirus in Safe Mode but Fails to Encrypt Files
Akira ransomware affiliate disabled EDR and antivirus in Safe Mode after accessing a VPN without MFA, but failed to encrypt files, highlighting security vulnerabilities.
DeadLock Leverages Polygon to Make Ransomware Harder to Stop
DeadLock ransomware uses Polygon blockchain for decentralized data leaks and chat, hindering stopping efforts with 96 victims and advanced encryption.
SharePoint: CISA Confirms Ransomware Exploitation of CVE-2026-45659
CISA confirms ransomware exploitation of SharePoint CVE-2026-45659 vulnerability. Patch servers and enable AMSI to prevent code execution and network breaches.
Gunra: The RaaS Ransomware Targeting Exposed Networks and Critical Infrastructure
Gunra ransomware, derived from Conti, uses RaaS to target exposed networks and critical infrastructure with double extortion. Key defensive measures outlined.
Storm-1175 Exploits Critical N-central Flaw to Target MSPs
Storm-1175 exploits a critical N-central zero-day to launch ransomware attacks against MSPs, compromising downstream clients. Immediate fixes recommended.