Ransomware & Extortion

Ransomware Group Emperador Claims 3.9 GB Data Theft from AB InBev

The ransomware group Emperador has added AB InBev, the manufacturer of Budweiser and Corona beers, to its list of alleged victims. The group claims to possess 3.9 GB of internal data and is demanding a $1 million Bitcoin ransom. The listing includes 329,244 social listening alerts, 2,510 corporate emails from subsidiaries, around 19,000 access records, internal service portal logs, and public key infrastructure certificates. Most of the data volume, 3.2 GB, is attributed to Azure storage assets. AB InBev has neither confirmed nor denied the claims, and no samples have been published to verify authenticity. The announcement provides no details on how the data was allegedly obtained, such as an exposed storage account or leaked credentials. While access records and certificates could aid network mapping and lateral movement, the lack of private keys or confirmed encryption of systems limits the immediate impact assessment.

Russian Ransomware Groups INC and The Gentlemen Deploy AI-Driven Phantom Framework for Fully Automated Attacks

SOCRadar researchers have disclosed the Phantom framework, an AI-powered autonomous ransomware attack platform operated by members linked to the INC and The Gentlemen groups. The system uses commercial large language models routed through OpenRouter to scan 7,158 edge devices, steal 535 administrator accounts, and compromise 4,140 endpoints. AI agents autonomously generate custom encryption binaries, craft personalized ransom demands based on stolen financial data, and write kernel drivers to disable EDR solutions before encryption. The framework runs on 32 custom MCP servers that give the AI direct access to scanning, credential abuse, financial analysis, and anti-detection tooling. Human operators only supply target prompts and approve final actions while the AI executes the entire kill chain. Phantom Agent v3.1 implants masquerade as Windows Update components and communicate over encrypted channels with randomized polling intervals. The discovery reveals a mature Ransomware-as-a-Service model that lowers the barrier for other criminal groups to conduct large-scale AI-automated extortion.

Creator of Ransomware Forum Ramp4u Hands Over 1.5 Billion Rubles to Russian Law Enforcement

A darknet researcher known as exkgb has published an analysis of the ransomware forum Ramp4u.io, revealing that its founder cooperated with authorities by transferring 1.5 billion rubles. The report follows the author's earlier coverage of the Exploit forum administration, which drew significant reader interest with only a 6% bounce rate. Ramp4u is described as a dedicated ransomware marketplace operating on the dark web. The article positions the forum as a key platform in the ransomware ecosystem and notes the unusual cooperation with security forces. exkgb continues to monitor and document major darknet platforms for the cybersecurity community.

Ransomware Attack on SoftBank's IDCF Cloud Encrypts 3.6PB in 7 Minutes as Operations Team Misses Alerts for 7 Hours

SoftBank subsidiary IDC Frontier suffered a ransomware attack on its IDCF Cloud East Japan Region 1 that encrypted 3.6PB of primary storage across 239 hypervisors and 225 datastores in just seven minutes. Attackers also destroyed 554,153 snapshots, eliminating 41.5PB of backup capacity and leaving 495 enterprise and government customers without recoverable data from the provider. Operations staff spent the next seven hours repeatedly rebooting already-encrypted virtual machines and resetting console passwords while failing to locate any of the 225 RECOVER-INFO.txt ransom notes left in datastore root directories. The intrusion was only confirmed after the threat actors directly defaced the vCenter management console with the message “IDCF CLOUD INFRASTRUCTURE SEIZED”. The incident highlights critical gaps in asset inventory, log monitoring, and incident response procedures rather than any zero-day exploit. No ransom was paid; the provider instead focused on public updates while advising customers to rely on their own off-site backups.

