Brenner Base Tunnel SE confirms a breach and Everest claims 812 GB. What we know, what we don’t, and why overblown alarm helps propaganda more than the attackers.

Brenner Base Tunnel (BBT) SE, the company building the Brenner Base Tunnel between Italy and Austria, has confirmed that unauthorized people accessed some of its data. The extortion group Everest claims it took 812 GB of files. Nobody has verified that, and a criminal bragging about file sizes isn’t an audited source.

The timeline is thin. The intrusion reportedly dates to mid-October, Everest’s claim to 17 October, and the Austrian press broke the story on 6 November. On 7 November BBT SE told ANSA that operations are unaffected, the systems involved are isolated, and outside forensic experts and the authorities are on the case.

If real and current, drawings, surveys and site procedures would save an attacker a lot of reconnaissance. Together they could show how the infrastructure fits together, and fraudsters could borrow project names to fool contractors. Those are scenarios, not sightings.

Dates matter too. The tunnel won’t open before 2034, at a projected cost of about €11.7 billion, so older drawings may describe a design that has since changed.

Knowing how a tunnel is built does not mean being able to control it. Sabotage requires access to operational systems and weaknesses that attackers can exploit. So far, there is no evidence that attackers accessed industrial systems or tampered with the tunnel’s control functions. BBT SE has not confirmed any encryption of its systems either. Claims that ransomware could stop the tunnel therefore have no factual support.

Everest is a Russian-speaking cybercriminal group. ZeroFox has also noted that the group tends to exaggerate the amount of data it steals. Speaking Russian and operating within a Russian-speaking cybercrime environment does not prove that the group is directed by the Russian state. In July, the same group demanded CHF 10 million from Stadler Rail after using stolen credentials to access a supplier’s data platform. Production continued despite the incident.

The response should focus on practical security measures. Organizations need to identify which information was exposed, revoke potentially compromised credentials, keep document management systems separate from industrial control networks, and warn suppliers about fraudulent requests. Whether NIS2 applies to a project company that is still under construction depends on its activities and the relevant national legislation.

There is no benefit in creating unnecessary alarm. It only helps the attackers and anyone trying to exploit the incident for an influence campaign. Blaming Moscow without evidence would play directly into propaganda efforts. There are three key questions that need clear answers: which files were actually stolen, how recent and relevant they are, and who might still be able to use them.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Brenner Base Tunnel)

Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately.

A security fix released in 2024 is now at the centre of ransomware attacks against Synology NAS devices. The company has found attackers targeting systems that still run outdated versions of DiskStation Manager (DSM), putting files stored on these network storage devices at risk of encryption and extortion.

Synology disclosed the attacks on October 29, 2026. Its investigation found that threat actors are taking advantage of a vulnerability that the vendor had already addressed in December 2024. “These attacks aim to encrypt data and extort ransom.” The warning highlights how devices left without security updates can remain exposed long after vendors have released a fix.

The company hasn’t identified the exact vulnerability used in the attacks. Instead, it refers customers to Synology-SA-24:20, a security advisory published on November 5, 2024, which documents three flaws affecting DSM. The advisory was updated as fixes became available across different software branches, with the DSM 6.2 update released on December 5.

The three vulnerabilities have different security implications. CVE-2024-10441 is the most severe, with a CVSS score of 9.8. It affects the system plugin daemon and could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable device.

CVE-2024-50629 has a CVSS score of 5.3 and affects the DSM webapi component. It could allow remote attackers to read limited files. The third issue, CVE-2024-10445, is rated 4.3 and concerns improper certificate validation in the update functionality. It could allow an attacker in an adjacent network position to write limited files.

Synology hasn’t confirmed which of these vulnerabilities attackers are exploiting. The three flaws should therefore be considered part of the security advisory, not three confirmed entry points in the current ransomware campaign.

The vendor has released corrected builds for all the affected DSM branches. Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory:

• DSM 7.2.2: 7.2.2-72806-1 or later.
• DSM 7.2.1: 7.2.1-69057-6 or later.
• DSM 7.2: 7.2-64570-4 or later.
• DSM 7.1: 7.1.1-42962-7 or later.
• DSM 6.2: 6.2.4-25556-8 or later.

The impact of a ransomware infection on a NAS can extend well beyond the storage device itself. Businesses often use these systems to keep shared documents, operational files and backup copies in one place. If attackers encrypt that data, employees may lose access to essential information, while recovery can become much harder if the NAS also holds the backups needed to restore other systems.

Updating DSM is therefore an immediate priority for administrators and home users alike. Synology is also advising customers to enable automatic updates so that future security fixes don’t depend entirely on someone checking for them manually.

“Synology also recommends enabling automatic updates to keep DSM up to date at all times.” concludes the advisory.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, NAS)

Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator.

A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for the Eastern District of New York announced it in a press release, and it also says an $11 million reward remains for a co-conspirator who’s still at large.

“Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims.” reads the DoJ’s press release. “The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers.  “

In December, Artem Aleksandrovych Stryzhak pleaded guilty in the U.S. for Nefilim ransomware attacks. The Ukrainian citizen was arrested in Spain in 2024 and extradited to the US in April 2025. He pleaded guilty to conspiracy to commit computer fraud, extortion, and related activity

Nefilim ransomware was used to encrypt networks worldwide, including in the Eastern District of New York, causing millions in losses from ransom payments and system damage. Attackers employed a customized ransomware executable in each attack, generating unique decryption keys and tailored ransom notes for victims. In June 2021, Nefilim administrators granted Artem Stryzhak access to the ransomware code in exchange for 20% of his ransom proceeds, which he deployed via his account on the administrators’ online platform.

Stryzhak and co-conspirators researched victims using online databases to collect information on their net worth, size, and contacts. After gaining network access, they stole data to pressure companies into ransom payments. Nefilim notes warned that stolen data would be posted on publicly accessible “Corporate Leaks” sites maintained by the administrators if victims did not comply.

Volodymyr Tymoshchuk, Stryzhak’s co-defendant and Nefilim admin, is a serial ransomware cybercriminal who is still at large. 

According to court documents, his first role was with Nefilim. Starting around June 2021, he joined the ongoing Nefilim conspiracy as an affiliate and got access to the ransomware. In exchange, he agreed with one of the group’s administrators, Volodymyr Tymoshchuk, to pay the administrators 20 percent of the ransom proceeds. Even crime has licensing fees.

One of those attacks came in June 2021, when Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, he created email addresses that went into a ransom note sent to the victim. He kept deploying Nefilim ransomware through at least October 2021.

Separately, he also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive’s conspirators attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. The attacks caused major disruption to daily operations around the world and affected responses to the COVID-19 pandemic. One hospital had to give up digital technology to treat its patients and couldn’t take in new ones right after the attack.

As a Hive affiliate, Stryzhak and his co-conspirators hit seven victims, including law firms, a dentist’s office and a healthcare provider, during the pandemic. Those victims couldn’t get to their encrypted data. The FBI, as part of a months-long effort to disrupt Hive, gave a decryption key to one of Stryzhak’s victims, so that victim recovered its data without paying a ransom.

U.S. Attorney Joseph Nocella, Jr. thanked the FBI’s New York Field Office, the Justice Department’s Office of International Affairs and its Computer Crime and Intellectual Property Section, and Spanish law enforcement for helping to capture him.

“Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” stated United States Attorney Nocella. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”

The State Department’s Transnational Organized Crime Rewards Program is offering up to $11 million for information that leads to the arrest, conviction or location of Tymoshchuk.

Anyone with information can call the FBI at +1-917-242-1407 or email TymoTips@fbi.gov, contact a local field office if in the United States, or reach the nearest U.S. Embassy if overseas.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying.

CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most active operations currently running. The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.

“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.” reads the joint advisory, “The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.”

SafePay appeared in mid-2024 as an independent ransomware group that operates without affiliates. This is unusual because many major ransomware groups work like franchises, allowing other criminals to use their tools and services. SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued. The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026.

SafePay’s preferred entry points are exposed credentials, brute force password attacks, and VPN access.

“The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory. “SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products”

Security teams should watch for unusual login attempts coming from Mullvad VPN IP addresses. SafePay also uses stolen account credentials and automated scripts to exploit known vulnerabilities in internet-facing devices. These include Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue.

Once inside a network, the attackers rely on common tools rather than specialized malware. They use PsExec, WinRM, RDP, and PowerShell to move between systems. A PowerShell script called ShareFinder.ps1 helps them find shared folders and identify valuable data. Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access. To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive.

Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size. Files get the .SafePay extension appended.

“Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software.” states the advisory. “SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. “

Paying the ransom remains the only path to decryption for encrypted files, and even that isn’t guaranteed to work.

The group runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn’t pay. After encryption, SafePay sends victims to a Tor-based chat portal for negotiations. A representative also makes phone calls to apply pressure. If no payment comes, everything goes on the leak site. The group also deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, which is the operational equivalent of cutting off every exit before the fire starts.

The advisory recommends several basic security measures. Keep internet-facing devices, especially VPNs and firewalls, up to date. Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems.

Limit the number of accounts allowed to use administrative tools. SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect. Organizations should also keep backups offline, encrypted, and immutable so attackers cannot access, change, or delete them.

CISA also recommends reviewing all accounts with admin privileges, setting time-limited access where possible, and disabling command-line tools for any account that doesn’t need them.

The advisory includes IOC files in STIX XML and JSON format, full MITRE ATT&CK mapping, and complete file and IP indicators.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

Japan helped extradite a Russian suspect linked to Qilin ransomware to Germany, but the gang continued attacking victims after his arrest.

