ransomware

Theo báo cáo của Đài Truyền hình Trung ương Trung Quốc, Trung tâm Xử lý Khẩn cấp Virus Máy tính Quốc gia và Phòng thí nghiệm Kỹ thuật Quốc gia về Công nghệ Phòng chống Virus Máy tính gần đây đã phát hiện nhiều vụ tấn công virus mã hóa "Weaxor" đối với người dùng trong nước dựa trên nền tảng phân tích hợp tác virus máy tính quốc gia.Sau khi các tệp quan trọng của người dùng bị mã hóa, tên tệp sẽ được đổi thành tên tệp gốc cộng với hậu tố ".weax". Kẻ tấn công để lại thư đòi tiền chuộc trên máy chủ, yêu cầu người dùng liên hệ và trả tiền chuộc.

Một thành viên cốt cán 28 tuổi mang quốc tịch Nga của băng nhóm ransomware nổi tiếng toàn cầu Qilin đã bị bắt tại Nhật Bản và đã được dẫn độ hợp pháp sang Đức vào ngày 2 tháng 10. Các báo cáo cho biết, người đàn ông này bị cáo buộc đã xâm nhập trái phép vào hệ thống của một công ty logistics ở Đức vào tháng 9 năm 2024 và mã hóa dữ liệu, yêu cầu và tống tiền khoảng 165.000 USD (khoảng 26 triệu yên Nhật) bằng Bitcoin.Cuộc điều tra cho thấy, anh ta chịu trách nhiệm xây dựng hệ thống tấn công trong mạng lưới tội phạm Qilin và nhận hoa hồng từ tiền chuộc mà các đội thực hiện ở các chi nhánh thu được. Cảnh sát Nhật Bản đã kiểm soát anh ta vào cuối tháng 5 năm nay khi anh ta đang du lịch đến Osaka, sau đó đã được chuyển giao cho phía Đức sau khi Tòa án tối cao Tokyo xác định đủ điều kiện. Qilin hoạt động theo mô hình "ransomware-as-a-service" (RaaS) và trước đó đã tuyên bố chịu trách nhiệm về cuộc tấn công mạng nhằm vào Tập đoàn Asahi Nhật Bản vào năm 2025.

Theo báo cáo của Decrypt, theo thông báo của Tổ chức Cảnh sát Hình sự Châu Âu, cảnh sát Tây Ban Nha đã bắt giữ một nghi phạm 16 tuổi mang quốc tịch Romania tại Alicante, nghi ngờ người này là quản trị viên và người điều hành chính của băng nhóm phần mềm độc hại KillSec.Hai nghi phạm khác trong độ tuổi hai mươi đã bị bắt giữ tại Anh và Romania; còn một nhà phát triển vừa tròn 18 tuổi vào tháng 8 năm nay đã bị xác định danh tính, nhưng do một số tội phạm xảy ra trong thời gian chưa đủ tuổi nên chưa bị bắt.Chiến dịch này có tên mã là Operation KillSwitch, do Cảnh sát Hình sự bang Hamburg của Đức và cơ quan công tố thành phố dẫn đầu, tập trung vào khoảng 1000 vụ tấn công nghi ngờ trên toàn cầu, hiện đã xác nhận khoảng 500 vụ là xâm nhập thành công.Các nhân viên thực thi pháp luật đã khám xét tám địa điểm ở Tây Ban Nha, Hy Lạp, Romania và Anh, kiểm soát năm máy chủ trung tâm và chuyển hướng các tên miền liên quan đến trang thông báo bị niêm phong, đồng thời thu giữ ít nhất 110 TB dữ liệu bị đánh cắp.KillSec hoạt động từ khoảng năm 2024, thông qua việc khai thác lỗ hổng phần mềm và các điểm lưu trữ đám mây có bảo mật kém để xâm nhập vào hệ thống doanh nghiệp, sao chép dữ liệu nội bộ và công khai các tổ chức bị ảnh hưởng trên các trang web rò rỉ trên dark web, đe dọa yêu cầu tiền chuộc bằng tiền điện tử, nếu bên kia từ chối thì sẽ phát tán dữ liệu miễn phí.Cảnh sát Liên bang Thụy Sĩ chỉ ra rằng băng nhóm này còn sử dụng phương pháp tống tiền kép, trước tiên mã hóa máy chủ rồi mới gây áp lực. Cáo buộc của công tố viên Mỹ cho thấy, một người mang quốc tịch Hà Lan sống tại Anh là Fouad Eltibrizi (biệt danh Archduke) đã bị một đại bồi thẩm đoàn liên bang Puerto Rico truy tố vào ngày 16 tháng 9, sau đó bị bắt và đang chờ dẫn độ, có thể đối mặt với án tù lên đến 10 năm. Trung tâm Tội phạm mạng Châu Âu thuộc Tổ chức Cảnh sát Hình sự Châu Âu đang hỗ trợ trong việc truy tìm nguồn gốc tiền điện tử và công tác điều tra số.

