#ransomnews — Public Fediverse posts

📣 Truffe WhatsApp, la guida utile 🇮🇹

Leggiamo sempre più spesso di persone in difficoltà dopo messaggi truffa su #WhatsApp.
Cosa fare? Cosa dire? A chi?

Abbiamo redatto una breve guida con le informazioni utili per un "primo soccorso".
Grazie a Forenser per il consulto tecnico.

Leggi subito la guida: https://github.com/ransomNews/coltellino/blob/main/guida-truffe-whatsapp_ransomnews.pdf

#ransomNews

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Qilin
🧬 Mastelli S.R.L. | Sanremo (IM)
🎯 settore: C - Manifatturiero
🔗 mastelli.com
🗓️ 18 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: -

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Everest
🧬 Galleria di Base del Brennero | Bolzano
🎯 settore: N - Servizi professionali
🔗 bbt-se.com
🗓️ 17 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: 812.00GB
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 24 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Everest
🧬 Galleria di Base del Brennero | Bolzano
🎯 settore: N - Servizi professionali
🔗 bbt-se.com
🗓️ 17 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: 812.00GB
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 24 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #SpaceBears
🧬 Alma Center Servizi Medicali S.R.L. | Mariglianella (NA)
🎯 settore: R - Sanità/Assistenza
🔗 almacenter.it
🗓️ 15 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 31 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Audit
🧬 Ze***ce | -
🎯 settore: -
🔗 -
🗓️ 14 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 21 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

⚠️🔐 Leaked password exposes 8.8 million records

A leaked 123456 password reportedly unlocked Denmark’s CPR register.
🔗 read more: https://www.malwarebytes.com/blog/news/2026/10/how-123456-became-the-key-to-almost-9-million-personal-records?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #DataBreach

⚠️ Fake contests hijack WhatsApp accounts

Stolen verification codes let scammers seize accounts and ask victims’ contacts for money.
🔗 read more: https://www.cybertrends.it/whatsapp-nuova-ondata-di-furti-di-account-con-falsi-concorsi-online/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #WhatsApp

🚨 Fake event invitations intercept #Google logins

UAT-11985 targets Taiwanese researchers with spoofed registration pages that relay MFA and steal sessions.
🔗 read more: https://gbhackers.com/ai-generated-event-lures/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Phishing

🇯🇵🎤 Supplier #malware threatens 8.72 million karaoke records

Daiichi Kosho warns customer and employee data may be exposed; theft remains unconfirmed.
🔗 read more: https://www.infosecurity-magazine.com/news/karaoke-giant-data-breach-eight/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #DataBreach

⚠️ iRhythm breach exposes over 360k patients

Attackers stole identity, insurance and device data from hosted applications, then demanded a ransom.
🔗 read more: https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Healthcare

🚨🪙 Spy implants drain Ledger hardware wallets

#Ledger confirmed hardware tampering in a wallet sold through #CryptoBilis.
🔗 read more: https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Crypto

🚨💸 Cheap phone? Ugh!

Beware some cheap android phones: preinstalled malware is not part of the official price.
https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html

#ransomNews #Android #Malware

🇫🇷🥷 French supermarket fridges hacked, food stocks ruined

Attackers reportedly forced defrost cycles up to 50°C, causing €270k in stock losses at two stores.
🔗 read more: https://www.infosecurity-magazine.com/news/french-supermarket-chains/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #OT

🚨🩺 Dexcom allegedly breached

You all know this is a pretty close theme to us.
Dexcom warned, early this summer, about a lot of their medical sensors being stolen.

Now the alleged breach and data exfiltration.

#ransomNews #healthcare #Dexcom

⚠️🥷 Japan extradites suspected Qilin operative to Germany

A 28-year-old Russian was arrested in Osaka in May over a German #ransomware attack and extradited in June.

🔗 read more: https://therecord.media/japan-germany-ransomware-arrest?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Qilin

🚨🤖 Fake Claude ads deliver ClickFix attacks

#Google Ads abuse Bing redirects to push malicious Mac commands.