Germany has arrested a Russian national believed to be a leading figure in the Qilin ransomware group, and Japan’s National Police Agency just put its own role in that arrest on the record. The suspect was detained in Japan back in May, at a hotel in Osaka, while traveling as a tourist.

“In connection with a ransomware incident in Germany, German authorities had obtained an arrest warrant for a Russian national suspected of involvement in the attack. When the suspect arrived in Japan, the Japanese authorities worked with the Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities to detain him under a provisional detention warrant, in accordance with Japan’s Act of Extradition.” reads a full NPA statement in Japanese. “The Japanese authorities subsequently handed the suspect over to Germany in accordance with the procedures established by that law. These actions contributed to the case.”

Germany already had an arrest warrant out for the man over a ransomware incident on German soil. When he showed up in Japan, Japanese authorities moved fast. Per the NPA’s own account, Japan’s Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities worked together to detain him under Japan’s extradition law, using a provisional detention warrant, before handing him over to Germany through the proper legal process.

The NPA statement does more than confirm the arrest. It specifically recognizes the work of the Kanto Regional Police Bureau’s Cyber Special Investigation Unit and other local police forces. They had been investigating Qilin ransomware attacks in Japan and working with German investigators on the wider case. The agency stressed that international cooperation is essential to investigating cybercrime, including ransomware attacks that affect countries around the world.

Japan has good reason to focus on Qilin. The group has attacked Japanese organizations, including carmaker Nissan and brewing company  Asahi. The attack on Asahi disrupted its operations for an extended period and exposed data belonging to 1.5 million people. Japan has been directly affected by the group, so its role in the investigation and the suspect’s extradition is significant.

Qilin ransomware operation has been active since 2022, it has become one of the most active RaaS groups in 2025, claiming over 40 victims monthly and peaking at 100 in June.

The group enables affiliates to deploy customized ransomware payloads against targeted organizations. Qilin uses double-extortion tactics, encrypting data while threatening to leak it via Tor-based portals. The group has targeted multiple sectors worldwide, including healthcare, manufacturing, and finance, leveraging phishing and known vulnerabilities.

In October 2025, Resecurity’s researchers detailed how the Qilin RaaS group relies on global bulletproof hosting networks to support its extortion operations.

In early October, DragonForce, LockBit, and Qilin formed a ransomware alliance to boost attack effectiveness, marking a major shift in the cyber threat landscape. Ransomware groups DragonForce, LockBit, and Qilin formed a strategic alliance to enhance their attack capabilities, signaling an evolving cyber threat landscape. The alliance aims at sharing tools and infrastructure to enhance attack effectiveness. 

At the end of March, Qilin Ransomware group allegedly breached the chemical manufacturing giant Dow Inc. 

Despite the suspect’s detention in May, the cybercrime group has listed hundreds of new victims on its Tor leak site since June alone.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

MonsterCloud owner Zohar Pinhasi allegedly paid ransomware demands behind clients’ backs, then charged them millions for the supposed recovery.

Zohar Pinhasi, the owner of Florida-based MonsterCloud, was charged this week with wire fraud. Federal prosecutors say his clients were scammed twice during the same ransomware crisis.

Pinhasi (50) also used the names “Zack Silver” and “Zack Green,” which is a surprising number of aliases for someone running a legitimate ransomware recovery business. MonsterCloud ’s website told clients not to pay ransoms and promised that its team could recover encrypted data without dealing with cybercriminals. Prosecutors say the company was doing the exact opposite.

According to the indictment, Pinhasi claimed to have proprietary tools and advanced decryption techniques that let him crack ransomware without negotiating with attackers. He allegedly had none of that. Instead, he contacted the same cybercriminals who’d hit his client, paid them for a decryption key, then had MonsterCloud staff use that key and present the recovery as the product of his own technology.

“Pinhasi typically charged MonsterCloud’s clients a fee that was substantially higher than the ransom that MonsterCloud secretly paid.” reads the press release published by DoJ.

The math is where it gets ugly. Prosecutors cite one case from August 2023 where Pinhasi paid a ransom of roughly $8,200, then billed the client about $150,000 for the “service.” Across the whole scheme, he allegedly collected more than $19 million from clients while quietly paying out over $8 million in ransom money himself, pocketing the difference while selling the opposite of what he was actually doing.

“The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “This prosecution underscores the Department’s commitment to protecting ransomware victims, regardless of how these cyber ransoms occur.”

That phrase captures the real damage here. Ransomware victims are already dealing with locked files, operational chaos, and the gut punch of being extorted. Finding out afterward that your “ethical” recovery firm secretly paid your attacker and marked up the bill nearly twentyfold isn’t a service failure, it’s exploitation dressed up as rescue.

The FBI and CISA have clear guidance on ransomware payments: they do not recommend paying because it does not guarantee that the data will be decrypted, that the attackers will leave the network, or that stolen data will not be leaked.

Pinhasi faces two wire fraud charges and one conspiracy charge. Each charge carries a possible sentence of up to 20 years if he is convicted, but the charges are only allegations at this stage.