ChainCatcher thông báo, theo báo cáo của CCTV, gần đây, Trung tâm Xử lý Khẩn cấp Virus Máy tính Quốc gia và Phòng thí nghiệm Kỹ thuật Quốc gia về Phòng chống Virus Máy tính dựa trên Nền tảng Phân tích Hợp tác Virus Máy tính Quốc gia (https://virus.cverc.org.cn) đã phát hiện nhiều sự kiện người dùng bị tấn công bởi virus mã hóa "Sorry" trong lãnh thổ của chúng ta. Sau khi các tệp quan trọng của người dùng bị mã hóa, tên tệp sẽ được thay đổi thành tên tệp gốc + chuỗi đuôi .sorry, kẻ tấn công còn để lại thư đòi tiền trên máy chủ của người dùng, yêu cầu người dùng tải xuống công cụ liên lạc mã hóa để liên lạc với họ.

According to Decrypt, a former Ukrainian police officer kidnapped a cryptocurrency entrepreneur and extorted approximately $2.2 million through violence, intimidation, and false debt claims. Prosecutors stated that the gang targeted at least four victims and committed crimes using law enforcement methods, official vehicles, and impersonating police officers. The Kyiv regional prosecutor's office announced that the pre-trial investigation has been completed, and the gang includes four former police officers and one previously convicted civilian, but none of them have been formally charged for these attacks yet. This case comes amid a global surge in "ransomware attacks" in the cryptocurrency space, where criminals use violent coercion to steal digital assets.

Bitcoin mining company MARA Holdings allocated approximately $4.3 million for CEO Fred Thiel's personal security expenses in fiscal year 2025, which includes $430,780 for vehicle bulletproof modifications, as well as expenses for bodyguards and residential security facilities. According to documents submitted to the U.S. SEC, MARA also provided approximately $3.9 million in security expenses for CFO Salman Khan, including $438,380 for vehicle bulletproof costs.Reports indicate that as incidents of "ransom attacks" targeting executives and investors in the crypto industry increase, crypto companies are significantly ramping up their investment in executive physical security. The so-called "ransom attack" typically refers to forcing victims to hand over private keys or account access through kidnapping, violence, or coercion. Data shows that in 2025, there were 72 confirmed incidents of crypto-related entity coercion globally, a year-on-year increase of 75%. Among these, France recorded 19 incidents, the highest in the world.

The open-source data visualization tool Grafana stated on platform X that it recently discovered an unauthorized attacker had obtained a token that could access the Grafana Labs GitHub environment and used it to download the code repository.An investigation confirmed that this incident did not involve customer data or personal information leakage, and no impact on customer systems or business operations was found. After the incident, forensic analysis was immediately initiated, and it is believed that the source of the credential leak has been identified. Additional security measures have also been deployed to strengthen environmental protection.Furthermore, Grafana disclosed that the attacker attempted to demand a ransom to prevent the code repository from being made public, but the company ultimately decided to refuse to pay the ransom and will release more information about the incident review after the investigation is completed.

