Ransomware campaigns, extortion economics, and the tradecraft that drives them — from LOLBin-heavy intrusions to bespoke encryptors. Coverage of individual crews (Anubis, BlueHammer, Kairos, Lynx, Avalon/CrownX, JadePuffer, Inc/Lynx) sits alongside the class-level tactics that outlive any one brand. Combined article + CVE feed for the Ransomware beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-17-clop-ransomware-ge-philips-data-theft/https://0daynews.com/articles/2026-08-17-clop-ransomware-ge-philips-data-theft/General Electric and Philips confirm they are investigating data theft claims from the Clop ransomware gang. Neither company has confirmed exfiltration scope, affected systems, or breach date.Mon, 17 Aug 2026 14:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-08-14-shell-clop-89gb-data-theft-claim/https://0daynews.com/articles/2026-08-14-shell-clop-89gb-data-theft-claim/Shell confirms investigating a potential incident after Clop listed the oil giant on its extortion site, claiming 89GB of exfiltrated data. No breach confirmed; initial access vector undisclosed.Fri, 14 Aug 2026 14:30:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-08-13-akira-edr-safe-mode-bypass-data-theft/https://0daynews.com/articles/2026-08-13-akira-edr-safe-mode-bypass-data-theft/An Akira ransomware affiliate rebooted a compromised host into Safe Mode to kill EDR, exfiltrated data, then failed to encrypt. The exfiltration is the real threat.Thu, 13 Aug 2026 22:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-08-12-colombia-justice-ministry-ransomware/https://0daynews.com/articles/2026-08-12-colombia-justice-ministry-ransomware/Ransomware disrupted Colombia's Ministry of Justice days before the presidential transition, part of a documented pattern of attacks on Latin American government institutions.Wed, 12 Aug 2026 22:30:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-08-12-hospital-ransomware-facebook-hijack/https://0daynews.com/articles/2026-08-12-hospital-ransomware-facebook-hijack/Ransomware attackers hijacked a hospital system's Facebook page during an active breach, claiming 6TB including mental health, abortion, and sexual assault records.Wed, 12 Aug 2026 06:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-08-12-deadlock-ransomware-blockchain-polygon/https://0daynews.com/articles/2026-08-12-deadlock-ransomware-blockchain-polygon/DeadLock ransomware has shifted victim comms and data-leak ops to Polygon smart contracts and Session messaging to resist law enforcement seizures.Wed, 12 Aug 2026 04:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-08-11-storm-1175-stormencryptor-ransomware-china-linked/https://0daynews.com/articles/2026-08-11-storm-1175-stormencryptor-ransomware-china-linked/Microsoft's threat intel team links China-backed Storm-1175 to StormEncryptor, a new C++ ransomware. MSPs on unpatched N-central are in the likely blast radius.Tue, 11 Aug 2026 12:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-08-11-gunra-ransomware-fbi-advisory/https://0daynews.com/articles/2026-08-11-gunra-ransomware-fbi-advisory/FBI, CISA, and South Korea warn Gunra ransomware is exploiting two KEV-listed Fortinet firewall flaws to hit healthcare, finance, and critical infrastructure.Tue, 11 Aug 2026 04:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-30-teams-vishing-chaos-ransomware-north-america/https://0daynews.com/articles/2026-07-30-teams-vishing-chaos-ransomware-north-america/Microsoft Teams vishing campaign impersonates IT support, gains remote access, and drops Chaos ransomware on North American organizations.Thu, 30 Jul 2026 19:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-29-shinyhunters-health-isac-healthcare-sso-warning/https://0daynews.com/articles/2026-07-29-shinyhunters-health-isac-healthcare-sso-warning/Health-ISAC warns healthcare orgs of rising ShinyHunters attacks using SSO social engineering to compromise cloud accounts and steal data.Wed, 29 Jul 2026 19:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-27-coca-cola-fairlife-data-theft-confirmed/https://0daynews.com/articles/2026-07-27-coca-cola-fairlife-data-theft-confirmed/Eleven days after the initial 8-K, Coca-Cola confirms hackers stole data from Fairlife in the ransomware attack. Volume and categories remain undisclosed.Mon, 27 Jul 2026 17:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-27-shinyhunters-claims-ey-breach-supply-chain/https://0daynews.com/articles/2026-07-27-shinyhunters-claims-ey-breach-supply-chain/ShinyHunters