For anyone choosing a ransomware recovery company, claims about “proprietary decryption tools” should be a reason to ask more questions, not simply trust the vendor.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MonsterCloud)

Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide.

Warlock ransomware made headlines back in mid-2025 for exploiting a chain of SharePoint zero-days collectively dubbed ToolShell. More than a year later, the same group is still using that door, and it’s still getting in.

Symantec tracks the group behind Warlock as Longlegs, also known as Storm-2603, and ties it back to older China-nexus clusters called CL-CRI-1040, CamoFei, and ChamelGang. In the past two months alone, Longlegs hit at least four organizations: a water utility, a telecom provider, a regional government body, and a university. All four sit in Portuguese or Spanish speaking countries, spread across Europe, Africa, and Latin America.

Warlock has already targeted organizations in the US, Brazil, India, Russia, Taiwan, and Japan, so the group is not focused on one specific region. The recent attacks on Portuguese- and Spanish-speaking countries could simply mean the attackers are looking for exposed and unpatched SharePoint servers wherever they can find them. They could also be working from a specific target list. Either way, targeting a water utility and a telecom company within a few weeks is something defenders should take seriously.

SharePoint is still the main entry point. Longlegs places a webshell in the LAYOUTS directory and designs it to work across different SharePoint versions. The attackers then steal the server’s ASP.NET machine keys and use them to create a signed payload that can execute code inside the SharePoint application. The technique is effective, but it depends on finding SharePoint servers that have not been properly patched.

Once they get inside, the attackers use DLL sideloading to run additional payloads. They download these files from legitimate hosting services such as catbox.moe and wasabisys.com, which helps the traffic blend in with normal activity.

Before deploying the ransomware, Longlegs also uses a signed but vulnerable driver called K7RKScan to disable security software. This is a common “bring your own vulnerable driver” technique. The attackers have also installed Visual Studio Code’s tunneling feature as a service, giving them remote access that can look like normal developer activity.

“The group continues to favor SharePoint-related vulnerabilities to gain initial access to targeted organizations.” states the report. “Longlegs abuses a vulnerable, signed driver (K7RKScan) to disable security software before deploying ransomware, and has also been observed abusing Visual Studio Code’s tunneling feature for covert remote access.”

Symantec’s report traces a full attack against a critical infrastructure operator starting July 22, 2026, when the webshell first landed on a SharePoint server. Two days later the attackers ran basic recon commands, deleted some staging files, and dropped a pair of DLL sideloading tools. A few days after that, they pinged a Burp Collaborator subdomain baked with the target’s own domain name, which is a scanner’s way of confirming its injected code actually ran.

By July 28 the real exploitation began, using a deserialization gadget to turn a forged, signed payload into code execution inside SharePoint. The attackers then pulled three separate installer packages from two different hosting services within ninety minutes, suggesting they had backups ready in case one path got blocked.

“Two different public hosting services and three distinct package names within the space of ninety minutes suggests the attackers had more than one payload ready to go and were not relying on a single point of delivery.” continues the report. “The intrusion then broadened from the two initial SharePoint servers to the wider domain. Later that day and into the next (July 29) the attackers repeatedly added a domain account named SPSEPRDSetup to the local Administrators group on three further hosts (Computer 3, Computer 4, and Computer 5):”

They spread out to more hosts by adding a fake-sounding admin account named SPSEPRDSetup, a decent bit of social camouflage since SharePoint really does create accounts with that kind of prefix.

On July 31, the attackers deployed a tool designed to disable antivirus and EDR across the network in a short period.

“In one intrusion against a critical infrastructure operator, the attackers pushed a tool designed to disable security software to at least 40 hosts within about two hours, then deployed Warlock on at least 33 hosts by staging it in the domain’s SYSVOL share, where ordinary domain replication delivered it to machines.” Symantec states.

Warlock ransomware was then deployed almost immediately after the security tools were disabled. This was not a slow attack. The attackers moved quickly from disabling protection to encrypting systems.

The attackers also used the domain’s SYSVOL share to distribute the ransomware. SYSVOL is automatically replicated across domain controllers, making it an effective way to spread files across a Windows domain. Symantec found that the ransomware was delivered through normal domain replication traffic, with three systems capturing dfsrs.exe, the Windows service responsible for that replication, delivering the malicious files.

The lesson here isn’t subtle. ToolShell and its related SharePoint flaws are still a working way into a network more than a year after they first made news, and that only holds true because some organizations haven’t patched or mitigated them yet. If you’re running on-premises SharePoint Server and haven’t checked it against CISA’s July 2026 advisory, that’s worth doing before your Monday coffee gets cold.

