Hospital Clínico Universidad de Chile in CL was targeted by the direwolf ransomware threat actor, leading to disruption of hospital operations and encrypted data. The incident impacted #Chile
Erdem Hospital in Turkey was targeted by the direwolf threat actor with ransomware, resulting in disruption to hospital operations and access to critical systems. The incident impacted hospital services across Turkey #Turkey
THQ Nordic in Sweden reported a ransomware incident allegedly orchestrated by direwolf, impacting its Multimedia, Games, and Graphics Software operations. The attack disrupted availability and operations across the organization, with effects concentrated in #Sweden
Multiple malicious Google Chrome and Microsoft Edge extensions were used to deliver a highly extensible malware framework that stole cryptocurrency, sensitive data, and browser history while also injecting ClickFix lures. Socket says the campaign may have been active since early 2024, with one extension, “Enable Right Click & Copy — Smart Unlock + OCR,” reaching at least 70,000 Chrome users before removal. #Chrome #MicrosoftEdge #Socket #EnableRightClickCopySmartUnlockOCR #Ledger #Trezor #Coinbase #Binance #Kraken #OKX #MEXC #KuCoin #Bybit #MetaMask
The City of Tarnos was hit by a ransomware attack targeting its Zimbra email service, with Mayor Marc Mabillet confirming both the intrusion and a ransom demand. Authorities have suspended the server and are investigating the incident with ALPI, while the possible theft of personal and sensitive data remains under review. #VilledeTarnos #Zimbra #Alpi #MarcMabillet
Winona County paid $128,539.57 to resolve a ransomware attack detected on Jan. 22 after engaging forensic experts, law enforcement, and its insurance carrier. Officials are now investigating a separate ransomware incident from April and reviewing affected data to determine whether residents’ personal information was exposed. #WinonaCounty
The City of Norcross identified a ransomware incident that occurred on August 1, 2026, and affected certain computer systems. The City engaged cybersecurity professionals and law enforcement, and while most services remain operational, some disruptions may continue as restoration efforts and security improvements progress. #CityofNorcross
Northwest Trophy (nwtrophy.com), a US-based, fourth-generation awards business in Woodinville, Washington, was targeted by the ransomware threat actor thegentlemen. The company is impacted in #UnitedStates.
Threat actor “thegentlemen” allegedly exfiltrated 531+ GB of NDA files, HR and employee data, technical drawings/models, bank statements, tax/legal documents, confidential materials, passport scans, VIP client data, and more from G R Infraprojects in India. The breach claim impacts #India
The ransomware claim alleges that threat actor thegentlemen targeted Glassdoor (glassdoor.com), a major U.S. employment and company-review platform owned by Recruit Holdings/Indeed, to disrupt access to its services. The platform underpins millions of anonymous employee reviews, salary data, and job listings, with an annual “Best Places to Work” program, impacting U.S.-based operations and users. #UnitedStates
Microsoft has detailed TerminalFix, a new ClickFix variant that tricks victims into running malicious commands in Windows Terminal or PowerShell through fake Cloudflare CAPTCHA pages on compromised websites. The attack uses DLL sideloading, steganographic payload extraction, Active Directory reconnaissance, and a custom reverse-tunnel implant to maintain persistent access and move deeper…
AUM Construction in the US reported a ransomware incident attributed to the Qilin threat actor, resulting in disruption and encrypted files. The attack impacted operations across the United States. #UnitedStates
There were 3 defacement incidents attributed to TeaM_CC, targeting sites in India and Ukraine. The attackers involved were TeaM_CC, and the affected countries were India and Ukraine. #India #Ukraine…
ITC Properties Group Limited in Hong Kong, reported a ransomware incident attributed to the Orova threat actor, impacting its operations and data security. The group is an investment holding company focused on property development, sales, and investments across Macau, Hong Kong, the PRC, and Canada, with additional securities and loan financing services; #HongKong #Macau #People’sRepublicofChina #Canada
In Mexico (MX), the incransom ransomware threat actor gained unauthorized access to Wittmann’s confidential files, including client data, proprietary R&D, and financial documentation, and then targeted NDA files. #Mexico