🔗 read more: https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #ClickFix

⚠️ FBI arrests ransomware negotiator over extortion

Edward Dubrovsky faces conspiracy and cyber-extortion charges in the #ShinyHunters probe.

🔗 read more: https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Extortion

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Majinahanashi
🧬 CFG Serramenti S.R.L. | Omobono Terme (BG)
🎯 settore: C - Manifatturiero
🔗 cfgserramenti.com
🗓️ 12 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 15 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

⚠️ AgentCore attack exposes credentials and conversations

Researchers used prompts and excessive IAM permissions to hijack other agents; AWS has hardened the defaults.

🔗 read more: https://gbhackers.com/aws-bedrock-agentcore-flaw-allowed-attackers/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #AWS

⚠️🥷 Empire Market co-creator gets 40 years

Raheim Hamilton ran a market handling over $430M.

🔗 read more: https://securityaffairs.com/200704/cyber-crime/us-sentences-empire-market-co-creator-over-430-million-criminal-marketplace.html?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #DarkWeb

⚠️ GhostAction hijacks over 500 GitHub accounts

Malicious workflows in tens of thousands of repositories steal CI/CD secrets and cloud and AI API keys.

🔗 read more: https://thehackernews.com/2026/10/credential-stealing-github-actions.html?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #GitHub

⚠️ Ricardo breach exposes 890k user accounts

Attackers accessed names, postal addresses and phone numbers; #Ricardo says emails and passwords were unaffected.

🔗 read more: https://securityonline.info/ricardo-data-leak/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale](https://securityonline.info/ricardo-data-leak/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #DataBreach

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Majinahanashi
🧬 Tema Energy S.R.L. | Casazza (BG)
🎯 settore: C - Manifatturiero
🔗 tema-energy.it
🗓️ 11 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 13 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Majinahanashi
🧬 Albertin Alcide e Figli S.N.C. | Cinisello Balsamo (MI)
🎯 settore: C - Manifatturiero
🔗 albertin-cliches.it
🗓️ 11 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 12 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🏴‍☠️ gruppo #Majinahanashi
🧬 HYSYTECH S.R.L. | Orbassano (TO)
🎯 settore: N - Servizi professionali
🔗 hysytech.com
🗓️ 11 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: -

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

𝗦𝗵𝗶𝗻𝘆𝗛𝘂𝗻𝘁𝗲𝗿𝘀: 𝘀𝗶𝘅 𝘆𝗲𝗮𝗿𝘀 𝗼𝗳 𝗰𝘆𝗯𝗲𝗿𝗰𝗿𝗶𝗺𝗲 — 𝗲𝘅𝗮𝗺𝗶𝗻𝗲𝗱 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝗲𝘅𝗽𝗲𝗿𝘁 𝗮𝗻𝗮𝗹𝘆𝘀𝗶𝘀 𝗮𝗻𝗱 𝗿𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗴𝗿𝗼𝘂𝗽 𝗽𝗲𝗿𝘀𝗽𝗲𝗰𝘁𝗶𝘃𝗲𝘀.

SuspectFile.com explores the group’s evolution, its impact on the cybercrime landscape, and what recent developments could mean for its future, featuring insights from security experts Claudia Galingani Mongini and Jon DiMaggio, alongside exclusive comments from Qilin and Anubis.

https://www.suspectfile.com/shinyhunters-six-years-of-cybercrime-expert-analysis-and-ransomware-group-perspectives/

#Anubis #Arkem_Cyber #Baited #Qilin #RansomNews #ShinyHunters

🏴‍☠️ gruppo #Deadlock
🧬 Rino Greggio Argenterie S.P.A. | Sarmeola di Rubano (PD)
🎯 settore: C - Manifatturiero
🔗 greggio.com
🗓️ 06 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: 500.00GB
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 14 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🏴‍☠️ gruppo #Deadlock
🧬 Rino Greggio Argenterie S.P.A. | Sarmeola di Rubano (PD)
🎯 settore: C - Manifatturiero
🔗 greggio.com
🗓️ 06 ottobre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: 500.00GB
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 14 ottobre 2026

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

🚨 ASOS allegedly breached

A push notification also was sent to customers - prolly was only for IT dept.
Screen via International Cyber Digest.