“Longlegs’ continued activity, more than a year after Warlock ransomware first came to prominence, shows that exploitation of ToolShell and other related-SharePoint vulnerabilities remains a viable initial access route for attackers SharePoint deployments that have not been patched or otherwise mitigated.” concludes the report. “The apparent recent focus on Portuguese- and Spanish-speaking countries suggests either an opportunistic targeting pattern driven by exposed, vulnerable SharePoint servers, or a more deliberate tasking. The inclusion of critical infrastructure operators among the victims is a reminder of the potential real-world consequences of ransomware attacks that succeed against essential services.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Warlock ransomware)

Operation KillSwitch: Europol says the KillSec ransomware group, allegedly led by a 16-year-old, was dismantled after attacks on about 1,000 victims.

Law enforcement seized control of KillSec ‘s dark web leak site, the Tor website the group used to threaten victims with publishing stolen files unless they paid up. That single action locked down more than 110 terabytes of stolen data, cutting off further unauthorized access. Full details are in Europol’s release.

The takedown was part of Operation KillSwitch, led by German authorities. Investigators are looking into around 1,000 suspected attacks worldwide and believe the group’s main operator is just 16 years old. Three suspects were arrested and police searched eight properties in Greece, Romania, Spain, and the UK.

“On 30 September 2026, law enforcement took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorised access.” reads the press release published by EUROPOL. “KillSec stole sensitive data by exploiting vulnerabilities and poorly secured access points to organisations’ systems. Around 500 of the suspected attacks have so far been identified as successful. This figure may change as investigators examine the evidence seized during the operation.”

KillSec has been active since around 2024. The group broke into systems by exploiting software flaws and weak security, often targeting cloud storage. After stealing sensitive data, they posted victims on their leak site and demanded payment to keep the data private.

Investigators are looking into around 1,000 suspected attacks, with about 500 already confirmed. The number could change as police examine the seized evidence. In some cases, the group received ransom payments.

What stands out is the tooling: investigators found the group used AI to build and maintain its ransomware infrastructure and to help pick out potential victims. Ransomware crews adopting AI for target selection isn’t exactly a plot twist at this point, but seeing it confirmed in a law enforcement operation is still worth noting.

The suspected main operator is 16 years old. Another suspect, believed to be a developer, turned 18 in August 2026 and was under 18 when some of the alleged crimes happened. Investigators also found people who may have worked as a negotiator and an affiliate. The investigation is still ongoing.

The case also shows a growing trend in cybercrime: some complex ransomware operations are being run by very young people.

“The coordinated action targeted both the people behind KillSec and the systems they relied on. Authorities carried out eight house searches in Spain, Greece, Romania, and the United Kingdom, made three provisional arrests, and seized evidence and assets.” continues the press release.

Police brought five central servers under their control over the course of the investigation, including the systems used to manage KillSec’s operations and store stolen victim data. They also seized the group’s domains and redirected visitors to a law enforcement notice instead. Authorities are now working through seized devices, tracing cryptocurrency, and following up on evidence that could surface more victims and more people involved.

Ten countries took part in the operation: Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the UK, and the US. Europol and Eurojust also supported the investigation.

Europol shared intelligence and helped investigators work together, while Eurojust helped coordinate the legal side. Europol also helped organize the action across countries. In total, police made three arrests and searched eight properties in four countries at the same time.

Eurojust’s role was judicial coordination, getting authorities across jurisdictions to align on identifying suspects and tracking financial trails. Europol also ran a coordination center to make sure the action happened simultaneously across every country involved. Pulling off three arrests and eight searches at the same time, across four countries, isn’t a small logistics problem.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, KillSec Ransomware)

Microsoft details Storm-3168, the JADEPUFFER-linked actor that used stolen service principals to delete Azure storage in minutes and harvest keys.

Microsoft just published the first detailed look at what JADEPUFFER does inside Azure. Sysdig first spotted the group’s activity in July 2026 and called it the first documented agentic ransomware operation. Microsoft tracks the same actor as Storm-3168, and its new report shows how fast this crew moves once it holds valid cloud credentials.

The attack involved two compromised service principals from the same tenant. These are non-human identities that applications use to communicate with Azure. One was used for reconnaissance, while the other focused on discovery, destruction and credential theft. It was a clear division of tasks between the two identities.

The reconnaissance began in early June 2026. The first identity spent about 15 hours and 30 minutes listing virtual machines, subscriptions, resource groups and other resources, completing more than 300 successful read operations. About 90 minutes later, the second identity carried out similar activity across two subscriptions in just five seconds. Both identities used Storm-3168 infrastructure, the same network fingerprint and the same user agent, python-requests/2.34.2.

“About 90 minutes after the first compromised service principal started enumeration, the second compromised service principal enumerated virtual machines and resource groups across two subscriptions in five seconds. Both service principals used Storm-3168 linked infrastructure, the same network fingerprint, and the user agent python-requests/2.34.2.16 hours later, the second service principal successfully enumerated Azure App Service configuration stores, possibly looking for exposed credentials. It also unsuccessfully attempted to look for Azure OpenSearch resources.” reads the report published by Microsoft. “70 seconds after this final inventory operation, the same service principal also attempted a ListKey operation against a non-existent storage account.”