A 27-year-old German hacker, Noah Christopher, was arrested in Bangkok, Thailand, facing up to 74 arrest warrants for cyber crimes in Europe.Investigations show that this individual is suspected of developing and operating a ransomware platform and a "cybercrime-as-a-service" (CaaS) system between 2021 and 2025, including providing distributed denial-of-service (DDoS) attack tools (such as Fluxstress and Neldowner), assisting global clients in launching cyber attacks and charging fees, with related ransom payments involving cryptocurrencies and other digital assets, constituting transnational cybercrime activities. His visa has been revoked, and he is currently detained awaiting extradition to Germany.

Renowned on-chain investigator ZachXBT released a report today stating that a Russian over-the-counter (OTC) broker named Aleksandr (Aleks) Khinkis is suspected of assisting ransomware groups in laundering over $4.7 million since 2025 through a single cryptocurrency trading platform account.The related funds involve three suspicious ransom payments, totaling approximately 796 bitcoins (BTC). The investigation shows that these funds were transferred in batches to his trading platform's deposit address (0xa756) after being bridged between Bitcoin and Avalanche, completing a total of 75 transactions from 2025 to 2026. Additionally, approximately $16.6 million is currently still held in Aave and is being gradually liquidated.ZachXBT pointed out multiple ransom transactions: a ransom payment of about 72 BTC in September 2025 was bridged to the related address; a ransom of about 164 BTC was also discovered in October 2025 and converted to approximately $3.8 million. Some related addresses were blacklisted by Tether in November 2025, and the subsequently frozen USDT was destroyed three weeks ago, indicating that law enforcement and compliance agencies have intervened.Earlier in 2023, this account was also involved in a ransom transaction of about 560 BTC, which was circulated through multiple intermediary addresses and trading platforms before being bridged back to the Avalanche network in 2024. Furthermore, the investigation pointed out that the source addresses of the related bitcoins have a high correlation with multiple ransomware addresses, suspected of serving as payment transit nodes. Although some funds remain dormant, ZachXBT warned that they may still be laundered in the future and urged victims to report related addresses promptly to freeze the funds.

According to Criptonoticias, the city government of Sanxenxo in the Galicia region of Spain suffered a ransomware attack, with hackers encrypting thousands of administrative documents and blocking system access, demanding a ransom of $5,000 in Bitcoin.The attack occurred on January 26, causing the municipal servers to completely crash, affecting the operation of essential services in the city, which has over 17,000 residents. The city government has reported the incident to the Spanish Civil Guard, refused to pay the ransom, and stated that it is enabling daily backups to restore the system.

According to a report by Le Parisien, the French cryptocurrency tax reporting platform Waltio announced that it has been extorted by a hacker group called "Shiny Hunters." The group claims to have obtained personal data of approximately 50,000 customers of the platform, most of whom are located in France, and is demanding a ransom for it.Waltio is a company that provides portfolio tracking and tax calculation services for cryptocurrency holders. The company stated that it has reported the incident of "attempted extortion and disruption of automated data processing systems" to the police. The report noted that the hackers allegedly obtained the relevant customers' email and account balance information as early as 2024.

According to Cointelegraph, researchers from the cybersecurity company Group-IB have discovered a ransomware called "DeadLock" that is using Polygon smart contracts to hide itself and rotate proxy addresses.This ransomware was first identified in July last year, and it dynamically updates the command and control infrastructure addresses used to communicate with victims by invoking specific smart contracts. Once a victim is infected and data is encrypted, DeadLock issues a ransom note threatening to sell the stolen data if demands are not met.Researchers pointed out that storing proxy addresses on-chain makes its infrastructure extremely difficult to dismantle, as there is no central server that can be shut down, and blockchain data is permanently retained across global nodes. This method of abusing smart contracts to relay proxy addresses is highly variable. Although DeadLock currently has low exposure and a limited number of known victims, its novel attack techniques still pose a potential threat to organizations that do not take it seriously.

According to monitoring by Group-IB, the ransomware family DeadLock is using Polygon smart contracts to distribute and rotate proxy server addresses to evade security detection.This malware was first discovered in July 2025, embedding JS code that interacts with the Polygon network within HTML files, using an RPC list as a gateway to obtain server addresses controlled by the attacker. This technique is similar to the previously discovered EtherHiding, aiming to leverage decentralized ledgers to construct covert communication channels that are difficult to block. DeadLock currently has at least three variants, with the latest version also embedding the encrypted communication application Session to directly communicate with victims.

