đź’° Ransomware Activity
In 2026, ransomware groups like Medusa and Qilin have been active, with Qilin scaling rapidly and Medusa claiming numerous victims. February saw 680 victims across 54 groups, with no clear leader in claims. The dark web remains a hub for ransomware operations and data leaks.
- The State Of Ransomware 2026 - BlackFog — 69. A newly emerged ransomware group known as ALP-001 claimed responsibility for a cyberattack against Chinese surveillance technology giant Hikvision. The group listed the company on its dark web lea...
- February 2026 Ransomware Report: 680 Victims, 54 Groups — Ransomware leak sites are dark web pages where ransomware operators publish stolen data from victims who refuse to pay. Most modern ransomware groups use double extortion. They steal your data before ...
- 10 most infamous ransomware groups to watch in 2026 — According to our research, ransomware incidents exposed on the dark web increased by 31% between July and September 2025, compared to the same period in 2024. We attribute much of this growth to Ranso...
- State of the Dark Web in 2026 — On August 2, 2025, eight ousted moderators collectively launched DamageLib as the “real” successor. The name was a deliberate nod to DaMaGeLaB, the original forum that Toha had relaunched as XSS in 20...
🚨 Critical Vulnerabilities
CVE-2026-20131 in Cisco firewalls and CVE-2026-1281 in Ivanti EPMM are critical vulnerabilities actively exploited in 2026. Both allow remote code execution and have been used in ransomware and APT attacks.
- March 2026 Threat Report: Critical CVEs — ## New Cisco Firewall Flaws Ignite Perimeter Risk Cisco published a group of 48 CVEs affecting its firewall product line, including two critical CVSS 10 vulnerabilities. One of these, CVE-2026-20131,...
- February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43 ... — Why this matters: Lotus Blossom exploited this flaw to replace legitimate Notepad++ update packages with malicious installers, deploying Cobalt Strike and the Chrysalis backdoor to targeted users over...
- Critical Vulnerabilities in Ivanti EPMM Exploited — ## Details of CVE-2026-1281 CVE-2026-1281 (CVSS 9.8) is a critical remote code execution (RCE) vulnerability in Ivanti EPMM. The vulnerability lies in legacy bash scripts used by the Apache web serve...
- Newest CVEs | Tenable® — | CVE-2026-1462 | A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` mod...
🛡️ Incident Response & DFIR News
DFIR involves digital forensics and incident response to investigate breaches and contain threats. Recent incidents include ransomware attacks and exploitation of zero-day vulnerabilities. SANS offers training on DFIR techniques and tools.
- DFIR in 2026: A Complete Guide to Digital Forensics and Incident Response — Hive Security — # DFIR in 2026: A Complete Guide to Digital Forensics and Incident Response From initial alert to post-incident report — a professional walkthrough of DFIR methodology, evidence collection, memory fo...
- The DFIR Report | Actionable Cyber Threat Intelligence — Dfir-Home-Hero-Background # Where Incidents Become Intelligence The DFIR Report delivers detailed, actionable intelligence drawn directly from observed intrusions—empowering organizations to harden ...
- SANS DFIR Summit & Training 2026 | Cybersecurity Training — FOR528: Ransomware and Cyber Extortion #### Quick view ### FOR577: LINUX Incident Response and Threat Hunting FOR577: LINUX Incident Response and Threat Hunting #### Quick view ### FOR589: Cyberc...
- Incident response — Latest News, Reports & Analysis | The Hacker News — The Hacker News Logo # Incident response | Breaking Cybersecurity News | The Hacker News Your MTTD Looks Great. Your Post-Alert Gap Doesn't Your MTTD Looks Great. Your Post-Alert Gap Doesn't ## You...
đź“° Latest Ransomware Attacks
In 2026, ransomware attacks affected Catalyst RCM, AkzoNobel, and HanseMerkur. The Waterfall Threat Report noted a ransomware slowdown but a rise in nation-state attacks on critical infrastructure.
- Biggest Cyber Attacks, Data Breaches, Ransomware Attacks of March 2026 — | | | | | | | --- --- --- | | Date | Victim | Summary | Threat Actor | Business Impact | Source Link | | March 03, 2026 | Catalyst RCM | Cyber Attack on healthcare RCM vendors may have impact...
- The State Of Ransomware 2026 | BlackFog — 10. German insurer HanseMerkur, headquartered in Hamburg, has been listed on DragonForce’s dark web leak site following claims of a ransomware attack in early 2026, with threat actors alleging they ex...
- Waterfall Threat Report 2026 finds ransomware slowdown masks deeper shift toward nation-state attacks on critical infrastructure - Industrial Cyber — March 27, 2026 The Waterfall Threat Report 2026 finds that publicly recorded cyber breaches with physical consequences across heavy industry and critical infrastructure fell by 25% to 57 incidents in...
- Data Breach News | Recent Data Breaches in 2026 — blog-post ### Campbell University Data Breach Report Victim campbell.edu Threat Actor INC\_RANSOM Date Discovered Apr 13, 2026 Description Campbell … blog-post ### Carters Data Breach Report Vict...
Facing an active incident? Contact us immediately at alerts@binary-response.com — we respond 24/7.