Sixteen hours later, the second identity checked App Service configuration stores, possibly hunting for exposed credentials, and tried to find Azure OpenSearch resources without luck. Seventy seconds after that, it asked for the keys of a storage account that doesn’t exist. Less than a second after that failed request, the deletion started.

In 35 minutes the identity attempted more than 150 destructive or credential related operations, and the destructive part itself ran about seven minutes. It tried to delete over 100 storage accounts and succeeded with most of them. It also deleted a Key Vault, a Function App, and an App Service plan from the same resource group, all of which appeared to support that one app.

Not everything was deleted. Azure resource locks and storage account deletion protection prevented the attackers from removing several storage accounts. Microsoft says this shows that independent security controls can still protect resources even when a compromised identity has broad admin privileges.

The attackers also tried to delete several Azure SQL databases at the same time, but all the attempts failed because the script used an unsupported API version for that resource type. In this case, a simple technical error ended up blocking part of the attack.

The attackers also targeted backup and recovery systems. The compromised identity made several unsuccessful attempts to remove Azure Site Recovery locks and Azure Backup protection locks. It also targeted storage accounts with names related to Terraform and backups, suggesting that the attackers were trying to make recovery more difficult.

Half an hour after the last deletion, the same identity came back for keys. It inventoried the storage accounts and sent more than 30 successful ListKeys requests, including for accounts tied to Azure Site Recovery. One storage account in the same resource group as the deleted Key Vault and Function App was spared during the cleanup, then hit with a successful key request later.

Microsoft says it can’t confirm how the identity was first compromised. It did find that the client ID, client secret, and tenant ID had been posted in plaintext in a public GitHub issue by an employee of the impacted organization.

“The issue was later edited to remove the secret, but the secret remained accessible through the issue’s public edit history. Removing or redacting an exposed secret does not invalidate it; credentials exposed in any public internet location should be treated as compromised and promptly revoked or rotated.” continues the report. “We could not confirm whether this secret was used for the activity described here.”

The report also describes separate probing from Storm-3168 linked infrastructure since the start of the year. The targets were Azure App Services belonging to different customers, and the paths included WordPress administration, PHP-CGI, LangFlow’s code validation endpoint at /api/v1/validate/code, and other web shell style locations. None of those targets overlapped with the affected subscriptions, and Microsoft found no route from an App Service to Azure Resource Manager credentials for this tenant. The three IP addresses tied to the probing and malicious requests are 45.131.66[.]106, 34.153.223[.]102, and 64.20.53[.]230.

Why call it automated? The timing, the split between two identities, and overlapping token streams point to scripted execution.

“The timing between the different operations and the division of work using multiple service principals and overlapping token streams from the same service principal strongly indicates automated or scripted execution.” Microsoft states.

The destructive identity used five unique tokens, four for deletion and one for storage inventory and key retrieval, and two of the deletion tokens were active at the same time for 70 seconds. One focused on storage deletion, the other on a mix of storage and SQL.

The permissions match what the identity already had. A group-granted Storage Account Contributor role covered the storage deletions. Direct Contributor access covered the three application resource deletions and one key retrieval, and direct SQL DB Contributor access covered the failed SQL attempts. The attackers didn’t need to escalate anything, because the access was already there.

Microsoft describes the pattern as consistent with ransomware and extortion, but with a caveat. It didn’t see a ransom note or confirm data exfiltration in this case. What it did see is destruction, interference with recovery, and collection of keys that could open the door to data theft later.

The advice starts with the boring part. Treat any credential exposed on the public internet as compromised, revoke or rotate it, and check its history of use. Keep secrets out of code, config files, repositories, and issues, and give service principals only the permissions their apps need.

Turn on the relevant Defender for Cloud plans for Resource Manager, Storage, Key Vault, App Service, and Databases. Restrict access to backup and recovery resources, and watch for attempts to change or remove their protection. Microsoft also points defenders toward Project Perception for AI agents that investigate at machine speed, and MDASH for finding AI assets and their weak spots.

“Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, JADEPUFFER)

Ryuk member Karen Vardanyan was sentenced to 24 months in U.S. prison after extradition from Ukraine and ordered to pay $1.2M in restitution.

Karen Vardanyan, a 35-year-old Armenian citizen who went by “Maneeken” and, oddly, “Karl Lagerfeld” online, was extradited from Ukraine and sentenced to 24 months in federal prison plus three years of supervised release. He was also ordered to pay $1,219,106 in restitution to his victims.

“Karen Vardanyan, 35, was sentenced to 24 months in federal prison and 3 years’ supervised release. He was also ordered to pay $1,219,106.00 in restitution to the victims in the case.” states the press release by DoJ..

That number alone tells you the scale of what he was involved in, and it’s only a fraction of the total damage the wider conspiracy caused.