#ransomNews #asos

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #BoobaProject
🧬 COSEF Consorzio di Sviluppo Economico del Friuli | Udine
🎯 settore: P - PA/Difesa
🔗 cosef.fvg.it
🗓️ 23 settembre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: 200.00GB
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: -

🖥️ ransomnews.online
🫯 ransomnews.github.io/RedACT

#ransomNews #cybersecurity #cyberthreats

We're always up for improvement, so here's the CESTINO (vulg trash) 🗑️

Instead of deleting old incomplete entries, we just write the new one in the dashboard and let the old one sink in - useful to trace and keep record of each claim.

🫯 ransomnews.github.io/RedACT

#ransomNews

🚨🥷 CL0P gets a taste of itself

#ShinyHunters hijacked CL0P’s leak site and demanded eight figures.
The extortionists are being extorted.
The banters goes on.
And on.

🔗 read more: https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/

#ransomNews #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Vexy
🧬 STP Fashion Lab | Firenze
🎯 settore: C - Manifatturiero
🔗 stpfashionlab.it
🗓️ 17 settembre 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: 79.94GB
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 01 ottobre 2026

#ransomNews

⚠️🎣 Invoice phishing abuses mshta.exe

Spanish lures launch hidden #HTA files for reconnaissance, HTML smuggling and credential-stealing payloads.

🔗 read more: https://gbhackers.com/new-phishing-campaign-abuses-windows-mshta-exe/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Phishing

⚠️🤖 #Claude agents automate attacks

Threat actors used agent workflows for reconnaissance, credential theft and data exfiltration.

🔗 read more: https://gbhackers.com/threat-actors-use-claude-ai-agents-to-automate-cyberattacks-and-steal-sensitive-data/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #AI

🚨 🥷 Conti coder gets four years

Oleksii Lytvynenko built a #malware loader and attacked 12 organizations.

🔗 read more: https://securityaffairs.com/198931/cyber-crime/conti-hacker-who-built-malware-and-attacked-victims-gets-four-year-sentence.html?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Conti

⚠️🤖 OpenAI agents overrun German wiki

Experimental agents made 15-18k autonomous edits, adapted to evade moderation and remained undetected for three months.

🔗 read more: https://www.securityweek.com/openai-agents-hijack-another-victim-website/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #AI

🚨 Security incident on MASTODON.BIDA.IM

Bida.im reports an ongoing credential stuffing campaign across the #Fediverse.

#ransomNews

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Settra
🧬 DiaSorin S.P.A. | Saluggia (VC)
🎯 settore: C - Manifatturiero
🔗 int.diasorin.com
🗓️ 03 settembre 2026

📄 sample: sì
▪️ dati esfiltrati dichiarati: 221.00GB
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 13 settembre 2026

#ransomNews #cybersecurity #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #INCRansom
🧬 Policlinico Triestino S.P.A. (Gruppo Policlinico Triestino) | Staranzano (GO)
🎯 settore: R - Sanità/Assistenza
🔗 polits.it
🗓️ 02 settembre 2026

📄 sample: sì
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: -

#ransomNews #cybersecurity #cyberthreats

🆕 Recap sugli attacchi #ransomware a target italiani 🇮🇹
🔘 Riassunto dal 1 Gennaio 2026 al 31 Agosto 2026
🔗 Dati e Statistiche: https://ransomnews.github.io/RedACT/

▪️ Totale rivendicazioni registrate dal 1 Gennaio 2026: 216
▪️ Totale dati (provvisori) pubblicati nell'anno 2026: 25.015,32 GB
▪️ Percentuale +/- rivendicazioni registrate rispetto allo stesso periodo anno precedente: +75,61 %

