ransomware

According to Decrypt, the European Union's law enforcement agency reported that Spanish police arrested a 16-year-old Romanian suspect in Alicante, suspected of being an administrator and main operator of the ransomware group KillSec.Two other suspects in their twenties were arrested in the UK and Romania, respectively; another developer who just turned 18 in August this year has been identified but has not been arrested due to some crimes occurring during their minor years.This operation, codenamed Operation KillSwitch, was led by the Hamburg State Criminal Police and the city's prosecution office, focusing on approximately 1,000 suspected attacks worldwide, with about 500 confirmed as successful intrusions.Law enforcement searched eight locations in Spain, Greece, Romania, and the UK, seized five central servers, and redirected related domain names to seizure announcement pages, while also confiscating at least 110 TB of stolen data.KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured cloud storage entry points to infiltrate corporate systems, copying internal data and naming victim organizations on dark web leak sites, threatening to publicly release documents to demand cryptocurrency ransoms, and if the target refuses to pay, they release the data for free.The Swiss Federal Police noted that the group also employed double extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges indicate that a Dutch national residing in the UK, Fouad Eltibrizi (nicknamed Archduke), was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and awaiting extradition, facing up to 10 years in prison. The European Cybercrime Centre, under the European Union Agency for Law Enforcement Cooperation, is assisting in tracing cryptocurrency funds and conducting digital forensics.

According to a report by Fabien Arnaud from the French media Midi Libre, a resident in Saint-Jean-de-Védas near Montpellier, France, was the victim of a home invasion and extortion related to cryptocurrency. The police acted quickly after the incident and have arrested three suspects.It is reported that the victim had previously encountered a similar violent extortion related to cryptocurrency on April 11 of this year.

Former Los Angeles County Sheriff’s Deputy Eric Saavedra was sentenced to 21 months in prison. The court found that he used law enforcement databases to assist a cryptocurrency trader in carrying out a extortion scheme.In addition to the prison sentence, Saavedra was also ordered to pay $90,984 in restitution, related to his concealment of $373,146 in income from the Internal Revenue Service.

According to ZEIT, the Berlin city government suffered a cyber attack two weeks ago, and the hacker group is suspected of implementing ransomware using the stolen data. According to Der Spiegel, the attackers are believed to be the long-active Rhysida hacker group, demanding a payment of 30 bitcoins (approximately 2 million euros) and threatening to release the data.The sensitive information involved may include records of violations and passwords. The Berlin state government has not yet confirmed the extent of the data breach and has not responded to the ransom amount or the identity of the attackers, stating that it will not comment "for reasons of investigative strategy." Berlin's mayor, Kai Wegner, has made it clear that Berlin will not yield to extortion. The main departments affected are transportation and construction management, which were temporarily isolated from the state government's network after the incident.

Cybersecurity company Check Point Research discovered that the StopAndProtect ransomware campaign uses nearly 2,000 compromised WordPress sites to spread malware, steal data, monitor victims, and deploy ransomware. This campaign was identified in mid-May. As of July 24, it has compromised over 6,000 unique IP addresses, including 1,852 in the United States, and 630 each in Russia and India.The compromised websites were also used to host malware, send commands, and store stolen files, screenshots, and activity logs. Attackers lure Windows users into running PowerShell commands through fake CAPTCHAs, thereby stealing credentials and cryptocurrency wallet recovery phrases, and spreading through networks and USB devices. Researchers have collected over 31,000 screenshots and more than 700 data compression packages, and believe that the attackers may have inadvertently infected themselves.

According to CCTV News, recently, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control, relying on the National Computer Virus Collaborative Analysis Platform (https://virus.cverc.org.cn), discovered multiple incidents of users being attacked by the "Sorry" ransomware virus within our country. After the user's important files were encrypted, the file names were changed to the original file name + .sorry suffix string. The attackers also left a ransom note on the user's host, demanding that the user download an encrypted communication tool to contact them.

