Malware & Ransomware
Kimsuky Uses GitHub Infrastructure for Operation GitPower Cyber Spying Campaign
North Korea-linked group targets Ukrainian policy experts with malware delivered via trusted code hosting platforms.
Malware & Ransomware
Malware & Ransomware coverage from Threat Times holds 46 articles, 6 of them reference guides. The newest was published on October 13, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include UK National Cyber Security Centre and CISA: Stop Ransomware.
Malware & Ransomware
Quantum giant IonQ targets cyber defense with $1.3B all-stock Elisity acquisition
Quantum computing leader IonQ has agreed to buy cybersecurity firm Elisity in an all-stock transaction valued at up to $1.3 billion, marking a major expansion into cyber defense.
Malware & Ransomware
Varonis researchers uncover AvisLoader, a Windows malware using encrypted P2C2
Varonis Threat Labs details AvisLoader, a new Windows loader that uses Tox for encrypted peer-to-peer command and control to resist takedowns.
Malware & Ransomware
WhatsApp attachment deploys VulcanRAT207.A to gain SYSTEM access on Windows
Attackers use a malicious ZIP file sent via WhatsApp to install a remote access trojan that achieves deep system control and evades detection.
Malware & Ransomware
Atlassian Data Center Flaw Exploited Two Hours After Disclosure
Threat actors tested a critical file-access vulnerability in Atlassian products within hours of technical details becoming public, according to monitoring firm watchTowr.
Malware & Ransomware
Canadian Ransomware Negotiator Edward Dubrovsky Arrested in ShinyHunters Probe
A Canadian cybersecurity executive faces extortion charges after an October 8 arrest linked to the FBI’s investigation of the ShinyHunters group.
Malware & Ransomware
Bitdefender Identifies Firmware-Level Malware in Budget Android Phones From Supply Chain Compromise
Security researchers report that budget Android devices from brands like Doogee and Cubot were shipped with preinstalled malware designed to generate fraudulent ad revenue.
Malware & Ransomware
WhatsApp Malware Chain Injects Code Into Windows Task Scheduler for SYSTEM Access
A financial document lure delivered via WhatsApp deploys malware that hijacks the Windows Task Scheduler to execute payloads with LocalSystem privileges, bypassing standard security checks.
Malware & Ransomware
Casbaneiro Trojan Targets Latin America With Conditional C2 Activation
August 2026 campaign uses geofencing and language checks to hide banking theft until victims visit targeted financial sites, evading sandbox analysis.
Malware & Ransomware
Qilin and Settra Ransomware Groups Exploit Palo Alto VPN Flaw
ReliaQuest confirms ransomware operators are actively abusing a high-severity authentication bypass in Palo Alto Networks products to gain initial access.
Malware & Ransomware
Flashpoint Report: CastleStealer Now Evades Chromium Encryption and Runs Remote Commands
New analysis shows the C# stealer has added remote execution, bypasses browser encryption, and uses encrypted TCP for data exfiltration.
Malware & Ransomware
Ransomware Tracker: N0N Group Leads 23 Leak-Site Claims in 24 Hours
Data desk analysis shows 23 unverified ransomware leak claims in a single day, with N0N accounting for more than half of the reported activity.
Malware & Ransomware
CastleStealer malware adds browser bypass and remote shell capabilities
Flashpoint analysis reveals CastleStealer can now bypass Chromium encryption and execute remote commands on compromised Windows systems.
Malware & Ransomware
Bitdefender Discovers Midnight Mimosa Malware Preinstalled on MediaTek Android Phones
Researchers identify a firmware-level Android malware campaign that fakes ad clicks and builds a proxy botnet across 150 countries.
Malware & Ransomware
PoeLLM Cryptominer Hits 3,400 Servers Using GitHub Poem for C2 Communication
Lumen researchers report that the PoeLLM malware has infected over 3,400 servers, primarily targeting exposed AI inference tools like LiteLLM and Ollama.
Malware & Ransomware
Nippon Columbia Malware Breach Exposes 8.7 Million Records for Daiichi Kosho
A malware infection at contractor Nippon Columbia compromised personal data for millions of users and employees of Japanese entertainment firm Daiichi Kosho.
Malware & Ransomware
Shai-Hulud worm targets AI infrastructure via compromised Tensorlake npm package
The Shai-Hulud credential-stealing worm has expanded its reach to AI tools by hijacking the Tensorlake package on the npm registry.
Malware & Ransomware
Ransomware Remediation Firm Owner Accused of Paying Extortion Demands
Zohar Pinhasi faces wire fraud charges for allegedly paying cybercriminals while charging clients higher fees for data recovery services.
Malware & Ransomware
TraderTraitor Uses Trojanized Terraform Provider to Deploy Cross-Platform Malware
Zscaler ThreatLabz identified a July 2026 campaign where the North Korean-linked group used a compromised infrastructure tool to deliver OS-specific malware.
Malware & Ransomware
Mistakes That Let Malicious npm Packages Compromise Your Build
Dependency confusion and typosquatting exploit default trust in public registries, allowing attackers to inject code into your build pipeline without direct access to your source repository.
Malware & Ransomware
FBI Arrests Canadian Cybersecurity Co-Founder in ShinyHunters Probe
U.S. agents detained a ransomware negotiator firm executive in Pennsylvania during an ongoing federal investigation into the ShinyHunters data leak group.
Malware & Ransomware
Linux Backdoors Disguise Traffic as Email Services to Evade Detection in Asia
Malware in South Korea and Taiwan mimics email security tools and legitimate OS processes to hide from defenders on network appliances.
Malware & Ransomware
CERT-UA: Over 100 Sites Injected With LunexStealer Malware via Fake Cloudflare Checks
Ukraine’s CERT-UA identified more than 100 compromised websites serving the LunexStealer malware through malicious JavaScript injections in September 2026.
Malware & Ransomware
Ransomware Groups Target Backup Infrastructure to Block Recovery Options
Attackers are increasingly compromising backup systems to eliminate recovery paths and force ransom payments, experts warn.