Ransomware extortionists claim they accessed data from the UK Department for Education, including customer service contact fields. The government says the risk to individuals is not high and no ransom payments are made.
Attackers used vishing via Microsoft Teams to impersonate IT support staff, trick employees into granting remote access, and then deploy Chaos ransomware. Sophos observed fast intrusions, sometimes within 17 hours.
Two recent incidents in Latin America show a new extortion pattern: attackers encrypt disks with BitLocker and trigger ransom notes via office printers. The cases also reveal recurring misuse of RDP, MSSQL misconfigurations, and RMM tools.
GenieLocker ransomware has been active since March 2026 and targets victims across multiple sectors. It runs on Windows, Linux and ESXi and uses a custom encryption mechanism.
Resecurity reports that INC ransomware has been claiming victims faster since the beginning of August 2026 via SonicWall SMA 1000. The chain appears to be driven by zero-days that, among other things, abuse MFA seeds and credentials.
River Bank’s parent company reports confirmation that data taken during a ransomware attack was deleted. The bank is still assessing whether any personal information was accessed.
Two newly reported SonicWall SMA1000 vulnerabilities (CVE-2026-15409 and CVE-2026-15410) have been exploited in ransomware incidents. Security teams urge rapid patching and active threat hunting.