WannaCry Ransomware: How EternalBlue Turned One Infection Into a Global Epidemic

On 12 May 2017, the WannaCry ransomware worm rapidly infected more than 230,000 computers across at least 150 countries by exploiting the unpatched SMBv1 vulnerability with the EternalBlue exploit. The malware combined remote code execution via EternalBlue with file encryption and ransom demands in Bitcoin, affecting hospitals, manufacturers, and government organizations worldwide. Microsoft had released the MS17-010 patch two months earlier, yet many systems remained vulnerable due to delayed deployment in large environments. WannaCry scanned both local subnets and random public IPv4 addresses in parallel threads, allowing infected machines to autonomously discover and compromise new targets without user interaction. Security researcher Marcus Hutchins halted the initial wave by registering a hardcoded kill-switch domain, though later variants removed this check. The incident demonstrated how a known, patchable flaw combined with worm-like propagation could produce worldwide operational disruption.

International Law Enforcement Operation Dismantles KillSec Ransomware Group and Seizes 110 TB of Stolen Data

An international operation coordinated by Eurojust with support from Europol has dismantled the infrastructure of the KillSec ransomware group. Authorities seized five servers containing at least 110 terabytes of data stolen from victims and took control of the group's leak site domains. Three individuals were arrested, including a 16-year-old identified as the group's primary administrator and operator. The coordinated action involved law enforcement from nine countries and included eight searches across Spain, Greece, the United Kingdom, and Romania. KillSec has been active since 2024 and is linked to nearly one thousand ransomware incidents worldwide, primarily using a double-extortion model that combines data encryption with threats to publish stolen information. The seized data volume highlights the scale of the group's operations, which frequently targeted healthcare environments where system downtime directly impacts patient care.

ShinyHunters Claims Breach of FBI Recruitment Portal and Demands Eight-Figure Ransom

The hacker group ShinyHunters has publicly claimed responsibility for compromising the FBI's official recruitment website, FBIjobs.gov, asserting access to sensitive data belonging to nearly all FBI agents as well as job applicants. According to the group, the intrusion extended to multiple internal systems including criminal justice databases, human resources platforms, and Medlink. The attackers stated they exploited a zero-day vulnerability in Oracle PeopleSoft to achieve remote code execution and subsequently defaced the careers site with a fabricated seizure notice. The FBI has acknowledged awareness of unauthorized activity on the portal but has not confirmed any data theft or the scope of the intrusion. ShinyHunters is now demanding an eight-figure ransom payment, framing the amount as a minor fraction of its own resources and warning that time is limited. The operation appears to be retaliation for an FBI public statement issued in May regarding the group's prior activities. Independent verification of the claims remains unavailable, and experts note that extortion groups routinely exaggerate the value of stolen data to increase pressure on victims.

PAYLOAD Ransomware Seizes Active Directory GPO to Disrupt Entire Windows Domain Without Encryption

Researchers at Kaspersky have documented an attack by the PAYLOAD ransomware that paralyzes an entire Windows domain without encrypting a single file. Instead of encryption, the operators leverage native Windows policy mechanisms to enforce disruption across the environment. The core of the attack is a malicious Group Policy Object named PAYLOAD linked directly to the root of the Active Directory domain. This placement allows the policy to reach virtually every connected device, turning it into a corporate-wide disruption tool. Through the GPO, the group distributes ransom notes from SYSVOL, replaces wallpapers and lock screens with extortion images displaying the message Welcome to Payload, and disables local administrator accounts on affected machines. A second policy object named win Firewall Off disables the Windows firewall across the entire fleet, increasing exposure during the operation. Initial access occurred in April 2026 via a compromised legitimate domain account on a FortiGate SSL VPN, with possible entry vectors including phishing, password spraying, and credential stuffing. The victim is a manufacturing company in the Middle East. The extortion model combines data theft with operational shutdown, delivering effects similar to traditional ransomware but without any decryption key to negotiate.