The United States, the European Union, and the United Kingdom jointly announced sanctions against a group involving state-level hacker organizations, cybercrime gangs, and their infrastructure providers. The targets are accused of causing billions of dollars in losses to global businesses, critical infrastructure, and government agencies. Among the most notable is the EU's sanction against the Russian cybercriminal Vitaly Nikolayevich Kovalev (alias "Stern").The EU has identified Stern as one of the core managers of the notorious Trickbot Group ransomware organization, which includes several high-risk ransomware variants such as Conti ransomware and Ryuk. On-chain analysis shows that wallet addresses associated with Stern have received over $300 million in ransom payments, potentially making him the "largest confirmed ransomware operator" to date. According to analysis, the $300 million only represents the profits obtained by Stern personally, and the overall illegal income of the Trickbot group may be much higher.On-chain fund flows indicate that Stern has had transactional connections with multiple ransomware ecosystems, including Ryuk, Conti, Diavol, Karakurt, Royal, and Quantum. Investigations show that Stern plays a role similar to "CEO" within the Trickbot organization, responsible for budget management, personnel recruitment, infrastructure procurement, and attack planning.

According to Financefeeds, the U.S. Department of Justice has announced criminal charges against 19-year-old dual citizen Peter Stokes, who is accused of being a member of the cybercrime organization "Scattered Spider," and has been extradited from Finland to the United States.

According to Decrypt, a former Ukrainian police officer kidnapped a cryptocurrency entrepreneur and extorted approximately $2.2 million through violence, intimidation, and false debt claims. Prosecutors stated that the gang targeted at least four victims and committed crimes using law enforcement methods, official vehicles, and impersonating police officers. The Kyiv regional prosecutor's office announced that the pre-trial investigation has been completed, and the gang includes four former police officers and one previously convicted civilian, but none of them have been formally charged for these attacks yet. This case comes amid a global surge in "ransomware attacks" in the cryptocurrency space, where criminals use violent coercion to steal digital assets.

Bitcoin mining company MARA Holdings allocated approximately $4.3 million for CEO Fred Thiel's personal security expenses in fiscal year 2025, which includes $430,780 for vehicle bulletproof modifications, as well as expenses for bodyguards and residential security facilities. According to documents submitted to the U.S. SEC, MARA also provided approximately $3.9 million in security expenses for CFO Salman Khan, including $438,380 for vehicle bulletproof costs.Reports indicate that as incidents of "ransom attacks" targeting executives and investors in the crypto industry increase, crypto companies are significantly ramping up their investment in executive physical security. The so-called "ransom attack" typically refers to forcing victims to hand over private keys or account access through kidnapping, violence, or coercion. Data shows that in 2025, there were 72 confirmed incidents of crypto-related entity coercion globally, a year-on-year increase of 75%. Among these, France recorded 19 incidents, the highest in the world.

The open-source data visualization tool Grafana stated on platform X that it recently discovered an unauthorized attacker had obtained a token that could access the Grafana Labs GitHub environment and used it to download the code repository.An investigation confirmed that this incident did not involve customer data or personal information leakage, and no impact on customer systems or business operations was found. After the incident, forensic analysis was immediately initiated, and it is believed that the source of the credential leak has been identified. Additional security measures have also been deployed to strengthen environmental protection.Furthermore, Grafana disclosed that the attacker attempted to demand a ransom to prevent the code repository from being made public, but the company ultimately decided to refuse to pay the ransom and will release more information about the incident review after the investigation is completed.

A 27-year-old German hacker, Noah Christopher, was arrested in Bangkok, Thailand, facing up to 74 arrest warrants for cyber crimes in Europe.Investigations show that this individual is suspected of developing and operating a ransomware platform and a "cybercrime-as-a-service" (CaaS) system between 2021 and 2025, including providing distributed denial-of-service (DDoS) attack tools (such as Fluxstress and Neldowner), assisting global clients in launching cyber attacks and charging fees, with related ransom payments involving cryptocurrencies and other digital assets, constituting transnational cybercrime activities. His visa has been revoked, and he is currently detained awaiting extradition to Germany.

Renowned on-chain investigator ZachXBT released a report today stating that a Russian over-the-counter (OTC) broker named Aleksandr (Aleks) Khinkis is suspected of assisting ransomware groups in laundering over $4.7 million since 2025 through a single cryptocurrency trading platform account.The related funds involve three suspicious ransom payments, totaling approximately 796 bitcoins (BTC). The investigation shows that these funds were transferred in batches to his trading platform's deposit address (0xa756) after being bridged between Bitcoin and Avalanche, completing a total of 75 transactions from 2025 to 2026. Additionally, approximately $16.6 million is currently still held in Aave and is being gradually liquidated.ZachXBT pointed out multiple ransom transactions: a ransom payment of about 72 BTC in September 2025 was bridged to the related address; a ransom of about 164 BTC was also discovered in October 2025 and converted to approximately $3.8 million. Some related addresses were blacklisted by Tether in November 2025, and the subsequently frozen USDT was destroyed three weeks ago, indicating that law enforcement and compliance agencies have intervened.Earlier in 2023, this account was also involved in a ransom transaction of about 560 BTC, which was circulated through multiple intermediary addresses and trading platforms before being bridged back to the Avalanche network in 2024. Furthermore, the investigation pointed out that the source addresses of the related bitcoins have a high correlation with multiple ransomware addresses, suspected of serving as payment transit nodes. Although some funds remain dormant, ZachXBT warned that they may still be laundered in the future and urged victims to report related addresses promptly to freeze the funds.