has claimed responsibility for the Ernst & Young breach first disclosed July 17, attributing entry to a supply-chain attack on EY systems.Mon, 27 Jul 2026 16:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-25-shinyhunters-breach-data-sextortion-2000-bitcoin/https://0daynews.com/articles/2026-07-25-shinyhunters-breach-data-sextortion-2000-bitcoin/Threat actors are targeting email addresses from ShinyHunters data leaks with $2,000 Bitcoin sextortion demands. What the campaign looks like and what to do.Sat, 25 Jul 2026 15:30:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-25-devman-raas-funky-mantis-affiliate-portal/https://0daynews.com/articles/2026-07-25-devman-raas-funky-mantis-affiliate-portal/PRODAFT documents DevMan RaaS — tracked as Funky Mantis — operating a unified portal for payload builds, victim management, and affiliate payouts.Sat, 25 Jul 2026 13:05:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-24-clop-windchill-flexplm-cve-2026-12569-data-theft/https://0daynews.com/articles/2026-07-24-clop-windchill-flexplm-cve-2026-12569-data-theft/Clop is exploiting CVE-2026-12569 in exposed PTC Windchill and FlexPLM instances for data theft. Unpatched and internet-facing — take it offline now.Fri, 24 Jul 2026 09:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-23-chaos-ransomware-msarat-browser-c2-webrtc-airgap/https://0daynews.com/articles/2026-07-23-chaos-ransomware-msarat-browser-c2-webrtc-airgap/The Chaos group's new msaRAT backdoor routes C2 through Chrome or Edge via WebRTC TURN relay, hiding attacker infrastructure behind the browser process.Thu, 23 Jul 2026 11:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-22-stadler-rail-everest-ransom-rejected/https://0daynews.com/articles/2026-07-22-stadler-rail-everest-ransom-rejected/Stadler Rail refused a $12.3M ransom from the Everest group after a supplier data exchange platform was compromised in mid-July 2026.Wed, 22 Jul 2026 17:30:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-21-anubis-fairlife-1tb-nutanix-claim-declines-comment/https://0daynews.com/articles/2026-07-21-anubis-fairlife-1tb-nutanix-claim-declines-comment/Anubis ransomware has claimed the July 16 Coca-Cola Fairlife attack, alleging ~1TB stolen and full Nutanix encryption. Coca-Cola declined to comment; BleepingComputer could not verify.Tue, 21 Jul 2026 20:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-20-jadepuffer-encforge-ai-asset-ransomware-model-weights-vector-dbs/https://0daynews.com/articles/2026-07-20-jadepuffer-encforge-ai-asset-ransomware-model-weights-vector-dbs/Sysdig's Threat Research Team says the agentic operator it named JADEPUFFER has upgraded from generic database encryption to a custom Go ransomware, EncForge, that specifically targets AI model checkpoints, vector databases, and training data.Mon, 20 Jul 2026 23:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-18-abbott-shinyhunters-vishing-exact-sciences-labcentral-disputed/https://0daynews.com/articles/2026-07-18-abbott-shinyhunters-vishing-exact-sciences-labcentral-disputed/ShinyHunters used vishing to hit legacy Exact Sciences systems in Abbott's Cancer Diagnostics business; a separate LabCentral extortion claim by ShadowByt3$ is disputed.Sat, 18 Jul 2026 14:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-16-coca-cola-fairlife-ransomware-sec-8k-us-production-halt/https://0daynews.com/articles/2026-07-16-coca-cola-fairlife-ransomware-sec-8k-us-production-halt/Coca-Cola disclosed a Fairlife ransomware attack via SEC 8-K on July 16. US dairy production suspended, Canada unaffected. No group has claimed it.Thu, 16 Jul 2026 22:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-16-symantec-spirals-ransomware-iis-webshell-24h-south-asia/https://0daynews.com/articles/2026-07-16-symantec-spirals-ransomware-iis-webshell-24h-south-asia/Symantec documents Spirals, a new ransomware family: IIS web-shell entry to a fully encrypted network in under 24 hours — one confirmed victim so far, an IT services firm in South Asia.Thu, 16 Jul 2026 11:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-15-doj-media-land-yalishanda-lockbit-blacksuit-play-bulletproof-hosting-indictment/https://0daynews.com/articles/2026-07-15-doj-media-land-yalishanda-lockbit-blacksuit-play-bulletproof-hosting-indictment/USAO-NDOH unsealed a Dec 2024 indictment against Volosovik ('Yalishanda'), Pankova, and Zatolokin — Media Land and ML.Cloud hosted LockBit, BlackSuit, Play. $62M losses, 21 states.Wed, 15 Jul 2026 10:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-14-ofac-1vpns-rashevskyi-silayev-sb0559-cryptor-designation/https://0daynews.com/articles/2026-07-14-ofac-1vpns-rashevskyi-silayev-sb0559-cryptor-designation/OFAC designated 1VPNS, its Ukrainian admin Rashevskyi, and Belarusian cryptor seller Silayev on July 14 — the follow-on to May's Operation Saffron seizure.Tue, 14 Jul 2026 11:20:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-10-vardanyan-ryuk-guilty-plea-portland-six-year-pipeline/https://0daynews.com/articles/2026-07-10-vardanyan-ryuk-guilty-plea-portland-six-year-pipeline/Karen Vardanyan pleaded guilty in Portland to Ryuk-era conspiracy charges from 2019-2020. Sentencing is set for September. A note on how long the pipeline actually takes.Fri, 10 Jul 2026 19:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-10-digitalmint-martino-70-months-blackcat-insider-negotiation/https://0daynews.com/articles/2026-07-10-digitalmint-martino-70-months-blackcat-insider-negotiation/Angelo Martino, ex-DigitalMint IR employee, sentenced to 70 months for feeding BlackCat victims' insurance limits and negotiation floors. An old failure mode.Fri, 10 Jul 2026 09:20:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-09-goddamn-ransomware-poisonx-driver-beast-rebrand/https://0daynews.com/articles/2026-07-09-goddamn-ransomware-poisonx-driver-beast-rebrand/Symantec attributes a new family, GodDamn, as a Beast rebrand shipping the PoisonX driver (g11.sys) — a Microsoft-signed kernel BYOVD used to neutralize endpoint defenses.Thu, 09 Jul 2026 13:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-08-mount-royal-university-cmd-organization-30-btc-breach/https://0daynews.com/articles/2026-07-08-mount-royal-university-cmd-organization-30-btc-breach/Mount Royal University confirms a June 17 intrusion exfiltrated H drive data. A group calling itself CMD demands 30 BTC before the stated leak deadline.Wed, 08 Jul 2026 22:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-04-kairos-1m-extortion-payment-us-government-ransom-isac/https://0daynews.com/articles/2026-07-04-kairos-1m-extortion-payment-us-government-ransom-isac/Ransom-ISAC's new case study confirms a ~$1M payment (9.44 BTC) to the Kairos crew on June 13, 2025. Krishnan's review found no encryption at any point — data-theft extortion only, tracked in ransomware feeds anyway.Sat, 04 Jul 2026 15:35:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-04-avalon-crownx-modular-malware-framework/https://0daynews.com/articles/2026-07-04-avalon-crownx-modular-malware-framework/Blackpoint Cyber says the previously undocumented Avalon framework combines credential theft, EDR-aware defense evasion, shadow-copy destruction, and the CrownX ransomware payload in one multi-stage phishing chain.Sat, 04 Jul 2026 08:00:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-03-fortibleed-inc-lynx-ransomware-attribution/https://0daynews.com/articles/2026-07-03-fortibleed-inc-lynx-ransomware-attribution/The Hacker News reports an operator behind FortiBleed's credential-theft infrastructure was seen running ransomware negotiation panels for both INC and Lynx. Not a resale ring — a pipeline.Sat, 04 Jul 2026 02:30:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-03-sysdig-jadepuffer-ai-agent-langflow-ransomware/https://0daynews.com/articles/2026-07-03-sysdig-jadepuffer-ai-agent-langflow-ransomware/Sysdig's Threat Research Team says JADEPUFFER is the first ransomware incident it has observed where an AI agent handled entry, credential theft, lateral movement, and destruction end-to-end. Initial access was a Langflow code-execution flaw.Fri, 03 Jul 2026 21:15:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-03-avalon-crownx-modular-malware-framework/https://0daynews.com/articles/2026-07-03-avalon-crownx-modular-malware-framework/Blackpoint Cyber documents Avalon, a previously undocumented modular framework whose ransomware payload — CrownX — arrives at the end of a legal-lure phishing chain that stages through Proton Drive, ISO, LNK, and MSBuild.Fri, 03 Jul 2026 20:20:00 GMTRansomwarearticlehttps://0daynews.com/articles/2026-07-03-anubis-ransomware-citrix-bleed-2-cve-2025-5777/https://0daynews.com/articles/2026-07-03-anubis-ransomware-citrix-bleed-2-cve-2025-5777/The Hacker News reports Anubis-ransomware affiliates using Citrix Bleed 2 (CVE-2025-5777) to breach NetScaler-fronted environments, then pivoting with legit RMM, BYOVD, and stolen supply-chain credentials.Fri, 03 Jul 2026 16:00:00 GMTRansomwarearticle