Ransomware Operators Hijack Active Directory via GPO to Lock Companies Without Encryption

Kaspersky researchers have uncovered a new extortion campaign called Payload that targets manufacturing companies by compromising privileged accounts and seizing control of Active Directory. Instead of deploying traditional ransomware encryptors, the attackers created a Group Policy Object named Payload linked to the domain root. This GPO automatically changed desktop wallpapers and lock screens across all systems, displayed ransom demands, and disabled administrative accounts after policy refresh. The group also exfiltrated valuable corporate data before the lockdown and later published it on the dark web to increase pressure on victims. Because the attack relied entirely on legitimate Windows mechanisms such as VPN access and Group Policy, conventional antivirus solutions proved ineffective. Experts recommend monitoring GPO changes, enforcing phishing-resistant MFA on VPN and admin systems, and applying least-privilege principles to limit the impact of credential compromise.

SETTRA Ransomware Deploys MeshAgent and gdrv.sys BYOVD Against Windows Systems

Huntress analysts have identified two separate incidents involving the newly observed SETTRA ransomware targeting Windows environments. The attacks combined the legitimate MeshAgent remote management tool with a Bring Your Own Vulnerable Driver technique using gdrv.sys to disable security controls. Victims included a consumer services and retail company hit in July and an industrial organization compromised in September. Initial access occurred through VPN connections or previously stolen credentials, after which operators deployed MeshAgent to maintain persistence and execute commands. Before encryption, the group deleted Windows event logs, disabled system recovery features, removed recovery partitions, and overwrote free disk space. Encrypted files received the .locked or .locked_wip extensions, with the ransomware binary named after the victim domain and ransom notes dropped as RESTORE_FILES.txt.

Ukrainian Developer of LockerGoga, MegaCortex and Nefilim Ransomware Sentenced to 12 Years and Nine Months

A 52-year-old Ukrainian national has been sentenced by the Zurich District Court to 12 years and nine months in prison for his role as the lead developer of the LockerGoga, MegaCortex and Nefilim ransomware strains. The court determined that the malware he created was deployed against companies across dozens of countries, causing approximately 100 million Swiss francs in damages in the cases examined. Notable victims included train manufacturer Stadler Rail, which suffered the theft of around 500 GB of confidential data and a $6 million ransom demand in 2020, as well as climate equipment supplier Meier Tobler and banking software developer Crealogix. The defendant claimed he was performing ordinary cybersecurity consulting and was unaware of the intended use of his code, but investigators found ransom demand templates alongside the source code, undermining his defense. He has been in custody since October 2021 as part of a wider international investigation into attacks affecting more than 1,800 individuals and organizations in 71 countries. Upon release he will be banned from entering Switzerland for ten years, although the verdict remains subject to appeal.

Android Ransomware Mantax Otax Encrypts Files and Streams Victim Screen in Real Time

Researchers at Zimperium have identified a new Android ransomware strain called Mantax Otax that combines file encryption with live screen recording and surveillance capabilities. The malware is distributed through sideloaded APK files delivered via messaging apps and phishing messages rather than official app stores. Once installed, it uses AES encryption to lock files with the .enc extension and conducts ransom negotiations directly on the infected device through an on-screen chat interface. In addition to encryption, Mantax Otax continuously captures the screen, saves footage as MP4 video, and streams it to operators while also photographing the surroundings with the device camera. The malware abuses accessibility services to read on-screen content, intercepts SMS messages to steal two-factor authentication codes, and exfiltrates contacts, call logs, browser history, and credentials from WhatsApp and Telegram. It also displays a fake lock screen to capture the device PIN. Impact is reduced on Android 10 and later due to Scoped Storage restrictions, though surveillance functions remain active. Evidence points to a targeted campaign against users in Indonesia.