▪️ Rivendicazioni registrate a Agosto 2026: 52
▪️ Rivendicazioni registrate a Agosto 2025: 14
▪️ Percentuale +/- rispetto allo stesso mese anno precedente: +271 %
▪️ Dati (provvisori) pubblicati a Agosto 2026: 3.455,62 GB

#ransomNews #RedACT

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #TheGentlemen
🧬 Exacta Labcenter S.P.A. | San Prospero (MO)
🎯 settore: G - Commercio
🔗 exactalabcenter.it
🗓️ 29 agosto 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: -

#ransomNews #cybersecurity #cyberthreats

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #TheGentlemen
🧬 General S.R.L. | Seravezza (LU)
🎯 settore: G - Commercio
🔗 generalgruppo.it
🗓️ 28 agosto 2026

📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: -

#ransomNews #cybersecurity #cyberthreats

🚨 UPDATE Stansted customer data stolen

Attackers obtained emails, phone numbers, vehicle registrations and postcodes; airport operations and payment data were unaffected.

🔗 read more: https://www.stanstedairport.com/help/data-security-incident/

#ransomNews #cyberthreats #DataBreach

⚠️ Kiro prompt injection leaks data

A malicious workspace can make #Amazon #Kiro exfiltrate local files after any agent message; fixed in 0.8.140.

🔗 read more: https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #AI

🚨 🤖 Boston Scientific attack disrupts shipments

A global network outage limited systems used to process and ship medical-device orders.

🔗 read more: https://www.helpnetsecurity.com/2026/08/27/boston-scientific-cyberattack-network-outage/

#ransomNews #cyberthreats #Healthcare

🚨 Bureau of Alcohol, Tobacco, Firearms and Explosives

Threat actor #Qilin lists Bureau of Alcohol, Tobacco, Firearms and Explosives on its DLS.

#ransomNews #cyberthreat

👉 Nobody "hacks in" anymore, somebody lets them in

The numbers we track are only half the story.
The other half is behavioural: who clicked, why it made sense to them, and what the attacker already knew before writing a single line of code.

🔗 https://ransomnews.github.io/RedACT/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Filone-3-(Avversario%252c-PAS)

#ransomNews #cyberthreats

🚨 🕹️🚗 #GTA6 leaked. Now the dragnet begins.

Take-Two subpoenaed Discord and Microsoft for IPs, phone numbers, linked accounts and device IDs, potentially exposing thousands with no known link to the leak.

CyberLeek claimed the leakage.
The footage escaped. Privacy may pay.

#ransomNews #cyberthreats #Privacy

🔎 Italian school vendor lists 6.1TB

#xplOitrs lists stolen files for $50.000.
Spaggiari Group says it's all ok.
And the threat actor smirks.

Thanks #FanPage for the mention, ransomNews is happy to serve 😎

🔗 read more: https://www.fanpage.it/innovazione/tecnologia/violato-il-gestore-dei-software-piu-usati-nelle-scuole-ditalia-dati-in-vendita-a-50-000-dollari/

#ransomNews #cyberthreats #DataBreach

⚠️🤖 #DeepSeek agent automates global attacks

A solo operator probed 460 systems; three organizations were breached and 11 #Marimo targets suffered command execution.

🔗 read more: https://gbhackers.com/chinese-hacker-uses-deepseek-hermes-agent/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #AI

🚨 nuova rivendicazione #ransomware Italia 🚨

🏴‍☠️ gruppo #Qilin
🧬 S.E.M.P. S.R.L. | Pero (MI)
🎯 settore: N - Servizi professionali
🔗 semp.it
🗓️ 23 agosto 2026

📄 sample: sì
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: -

#ransomNews #cybersecurity

🚨 🚗 Malware hijacks #Android car units

Attackers abused #DoFun’s update channel to deploy a #BadBox downloader for fraud.

🔗 read more: https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Calendario-Editoriale

#ransomNews #cyberthreats #Android