According to the U.S. Department of Justice, two American men have pleaded guilty to attacking multiple targets in the U.S. using ALPHV BlackCat ransomware.Ryan Goldberg (40) from Georgia and Kevin Martin (36) from Texas admitted to deploying ALPHV BlackCat ransomware between April and December 2023. Both are professionals in the cybersecurity industry, and they, along with another accomplice, paid 20% of the ransom as a cut to the ALPHV BlackCat administrator to gain access to the ransomware. After successfully extorting approximately $1.2 million in Bitcoin from one victim, the three split 80% of the ransom and laundered it through various means.The two defendants are scheduled to be sentenced on March 12, 2026, and could face up to 20 years in prison.

According to The Hacker News, the Qilin ransomware group launched a "Korean Leaks" supply chain attack by breaching the South Korean IT service provider GJTec, resulting in 28 financial companies being affected and over 1 million files totaling 2 TB of data being stolen.Bitdefender's investigation found that this operation is linked to the North Korean-backed APT "Moonstone Sleet," suspected of collaborating with the Russian-speaking Qilin group, aiming to exert pressure on the South Korean financial market.

ChainCatcher news, according to Bitcoin News, the ransomware group "Rhysida" has stolen sensitive data from the Maryland Department of Transportation and is auctioning this data for 30 bitcoins (approximately 3.4 million USD).

ChainCatcher news, Replit CEO stated that North Korean IT remote workers (ITW) are using AI tools to secure remote jobs in the U.S., generating hundreds of millions of dollars for North Korea. On this, blockchain detective ZachXBT responded that North Korean IT remote workers are involved in at least 25 hacking or ransom incidents targeting companies in the cryptocurrency industry. The affected companies are all enterprises in the crypto field.

ChainCatcher news, according to the U.S. Department of Justice, British citizen Thalha Jubair has been charged for participating in at least 120 cyber intrusions and ransomware attacks involving 47 U.S. entities, with a total ransom paid by victims exceeding $115 million.The indictment alleges that 19-year-old Jubair (also known by aliases "EarthtoStar," "Brad," "Austin," etc.) collaborated with a cybercrime group known as "Scattered Spider" to gain unauthorized network access through social engineering techniques, steal and encrypt information, and then extort ransom from victims. The group also targeted U.S. critical infrastructure companies and the U.S. court system. Law enforcement successfully seized approximately $36 million in cryptocurrency when they shut down servers in July 2024. Jubair faces multiple charges including computer fraud, telecommunications fraud, and money laundering, with a maximum sentence of 95 years in prison.

ChainCatcher News, the U.S. Department of Justice announced that after unsealing six search warrants in federal courts in Virginia, California, and Texas, over $2.8 million in cryptocurrency, $70,000 in cash, and a luxury car were seized. These assets are allegedly related to the ransomware proceeds laundered by Ianis Aleksandrovich Antropenko, who is currently facing charges in the Northern District of Texas.According to the indictment, Antropenko and his associates deployed Zeppelin ransomware to infiltrate victim systems, encrypt data, and steal information, subsequently demanding ransom payments in exchange for decrypting files, preventing leaks, or deleting stolen data. Victims include individuals, businesses, and institutions both domestically and internationally.The search warrants reveal that Antropenko laundered the ransom proceeds through various channels, including the use of ChipMixer—a cryptocurrency mixing service that was dismantled in 2023 by an international law enforcement operation. He also converted cryptocurrency into cash and made incremental deposits into accounts to evade regulation.

ChainCatcher news, according to Decrypt, Texas authorities announced the seizure of $2.8 million in cryptocurrency, $70,000 in cash, and a luxury car from alleged ransomware operator Ianis Antropenko. Antropenko is accused of using Zeppelin ransomware to attack global targets.Data shows that in 2024, losses from cryptocurrency-related crimes in the U.S. reached $9.3 billion, a 66% increase year-on-year. The Department of Justice's Cyber Crime Division stated that it has recovered a total of $350 million in victim funds and prevented over $200 million in potential ransom payments.