Ransomware
12 cases
A 28-year-old Russian, described as a Qilin core member, was arrested in Osaka in May 2026 and handed to Germany on 2 October over a September 2024 attack on a German logistics firm and a ~¥26M Bitcoin ransom. The case rests on investigative sources, not a published charging document.
South Africa's air navigation provider ATNS found ransomware-linked malware in an OT network supporting aviation weather services, with suspected data exfiltration to China-based IPs. No flights were disrupted; the actor is unknown and a forensic probe is under way.
Warlock (Storm-2603 / GOLD SALEM / Longlegs) kept exploiting SharePoint ToolShell flaws into 2026, ransoming 33+ hosts at a critical-infrastructure operator via SYSVOL across Europe, Africa and Latin America.
Clover Health (138,677) and AngMar Management Services (126,196) disclosed separate US healthcare breaches in September 2026 — one social engineering of three staff accounts, one Interlock ransomware attack — paired in coverage as '250,000 impacted'.
Operation KillSwitch seized KillSec's leak site and five servers on 30 September 2026, securing 110 TB of stolen data. A 16-year-old is the alleged main operator; a Dutch national is indicted in Puerto Rico. What the primary sources say, and where the numbers diverge.
On May 19-20, 2026, Europol and Eurojust's Operation Saffron took down First VPN — a bulletproof service running since 2014 and used by 25+ ransomware groups. Investigators infiltrated it, seized 33+ servers and unmasked ~506 users. The Ukrainian admin was searched and interviewed, not arrested.
A maximum-severity SonicWall SMA1000 SSRF was exploited as a zero-day three weeks before its July patch. Volexity's UTA0533, a separate credential-harvesting operator, and an INC Ransomware affiliate all piled on — one ran Impacket secretsdump from the appliance to DCSync seven domain controllers.
A Conti affiliate who coded a loader and intruded on twelve victims got 48 months in Nashville on 10 September 2026. The judgment credits custody since his July 2023 arrest in Cork, leaving about ten months. Plea agreement and docket analysed.
Three men who worked in incident response ran BlackCat attacks. One of them was simultaneously negotiating on behalf of ransomware victims — and passing the attackers his own clients' insurance limits.
LockBit, BlackSuit and Play didn't run their own servers. They rented them from a company in St Petersburg that answered no abuse reports and no takedown requests, and billed like any other host.
The BlackSuit ransomware group (a rebrand of Royal Ransomware) compromised CDK Global, the dominant Dealer Management System provider for North American auto dealerships, causing a weeks-long outage affecting ~15,000 dealerships' ability to sell, finance, service, and manage vehicles — one of the most disruptive ransomware incidents against a critical software supplier in 2024.
The ALPHV/BlackCat ransomware group compromised Change Healthcare, the largest US healthcare claims clearinghouse, causing a nationwide outage of pharmacy, medical claims, and payment processing affecting hundreds of thousands of providers, pharmacies, and patients — the most significant cyberattack on US healthcare infrastructure to date.