#ransomware
8 cases
South Africa's air navigation provider ATNS found ransomware-linked malware in an OT network supporting aviation weather services, with suspected data exfiltration to China-based IPs. No flights were disrupted; the actor is unknown and a forensic probe is under way.
Warlock (Storm-2603 / GOLD SALEM / Longlegs) kept exploiting SharePoint ToolShell flaws into 2026, ransoming 33+ hosts at a critical-infrastructure operator via SYSVOL across Europe, Africa and Latin America.
Clover Health (138,677) and AngMar Management Services (126,196) disclosed separate US healthcare breaches in September 2026 — one social engineering of three staff accounts, one Interlock ransomware attack — paired in coverage as '250,000 impacted'.
A Conti affiliate who coded a loader and intruded on twelve victims got 48 months in Nashville on 10 September 2026. The judgment credits custody since his July 2023 arrest in Cork, leaving about ten months. Plea agreement and docket analysed.
Three men who worked in incident response ran BlackCat attacks. One of them was simultaneously negotiating on behalf of ransomware victims — and passing the attackers his own clients' insurance limits.
LockBit, BlackSuit and Play didn't run their own servers. They rented them from a company in St Petersburg that answered no abuse reports and no takedown requests, and billed like any other host.
The BlackSuit ransomware group (a rebrand of Royal Ransomware) compromised CDK Global, the dominant Dealer Management System provider for North American auto dealerships, causing a weeks-long outage affecting ~15,000 dealerships' ability to sell, finance, service, and manage vehicles — one of the most disruptive ransomware incidents against a critical software supplier in 2024.
The ALPHV/BlackCat ransomware group compromised Change Healthcare, the largest US healthcare claims clearinghouse, causing a nationwide outage of pharmacy, medical claims, and payment processing affecting hundreds of thousands of providers, pharmacies, and patients — the most significant cyberattack on US healthcare infrastructure to date.