IT Elements 2026 Conference: Ransomware Accounts for 69% of Incidents as Businesses Struggle with Backup Protection and AI Workloads

The fourth IT Elements conference opened in Moscow on September 9, focusing on business continuity after cyberattacks, infrastructure failures, and ransomware incidents. Jet CSIRT data showed that ransomware was responsible for 69% of confirmed incidents in the first half of 2026, with the majority occurring in the second quarter. Experts discussed the challenges of protecting backup copies from compromise, the frequent gap between stated RTO targets and real-world recovery times, and decision-making processes during major outages. The event also covered corporate AI agents, stressing the need for strong Data Governance, Data Quality, and DataOps practices to avoid unreliable model outputs. Research from Jet Infosystems and AC IKS revealed that over 30% of companies have already allocated dedicated network segments for AI workloads, with power demands reaching 80-200 kW per rack. On the networking track, testing of Eltex and EcoRouter devices showed adequate performance in standard scenarios but highlighted the lack of a universal domestic solution. The conference concluded with discussions on workforce changes, noting that AI is altering career paths for junior specialists and increasing demand for professionals who understand business context and can critically evaluate model results.

Ransomware Operators Linked to The Gentlemen Deploy TukTuk C2 Framework for Espionage and Credential Theft

Operators associated with the ransomware group The Gentlemen have adopted a new command-and-control framework called TukTuk to steal credentials, monitor compromised systems, and prepare environments for ransomware deployment. The framework was discovered on a server that also hosted tools for disabling EDR solutions, research on vulnerable drivers, and data apparently stolen from two large organizations. TukTuk includes agents for both Windows and Linux, along with its own backend and management panel that allows remote command execution, file transfers, screen capture, and device tracking through a single interface. One notable feature displays a fake Windows Security window on the victim's machine to capture entered credentials and send them directly to the attackers' panel. Researchers identified a DLL sideloading technique that abuses the legitimate Greenshot.exe executable to load a malicious log4net.dll library and launch the TukTuk agent. The server also contained EDRKiller, WarsawKiller, and UnknownKiller tools, plus materials on BYOVD attacks that leverage vulnerable legitimate drivers to gain kernel access and interfere with security products.

The Evolution of Ransomware: From 1989 Floppy Disks to Multi-Million Dollar Extortion Empires

Ransomware has transformed dramatically since its origins in 1989, when evolutionary biologist Joseph Popp mailed AIDS-themed floppy disks demanding $189 via Panamanian mail. Early experiments like GPCode and Archiveus introduced stronger cryptography by the mid-2000s, while Reveton and CryptoLocker in 2012-2013 combined psychological pressure, Gameover Zeus botnets, and Bitcoin payments. Major incidents such as WannaCry, NotPetya, and attacks on Colonial Pipeline and JBS Foods demonstrated global reach and state-level involvement. Modern groups like REvil, LockBit, Maze, and Akira refined double extortion, Ransomware-as-a-Service models, access brokers, and virtualization targeting. Law enforcement operations have disrupted infrastructure repeatedly, yet the market fragments and regenerates with new brands. The core business model remains resilient due to easy initial access, layered extortion tactics, and victims' operational dependencies.

Ragnarök: F6 Investigates VantaCore Ransomware Attacks and Suspected Thor Rebrand

F6's Digital Forensics Laboratory has identified a new ransomware group called VantaCore that has struck at least seven Russian organizations with multimillion-dollar ransom demands. Researchers assess VantaCore as a rebrand of the previously known pro-Ukrainian Thor group, part of a broader consolidation among such actors in 2025–2026. The group abandoned LockBit 3 Black and Babuk in favor of its own VantaCore ransomware built on similar foundations, while deploying custom tools including VantaCoreLoader, VantaCoreRAT, and the SnowKiller BYOVD utility. VantaCore maintains a Tor-based data leak site launched no later than June 2026 and uses double and triple extortion tactics, selling or publicly releasing stolen data after encryption. Initial access relies on exposed RDP, VPN, public application vulnerabilities, and compromised partner credentials, followed by lateral movement via legitimate accounts and SMB/RDP. The group disables security products, clears logs, and destroys backups using Bootice before deploying its ChaCha20/X25519 ransomware via manual RDP sessions or automated loaders.

