ransomware – Noise

New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles

Rapid7 Labs — Tue, 18 Aug 2026 12:49:46 +0000

You can’t patch everything. So what do you fix first? Findings in Q2 2026 have changed traditional answers.The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI...

Q1 2026 Threat Landscape Report: Zero-clicks, geopolitical tensions, and some wins for law enforcement

Rapid7 Labs — Thu, 21 May 2026 13:00:00 +0000

The first quarter of 2026 reinforced that attackers are moving faster, operating with greater coordination, and exploiting weaknesses before most organizations can respond effectively. From escalating geopolitical tensions to increasingly aggressive ra...

Defense by Design: Building Infrastructure That Assumes Adversaries

Kari Rivas — Thu, 07 May 2026 19:18:45 +0000

Learn how to build resilient infrastructure that stands up to persistent adversaries who probe your environment through traffic abuse and credential attacks.

The post Defense by Design: Building Infrastructure That Assumes Adversaries appeared first on Backblaze Blog | Cloud Storage & Cloud Backup

A Ransomware Negotiator Was Working for a Ransomware Gang

Bruce Schneier — Fri, 01 May 2026 11:18:43 +0000

Someone pleaded guilty to secretly working for a ransomware gang as he negotiated ransomware payments for clients.

Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained

Anna Širokova — Tue, 21 Apr 2026 14:15:23 +0000

OverviewFor executive leadership, the emergence of Kyber ransomware represents a significant and immediate threat due to its specialized, dual-platform deployment capability targeting mission-critical virtualization infrastructure (VMware ESXi) and cor...

The Post-RAMP Era: Allegations, Fragmentation, and the Rebuilding of the Ransomware Underground

Alexandra Blia — Wed, 25 Feb 2026 13:56:38 +0000

OverviewThe anatomy of the RAMP disruptionActive since 2021, the RAMP (Ransomware and Advanced Malware Protection) forum has established itself as a prominent hub within the cybercrime ecosystem, particularly for ransomware operators and affiliates coo...

ICYMI: Experts on Experts – Season One Roundup

Emma Burdett — Tue, 03 Feb 2026 14:23:34 +0000

In 2025, we launched Experts on Experts: Commanding Perspectives as a pilot video series designed to spotlight the ideas shaping cybersecurity, directly from the people driving them. Over five episodes, Rapid7 leaders shared short, candid conversations...

From Extortion to E-commerce: How Ransomware Groups Turn Breaches into Bidding Wars

Alexandra Blia — Mon, 24 Nov 2025 14:21:37 +0000

Ransomware has evolved from simple digital extortion into a structured, profit-driven criminal enterprise. Over time, it has led to the development of a complex ecosystem where stolen data is not only leveraged for ransom, but also sold to the highest ...

The State of Security Today: Setting the Stage for 2026

Rapid7 — Tue, 18 Nov 2025 16:07:34 +0000

As we close out 2025, one thing is clear: the security landscape is evolving faster than most organizations can keep up. From surging ransomware campaigns and AI-enhanced phishing to data extortion, geopolitical fallout, and gaps in cyber readiness, th...

Threat Landscape of the Building and Construction Sector Part Two: Ransomware

Jeremy Makowski — Fri, 14 Nov 2025 14:31:42 +0000

In this second installment of our two-part series on the construction industry, Rapid7 is looking at the specific threat ransomware poses, why the industry is particularly vulnerable, and ways in which threat actors exploit its weaknesses to great effe...

Attackers accelerate, adapt, and automate: Rapid7’s Q3 2025 Threat Landscape Report

Rapid7 — Wed, 12 Nov 2025 13:55:11 +0000

The Q3 2025 Threat Landscape Report, authored by the Rapid7 Labs team, paints a clear picture of an environment where attackers are moving faster, working smarter, and using artificial intelligence to stay ahead of defenders. The findings reveal a thre...

Microsoft Still Uses RC4

Bruce Schneier — Tue, 16 Sep 2025 11:06:44 +0000

Senator Ron Wyden has asked the Federal Trade Commission to investigate Microsoft over its continued use of the RC4 encryption algorithm. The letter talks about a hacker technique called Kerberoasting, that exploits the Kerberos authentication system.

AI & Ransomware: Inside the Exfiltration Playbook

Stephanie Doyle — Thu, 17 Jul 2025 15:15:55 +0000

Exfiltration has become a key tactic in cyber attacks, and cloud misconfigurations contribute to its success in undermining enterprises. Let's talk about important trends and best practices.

The post AI & Ransomware: Inside the Exfiltration Playbook appeared first on Backblaze Blog | Cloud Storage & Cloud Backup

BlackSuit Continues Social Engineering Attacks in Wake of Black Basta’s Internal Conflict

Tyler McGraw — Tue, 10 Jun 2025 15:00:00 +0000

Despite a significant decrease in social engineering attacks linked to the Black Basta ransomware group since late December 2024, Rapid7 has observed sustained social engineering attacks. Evidence suggests that BlackSuit affiliates have either adopted Black Basta’s strategy or absorbed its members.

From Ideology to Financial Gain: Exploring the Convergence from Hacktivism to Cybercrime

Rapid7 — Tue, 03 Jun 2025 17:00:00 +0000

The lines between ideologically-driven hacktivism and financially motivated cybercriminals are blurring. Some hacktivist groups are evolving into ransomware operations – even becoming ransomware affiliates – merging the disruptive zeal of hacktivism with the ruthless efficiency of cybercrime.

Australia Requires Ransomware Victims to Declare Payments

Bruce Schneier — Mon, 02 Jun 2025 11:03:34 +0000

A new Australian law requires larger companies to declare any ransomware payments they have made.

Retail Under Siege: What Recent Cyber Attacks Tell Us About Today’s Threat Landscape

Emma Burdett — Tue, 27 May 2025 14:00:00 +0000

When several major UK organizations, including well-known retail brands, found themselves caught in a cyber attack earlier this year, it made headlines – reflecting a growing trend where attackers exploit third-party vendors to breach businesses through a single point of entry.

Key Takeaways from the Take Command Summit 2025: Inside the Mind of an Attacker

Rapid7 — Wed, 21 May 2025 14:00:00 +0000

In one of the most anticipated sessions of Take Command 2025, Raj Samani, Chief Scientist at Rapid7, sat down with Trent Teyema, former FBI Special Agent and President of CSG Strategies, for a candid conversation on how threat actors are evolving and what defenders must do to keep up.

Why is Ransomware Still a Thing in 2025?

Christiaan Beek — Thu, 01 May 2025 15:05:00 +0000

Ransomware remains a crisis because we are still giving attackers the upper hand. To regain control, we need to understand how we’ve made it so easy for them, and what we can do to change that.

AI 101: How AI and Ransomware Are Reshaping Cybersecurity

Stephanie Doyle — Thu, 17 Apr 2025 16:05:32 +0000

AI is changing the ransomware landscape, empowering both cybercriminals with sophisticated tools and cybersecurity defenders with advanced protection. Today, let's talk about the high-stakes battle for data security.

The post AI 101: How AI and Ransomware Are Reshaping Cybersecurity appeared first on Backblaze Blog | Cloud Storage & Cloud Backup