In July, Vardanyan pleaded guilty in the U.S. for his role in Ryuk ransomware attacks targeting American organizations between 2019 and 2020. Extradited from Ukraine after his 2025 arrest, he admitted providing initial access to corporate networks that enabled ransomware deployment.

Between November 2019 and April 2020, Karen Vardanyan illegally accessed corporate networks and helped deploy Ryuk ransomware on hundreds of servers and workstations.

The attacks encrypted victims’ data and demanded Bitcoin payments in exchange for decryption keys. Among the victims were a Michigan company that paid 200 Bitcoin (worth over $1.1 million at the time), a company in Oregon, and a school in Texas. Overall, the group is believed to have collected around 1,610 Bitcoin, valued at more than $15 million when the ransoms were paid.

According to a report published by Advanced-intel and HYAS in 2021, Ryuk was a highly profitable ransomware operation, generating an estimated $150 million in Bitcoin ransom payments. Researchers traced 61 wallet addresses linked to the group and identified laundering mechanisms involving brokers, intermediary wallets, and cryptocurrency exchanges such as Binance and Huobi. Ryuk RaaS was run by the crew known as Wizard Spider, which became one of the defining threats of the early pandemic years, hitting hospitals hard while healthcare systems were already stretched to breaking. At its peak, it was compromising roughly 20 organizations a week and pulled in more than $150 million in ransom payments before shutting down in 2020.

The operators used professional money-flow techniques and created unique ProtonMail addresses for each victim to improve operational security and avoid detection.

Hundreds of servers and workstations from a role that was, technically, just the entry point. That’s the part worth sitting with if you’re in charge of defending a network: the person who gets you in the door is rarely the one who does the flashy encryption work, but without them none of it happens.

The FBI investigated the case, and the Justice Department’s Office of International Affairs handled the extradition process, with Ukrainian authorities getting a direct thank you for their cooperation, a detail that matters more than it might seem given how often ransomware operators hide behind borders that don’t cooperate with US law enforcement.

Ryuk did not really disappear when the ransomware operation shut down. Wizard Spider later rebranded as Conti, which grew even bigger before its chats and source code leaked in 2022. The group then broke into smaller crews, some joining other ransomware operations and others creating new ones. The Ryuk-to-Conti connection is therefore still visible in today’s ransomware ecosystem.

Whether a 24-month sentence matches more than $1 million in restitution and a role in a $15 million conspiracy is open to debate. But the extradition itself sends a clear message: hiding behind national borders is no longer a guarantee of safety for cybercriminals.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ryuk)

Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for ransomware attacks.

Oleksii Oleksiyovych Lytvynenko had, by most accounts, a fairly ordinary legal career in Ukraine before he switched to writing malware. A US federal court sentenced the 44-year-old to four years in prison this week for conspiracy to commit wire fraud, the Justice Department announced, tied to his role in Conti, the ransomware operation blamed for infecting over 1,000 organizations worldwide.

“Oleksii Oleksiyovych Lytvynenko, 44, a Ukrainian national, was sentenced today to four years in prison for conspiracy to commit wire fraud in connection with a conspiracy to deploy Conti, a ransomware variant that infected the computers of more than 1,000 victims worldwide.” reads the announcement by DoJ. “According to court documents, Lytvynenko, formerly of Cork, Ireland, conspired with others to deploy Conti ransomware to extort victims and steal their data. From 2020 until 2022, Conti was used to attack computers and networks in 47 states, 31 foreign countries, the District of Columbia, and Puerto Rico. The FBI estimates that, as of January 2022, there had been victim payouts associated with Conti ransomware exceeding $150,000,000.”

Conti’s numbers put it in a different league from most ransomware groups that end up in a US courtroom. Between 2020 and 2022, the group attacked networks across 47 US states, 31 foreign countries, Washington DC, and Puerto Rico, and the FBI estimates victim payouts topped $150 million before the operation shut down.

Lytvynenko stood out because he handled both sides of Conti’s operations. He broke into victim networks and developed tools for attacks. He built a loader that helped deploy malware on compromised systems. Investigators found stolen data from eight US victims and four overseas organizations in his accounts. Prosecutors linked his actions to attacks on at least 12 companies, showing he played an active role rather than working on the sidelines.

Specifically, he was assigned to code a “loader,” the kind of malware that opens the door for other malicious software to run once a machine is already compromised. Evidence recovered from his own online accounts showed he personally held stolen data from eight US victims and four more overseas, and prosecutors say his direct actions affected at least a dozen companies during his time with the group. That’s not someone on the periphery of the operation; that’s someone touching both the tools and the actual victims.

The most striking detail in this case is what happened after Conti supposedly stopped existing. The gang shut down its operation in 2022 after its internal chat logs and source code leaked publicly, following the group’s public declaration of support for Russia’s invasion of Ukraine, a leak that exposed the entire operation to researchers and law enforcement simultaneously. Lytvynenko apparently didn’t take that as a signal to find a different line of work.