Ransomware Group TITAN Deploys Local AI on AMD EPYC Servers to Accelerate Stolen Data Analysis

The TITAN ransomware group has announced the integration of an on-premises artificial intelligence platform designed to process up to 700 GB of exfiltrated data per hour. Operating as a ransomware-as-a-service model since May 2026, TITAN combines file encryption with data theft and has already published 24 victims across 10 countries. Manufacturing and professional services firms account for 29 percent of the targeted organizations. The AI system runs locally on AMD EPYC servers with GPU acceleration and automatically classifies financial documents, legal records, personal data, trade secrets, and intellectual property. It further identifies information with high reputational or regulatory impact, maps corporate and personal relationships, and estimates potential penalties under data-protection laws. The group also claims the platform can generate automated notifications to regulators and media outlets to intensify extortion pressure.

VantaCore Ransomware Group Targets Russian Businesses with Custom Toolkit and Triple Extortion

Security researchers at F6 have identified a new ransomware operation called VantaCore that is actively attacking small and medium-sized Russian companies. The group employs a custom set of tools including VantaCoreLoader, VantaCoreRAT, and its own encryption malware to conduct double and triple extortion campaigns. Initial access is gained through poorly secured RDP and VPN services, vulnerable public applications, and compromised partner accounts. Once inside the network, attackers move laterally using SMB and RDP with legitimate credentials, deploy Tactical RMM, and install their backdoor before disabling security products with an AV/EDR killer. Victims face data theft, backup destruction, and encryption, followed by threats to publish or sell stolen information if ransom demands in the millions of dollars are not met. F6 assesses that VantaCore may be a rebranded version of the previously known pro-Ukrainian group Thor, based on similar Tor negotiation chat design and a THOR rune icon on the leak site that appeared no later than June 7, 2026.

Boston Scientific Hit by Cyber Attack: Global IT Outage Disrupts Orders and Shipments, Shares Drop

On August 25, Boston Scientific detected a cyber attack that compromised parts of its IT infrastructure, leading to widespread network interruptions across its global operations. The medical device giant, which generates over $16 billion in annual revenue and operates in more than 130 countries, saw customer order processing and product shipments halted in multiple regions. Wall Street Journal and Reuters reported the incident on August 26, after which the company's stock declined. While China operations remained unaffected due to regional system isolation, the company stated that full global recovery timelines remain unknown. The attack's specific methods, including any potential ransomware involvement or data exfiltration, have not been disclosed as third-party investigators continue their work. The event underscores the severe operational and patient-care risks when healthcare supply chains face cyber disruptions.

Aurora Ransomware Affiliate Uses AI Assistant Cursor to Compromise Active Directory and VMware ESXi Servers

An affiliate of the Aurora ransomware group employed the AI-powered coding assistant Cursor to plan and execute targeted attacks against corporate environments, focusing on Active Directory and VMware ESXi servers. The campaign impacted more than 20 organizations between April and July 2026. The operator used Cursor to generate commands, refine exploitation techniques, and build attack sequences aimed at Windows infrastructure, particularly Active Directory Certificate Services (ADCS). Techniques included noPac exploitation combined with NTLM relay attacks leveraging PetitPotam, PrinterBug, and DFSCoerce to escalate privileges up to domain administrator level. After gaining access, the attackers collected and compressed large volumes of data for exfiltration before deploying the Aurora ransomware on Windows, Linux, and ESXi systems. The ESXi variant stops virtual machines prior to encryption to maximize impact on virtualized environments.

7 Core Rules for Responding to Ransomware and Infrastructure Breaches

The article outlines practical first-response steps for organizations facing ransomware encryption or infrastructure compromise for the first time. It stresses isolating affected systems from the network without powering them down, preserving volatile data and logs, and avoiding premature cleanup or backup restoration. The guidance covers closing obvious compromised access paths, documenting observed facts and actions, and stopping further ad-hoc changes once containment is achieved. These measures help retain forensic artifacts that investigators need to determine the initial access vector and attacker movement. The rules are presented as a starting point for teams without formal incident response procedures.

