Tag

ransomware

8 stories

Aur0ra’s AI-Driven Leap: How Cursor Agents Helped Hackers Reach Domain Admin

Ransomware operators tied to the Aur0ra (Aur0ra/Aur0ra) family used AI coding agents to shorten the path from stolen credentials to full domain administrator control, then collected data and prepared ransomware deployment. Sophos researchers traced the activity to a group tracked as GOLD OGRE, which combined human-provided access and goals with Cursor AI agents that automated many intrusion steps. The result: lower skill required to run complex intrusions and faster, more…

Saugata DattaOct 31, 20263 min read128

Cybersecurity

Breaking the Ransomware Chain: Flashpoint’s 2026 Survival Guide

Ransomware is scaling faster than many organizations anticipated. In the first half of 2026, Flashpoint tracked 6,256 ransomware incidents — a 45% jump from 2025 — driven by expanding Ransomware-as-a-Service (RaaS) ecosystems, commoditized tooling, and growing use of AI. For security leaders, threat hunters, and intelligence teams, understanding how these operations form and where they can be interrupted has become a business-critical priority. Why ransomware is surging Flashpoint’s analysis points…

Saugata DattaOct 27, 20262 min read161

Cloud Computing

Ransomware Strikes Colombian Justice Ministry Ahead of Presidential Transition

Colombia's Ministry of Justice was hit by a ransomware attack on August 2, affecting parts of its IT infrastructure and degrading several public-facing services just days before a national presidential handover. The disruption touched systems used for illicit-drug monitoring and legal processes; while some files were encrypted, the acting minister at the time, Cielo Rusinque, said publicly that there was no evidence of data exfiltration. The incident arrived amid heightened…

Saugata DattaAug 12, 20264 min read320

Artificial Intelligence

Microsoft Links Medusa Ransomware Affiliate to Zero-Day Exploitation Campaign

Microsoft’s recent analysis tying a Medusa ransomware affiliate to a campaign that leveraged zero-day vulnerabilities has put a renewed spotlight on the evolving tactics of extortion groups and the threat posed by previously unknown software flaws. For security teams and executives, the announcement is a reminder that threat actors are combining rapid vulnerability exploitation with tried-and-true ransomware playbooks to increase both speed and impact. What Microsoft reported and why it…

Saugata DattaApr 6, 20264 min read549

Cybersecurity

Hackers Weaponize Legitimate Windows Tools to Kill Antivirus — What Defenders Must Do Now

Ransomware gangs have evolved from noisy mass campaigns into precise, surgical operators. A growing and dangerous trend is the abuse of legitimate Windows utilities — tools built to help administrators troubleshoot and repair systems — as the first step in modern ransomware operations. By repurposing utilities such as Process Hacker, IOBit Unlocker, PowerRun, AuKill and TDSSKiller, attackers can silently neutralize antivirus (AV) and EDR protections, creating a short but effective…

Saugata DattaApr 1, 20265 min read660

Cybersecurity

What the Marquis Breach Teaches Us About Vendor Risk and Ransomware Preparedness

Marquis, a Texas-based provider of digital marketing, CRM and analytics services for hundreds of financial institutions, disclosed a major security incident tied to a mid‑2025 ransomware attack that ultimately exposed the personal information of more than 672,000 people. The story is less about a single failure and more about how a cascade of weaknesses—an exploited firewall, third‑party exposure, and slow discovery—can amplify harm across an industry that relies heavily on…

Saugata DattaMar 19, 20263 min read599

Cybersecurity

Cisco Under Fire: Zero-Day in Secure Firewall Management Center Powers Interlock Ransomware

A critical zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) — tracked as CVE-2026-20131 — has been exploited in the wild to deploy Interlock ransomware. The timeline and technical details reported by independent researchers make this a clear, urgent warning for organizations running Cisco FMC: an unauthenticated remote exploit can lead to arbitrary Java code execution with root privileges, and threat actors used it to build a sophisticated, multi-stage…

Saugata DattaMar 19, 20264 min read808

Artificial Intelligence

When Money Talks and Machines Mimic: Ransomware, Extortion, and the AI Arms Race in Cybersecurity

The landscape of cyber threats has shifted decisively toward financially motivated crime. Extortion and ransomware now drive more than half of attacks with known motivations, as opportunistic criminal groups scale operations with automated tooling and AI. Speed, automation, and deception combine to inflict outsized damage on vulnerable organizations and public services. Why extortion and ransomware dominate Ransomware and extortion target assets that are both critical and costly to restore. Hospitals,…

Saugata DattaFeb 11, 20263 min read869

Free Tools: IP, DNS, SSL