Malware & Ransomware
Which organisations face new ransomware leak claims in latest surge?
Forty-three unverified theft statements were posted by eight groups in a single day, with Qilin leading the activity across multiple sectors.

The Breach Observer Adversary Desk is the part of the Breach Observer newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 7 articles so far. See the editorial policy or report an error.
Forty-three unverified theft statements were posted by eight groups in a single day, with Qilin leading the activity across multiple sectors.

Stolen session cookies bypass multi-factor authentication, making the choice of infostealer intelligence vendor a critical operational decision for security teams.

Espionage actors target CIS government and utility sectors with new WinRAR exploit and PowerShell chains, threatening interactive system access.

Microsoft’s Digital Crimes Unit worked with law enforcement to disrupt a Chinese-language cybercriminal ecosystem selling illicit phishing tools.

Attackers used three flaws in Ivanti Connect Secure to gain root access, steal credentials and search for Active Directory data on affected networks.

Bitdefender reveals preinstalled malware on MediaTek devices that turns phones into botnet nodes and enables ad fraud.

Criminal IP launches AITEM, an AI-driven framework that links exposure discovery with risk prioritisation and response actions for security teams.