IT Elements 2026 to Stage IT Apocalypse Simulations and Critique Russian Vendors

The IT Elements 2026 conference has unveiled its full program, centering on business continuity after successful cyberattacks, infrastructure failures, or technological disasters. Scheduled for September 9-10 at the Serp i Molot cultural center in Moscow, the event will host over one hundred reports, discussions, demonstrations, and master classes. The opening plenary will examine whether the primary-backup data center model remains viable, if the 3-2-1 backup rule still protects against modern ransomware, and whether CIOs or CISOs should own cyber resilience. Practical sessions will demonstrate a full Microsoft migration in 60 minutes, moving Exchange and MinIO to Russian alternatives, and a detailed review of domestic hyperconvergence strengths and weaknesses. Comparative test results for routers, NGFW, and VM systems will be presented without marketing gloss. Additional tracks will cover monitoring of corporate AI models from GPU to prompt under FSTEC Order No. 117, OWASP Top 10 for LLM, and MITRE ATLAS, alongside real-world cases from Rosatom, Beeline, Sber, and T-Bank. Trubnaya Metallurgicheskaya Kompaniya will simulate a 48-hour IT outage and show how to restart operations in half a day.

LockBit Claims Breach of U.S. Bank, Sets September 2026 Deadline for Ransom Payment

The ransomware group LockBit has added U.S. Bank to its leak site, claiming to have stolen data from the financial institution and threatening to publish it unless a ransom is paid by September 3, 2026. U.S. Bank stated it is actively investigating the claims but has so far found no evidence of unauthorized network access or impact on internal systems. Lee Henderson, the bank's vice president of public affairs, confirmed that the institution is monitoring the situation and treating the allegations seriously. LockBit placed the bank's domain on its extortion portal on August 19 and has a history of resuming operations after a major international law enforcement disruption in 2024. The investigation remains ongoing, with the final scope depending on whether unauthorized access and data theft can be confirmed.

Sorry Ransomware Exploits cPanel Vulnerability to Directly Lock Linux Servers in Multiple Chinese Incidents

China's National Computer Virus Emergency Response Center has issued a warning about the Sorry ransomware, which targets exposed Linux web servers through a cPanel authorization vulnerability. The Go-based malware gains root access without any phishing or user interaction, disguises itself as the legitimate sshd process, and follows a six-stage attack chain that includes data exfiltration before encryption. It terminates databases, security tools, and backup services, then uses AES and RSA to encrypt files with a .sorry extension while demanding ransom via an encrypted communication tool. The campaign specifically affects small and medium-sized enterprises running cPanel on mainstream Linux distributions, including domestic Xinchuang systems. Attackers also scan internal networks for weak SSH credentials to spread laterally. The center urges immediate patching of cPanel, exposure reduction, strong passwords, offline backups, and avoidance of fake decryptors.

China Warns of New 'Sorry' Ransomware Targeting Exposed Linux Web Servers via cPanel Vulnerability CVE-2026-41940

China's National Computer Virus Emergency Response Center has issued an official alert after multiple incidents of the newly discovered 'Sorry' ransomware family struck Linux Web servers inside the country. The Go-language malware specifically targets internet-exposed servers running vulnerable versions of WebPros cPanel and can also run on domestic Xinchuang operating systems. Attackers exploit authorization flaw CVE-2026-41940 (CNNVD-202604-5641) to gain access, deploy the ransomware disguised as sshd processes, kill backup and security services, exfiltrate data, and encrypt files with AES and RSA before scanning for weak SSH credentials to spread laterally. The advisory states that no reliable decryption method currently exists once files receive the .sorry extension. Organizations are urged to immediately audit cPanel versions, inspect processes, restrict management interfaces, eliminate weak passwords on ports 22/2222/22222, and verify offline backups.