When Irish police showed up at his home in County Cork in July 2023, they reportedly found his laptop still open, running Cobalt Strike, with an active Rocket. Chat session connected over Tor, the kind of setup that doesn’t belong to someone who’s quietly stepped away from cybercrime. Forensic evidence from that arrest demonstrated his ransomware activity had continued well past Conti’s collapse. He was extradited from Ireland to the US in October 2025, more than two years after that raid.

Lytvynenko admitted to joining the group around September 2021. He acknowledged holding stolen data from multiple victims in the U.S. and abroad.

Oleksii Lytvynenko pleaded guilty to conspiracy to commit wire fraud for his role in the Conti ransomware operation. In September 2023, four other Conti conspirators were indicted in Tennessee.

“Lytvynenko pleaded guilty to wire fraud conspiracy on June 10. Evidence recovered from Lytvynenko’s online accounts showed he possessed data stolen from eight U.S. victims and four overseas victims. Lytvynenko further admitted to joining a team run by a Conti conspirator during which time Lytvynenko was directed to work on coding a “loader,” which is typically a type of malware, or malicious software, that is used to load programs necessary to execute other malicious attacks.” DoJ continues. “Forensic artifacts recovered at the time of his arrest in July 2023 in County Cork, Ireland, further demonstrated ongoing involvement in ransomware activity.”

Lytvynenko pleaded guilty in June to a single count of wire fraud conspiracy, a charge that carried a statutory maximum of 20 years, making the four-year sentence a fraction of what he legally could have received.

“Conti ransomware caused extraordinary harm, targeting victims across nearly every state and dozens of countries and disrupting critical operations for organizations across multiple industries,” said Assistant Director Brent Daniels of the U.S. Secret Service’s Office of Field Operations. “Today’s sentence is a measure of justice for the victims whose data, operations, and livelihoods were put at risk. It underscores the Secret Service’s commitment to pursuing ransomware actors and their networks wherever they operate and protecting the American people.”

The sentence adds to a broader US crackdown on ransomware. The Ransom Cartel creator recently received 16 years, while a Karakurt negotiator got 8.5 years. Lytvynenko’s four-year sentence may look lighter, but it still shows that US courts are pursuing ransomware criminals who operate from abroad.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Conti ransomware)

Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware.

Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target is CVE-2026-20079, a critical authentication bypass that lets unauthenticated attackers remotely bypass security controls, run scripts and potentially gain root access. Attackers also exploit CVE-2026-20316 to access sensitive data through a low-privilege account. The second flaw can be chained with other FMC vulnerabilities to increase privileges.

Cisco linked the attacks to ransomware operations, including Qilin, as well as state-sponsored activity.

“Talos’ analysis illustrates three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors, as described below.” reads the advisory. “The first cluster which we track as UAT-12197, involves the exploitation of CVE-2026-20079, leading to the deployment of web shells, a Java Archive (JAR)-based command executor, and credential exfiltration.”

Talos identified three attack clusters targeting Cisco Secure Firewall Management Center (FMC). The first cluster deploys JSP-based web shells and custom command executors into Tomcat webroot directories to query internal databases and harvest user authentication data and credentials.

“This cluster of activity involved the successful exploitation of CVE-2026-20079 and the subsequent placement of a malicious web shell in the CSM Tomcat webroot directory.” reads the report. “The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process:”

The second cluster, attributed to the advanced persistent threat actor UAT-11823 with tooling overlapping Sandworm, establishes Netcat reverse shells, harvests device configurations, and installs the modular ELF malware “Cyclops Blink” for persistent access, DNS over HTTPS resolution, and packet sniffing.

“The threat actor obtained initial access to compromised systems by either exploiting CVE-2026-20079 or via static credentials.” Talos states. “After obtaining access, UAT-11823 subsequently updated the “license.tmp” file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server:”

The third cluster involves Qilin ransomware operators (UAT-11988) who use static credentials for initial access, perform extensive domain reconnaissance, deploy SOCKS proxies and reverse-SSH tunnels, and execute AV killers before deploying ransomware.

“Once extensive reconnaissance was completed, the threat actor attempted to establish persistent network access into the victim organization using a Python SOCKS5 proxy (socks5.py) and a reverse-SSH tunnel from the FMC back to the attacker’s own remote host. The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report. “The threat actor conducted extensive probing of endpoints in the victim’s environment, deployed open-source tooling such as impacket, Invoke-TheHash, and custom-made AV killers — all followed by the deployment of the Qilin ransomware on selected endpoints.”

Cisco strongly urges customers to immediately apply released hotfixes and update detection rules using the provided Snort SIDs while awaiting upcoming comprehensive security hardening updates.

CISA added CVE-2026-20079 to its KEV catalog, requiring U.S. federal agencies to patch it by September 12, 2026. CVE-2026-20316 was added in late July.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco FMC)