According to Criptonoticias, the city government of Sanxenxo in the Galicia region of Spain suffered a ransomware attack, with hackers encrypting thousands of administrative documents and blocking system access, demanding a ransom of $5,000 in Bitcoin.The attack occurred on January 26, causing the municipal servers to completely crash, affecting the operation of essential services in the city, which has over 17,000 residents. The city government has reported the incident to the Spanish Civil Guard, refused to pay the ransom, and stated that it is enabling daily backups to restore the system.

According to a report by Le Parisien, the French cryptocurrency tax reporting platform Waltio announced that it has been extorted by a hacker group called "Shiny Hunters." The group claims to have obtained personal data of approximately 50,000 customers of the platform, most of whom are located in France, and is demanding a ransom for it.Waltio is a company that provides portfolio tracking and tax calculation services for cryptocurrency holders. The company stated that it has reported the incident of "attempted extortion and disruption of automated data processing systems" to the police. The report noted that the hackers allegedly obtained the relevant customers' email and account balance information as early as 2024.

According to Cointelegraph, researchers from the cybersecurity company Group-IB have discovered a ransomware called "DeadLock" that is using Polygon smart contracts to hide itself and rotate proxy addresses.This ransomware was first identified in July last year, and it dynamically updates the command and control infrastructure addresses used to communicate with victims by invoking specific smart contracts. Once a victim is infected and data is encrypted, DeadLock issues a ransom note threatening to sell the stolen data if demands are not met.Researchers pointed out that storing proxy addresses on-chain makes its infrastructure extremely difficult to dismantle, as there is no central server that can be shut down, and blockchain data is permanently retained across global nodes. This method of abusing smart contracts to relay proxy addresses is highly variable. Although DeadLock currently has low exposure and a limited number of known victims, its novel attack techniques still pose a potential threat to organizations that do not take it seriously.

According to monitoring by Group-IB, the ransomware family DeadLock is using Polygon smart contracts to distribute and rotate proxy server addresses to evade security detection.This malware was first discovered in July 2025, embedding JS code that interacts with the Polygon network within HTML files, using an RPC list as a gateway to obtain server addresses controlled by the attacker. This technique is similar to the previously discovered EtherHiding, aiming to leverage decentralized ledgers to construct covert communication channels that are difficult to block. DeadLock currently has at least three variants, with the latest version also embedding the encrypted communication application Session to directly communicate with victims.

According to the U.S. Department of Justice, two American men have pleaded guilty to attacking multiple targets in the U.S. using ALPHV BlackCat ransomware.Ryan Goldberg (40) from Georgia and Kevin Martin (36) from Texas admitted to deploying ALPHV BlackCat ransomware between April and December 2023. Both are professionals in the cybersecurity industry, and they, along with another accomplice, paid 20% of the ransom as a cut to the ALPHV BlackCat administrator to gain access to the ransomware. After successfully extorting approximately $1.2 million in Bitcoin from one victim, the three split 80% of the ransom and laundered it through various means.The two defendants are scheduled to be sentenced on March 12, 2026, and could face up to 20 years in prison.

According to The Hacker News, the Qilin ransomware group launched a "Korean Leaks" supply chain attack by breaching the South Korean IT service provider GJTec, resulting in 28 financial companies being affected and over 1 million files totaling 2 TB of data being stolen.Bitdefender's investigation found that this operation is linked to the North Korean-backed APT "Moonstone Sleet," suspected of collaborating with the Russian-speaking Qilin group, aiming to exert pressure on the South Korean financial market.

ChainCatcher news, according to Bitcoin News, the ransomware group "Rhysida" has stolen sensitive data from the Maryland Department of Transportation and is auctioning this data for 30 bitcoins (approximately 3.4 million USD).