Ransomware Groups Disable EDR, Backups and Windows Telemetry Before Encryption

Ransomware operators are increasingly focusing on disabling endpoint detection and response tools, backup systems, and Windows telemetry mechanisms prior to launching encryption. An analysis of the ten ransomware families with the lowest prevention rates in 2026 found that Play achieved only 13 percent of attacks blocked. BlackByte followed with 25 percent blocked and LockBit with 30 percent blocked. BabLock leverages a legitimate uninstaller to remove endpoint protection and terminates processes belonging to antivirus, EDR, backup, and database applications. It then clears the Security and System event logs to hinder incident response. LockBit 5.0 instead interferes with Event Tracing for Windows to reduce visibility for monitoring solutions. Additional families employ process injection, in-memory execution, registry modifications, file masquerading, and living-off-the-land binaries to evade detection.

Chinese Courts Hand Down 16-Year and 32-Year Sentences to Ransomware Operators

Two individuals involved in ransomware operations have received lengthy prison terms in China, with one sentenced to 16 years and the other to 32 years. The cases underscore Beijing's increasing focus on prosecuting ransomware-related crimes. The longer sentence reflects the scale and impact of the criminal activity attributed to the second defendant. Chinese authorities have publicly highlighted these outcomes as part of broader efforts against cyber extortion. The rulings send a clear deterrent message to ransomware actors operating within or targeting Chinese infrastructure.

Telegram Removed from App Store After Extortionist Plants AI-Modified CSAM in Archived Message

Pavel Durov stated that an extortionist edited an old public group message by inserting AI-altered child sexual abuse material, allowing the post to evade detection by active chat participants while enabling a direct report to Apple. The tactic triggered automatic removal of Telegram and experimental Telegram X from the App Store in multiple countries including Russia, Turkey, and the United States on August 4. Apple restored the applications after Telegram deleted the prohibited content and blocked the responsible account, with the entire outage lasting approximately ninety minutes. During the incident, push notifications failed for some iOS users, while macOS and Android versions remained unaffected. Durov criticized Apple for suspending the app without prior contact and warned that the same mechanism could be used against any user-generated content platform. Telegram urged Apple to apply equal scrutiny to all incoming reports rather than acting on isolated complaints that bypass normal moderation filters.

Cl0p Exploits Critical Windchill Vulnerability CVE-2026-12569 to Steal Industrial Designs

The Cl0p extortion group is actively targeting internet-exposed PTC Windchill and FlexPLM servers to exfiltrate engineering projects, technical specifications, and other sensitive data. The campaign focuses on organizations in the industrial, automotive, aerospace, defense, and retail sectors. Attackers leverage the critical remote code execution vulnerability CVE-2026-12569, which stems from unsafe deserialization and carries a CVSS score of 9.8, allowing unauthenticated exploitation over the network. The intrusion chain also combines a WSDL endpoint information disclosure in FlexPLM with a login mechanism weakness in Windchill to gain initial access and execute commands without valid credentials. After compromise, operators deploy JSP web shells to maintain persistence, explore files, and prepare data for exfiltration. Affected systems often contain unreleased product designs, engineering drawings, and strategic manufacturing documents. The activity began in early June 2026, with extortion emails sent to hundreds of employees starting July 20 to increase internal pressure ahead of potential data leaks.

Chaos Ransomware Group Uses msaRAT Trojan to Hide C2 Traffic Through Invisible Chrome and Edge Browsers

The Chaos ransomware group has adopted a new Rust-based trojan called msaRAT to conceal its command-and-control communications inside legitimate browser sessions. The malware launches Chrome or Edge in invisible mode and controls it via the Chrome DevTools Protocol, keeping all outbound traffic restricted to localhost. It then injects JavaScript to negotiate a WebRTC connection through Cloudflare Workers before routing data over Twilio TURN servers, preventing the attackers' real infrastructure from appearing in network logs. Commands are executed through cmd.exe, and the implant includes queuing mechanisms that support reliable transfer of files, screenshots, and larger data volumes. In the analyzed incident, operators delivered the malware via an MSI installer disguised as a Windows update that loaded the msaRAT DLL directly into memory. The technique does not exploit any vulnerabilities in Chrome or Edge and is designed to blend malicious traffic with normal corporate browser activity.