Dark Project, an emerging financially motivated ransomware operation, has claimed 38 victims across eight countries in the supplied threat intelligence snapshot, with manufacturing and healthcare bearing the heaviest exposure. The group combines data theft, system encryption, and public disclosure threats with an affiliate program designed to scale intrusions. The figures represent allegations published through criminal […]

The post Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

HYFLOCK ransomware operators have developed successive Windows encryptors that lock files, access network shares, and attempt to obstruct recovery, while implementation flaws create sharply different outcomes for victims. The investigation distinguishes demonstrated functionality from promotional claims. Although researchers confirmed encryption and scheduled-task registration, they did not establish successful domain-wide propagation or reliable execution after remote […]

The post Hackers Develop New HYFLOCK Ransomware That Encrypts Files and Attempts to Block Recovery appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately.

A security fix released in 2024 is now at the centre of ransomware attacks against Synology NAS devices. The company has found attackers targeting systems that still run outdated versions of DiskStation Manager (DSM), putting files stored on these network storage devices at risk of encryption and extortion.

Synology disclosed the attacks on October 29, 2026. Its investigation found that threat actors are taking advantage of a vulnerability that the vendor had already addressed in December 2024. “These attacks aim to encrypt data and extort ransom.” The warning highlights how devices left without security updates can remain exposed long after vendors have released a fix.

The company hasn’t identified the exact vulnerability used in the attacks. Instead, it refers customers to Synology-SA-24:20, a security advisory published on November 5, 2024, which documents three flaws affecting DSM. The advisory was updated as fixes became available across different software branches, with the DSM 6.2 update released on December 5.

The three vulnerabilities have different security implications. CVE-2024-10441 is the most severe, with a CVSS score of 9.8. It affects the system plugin daemon and could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable device.

CVE-2024-50629 has a CVSS score of 5.3 and affects the DSM webapi component. It could allow remote attackers to read limited files. The third issue, CVE-2024-10445, is rated 4.3 and concerns improper certificate validation in the update functionality. It could allow an attacker in an adjacent network position to write limited files.

Synology hasn’t confirmed which of these vulnerabilities attackers are exploiting. The three flaws should therefore be considered part of the security advisory, not three confirmed entry points in the current ransomware campaign.

The vendor has released corrected builds for all the affected DSM branches. Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory:

• DSM 7.2.2: 7.2.2-72806-1 or later.
• DSM 7.2.1: 7.2.1-69057-6 or later.
• DSM 7.2: 7.2-64570-4 or later.
• DSM 7.1: 7.1.1-42962-7 or later.
• DSM 6.2: 6.2.4-25556-8 or later.

The impact of a ransomware infection on a NAS can extend well beyond the storage device itself. Businesses often use these systems to keep shared documents, operational files and backup copies in one place. If attackers encrypt that data, employees may lose access to essential information, while recovery can become much harder if the NAS also holds the backups needed to restore other systems.

Updating DSM is therefore an immediate priority for administrators and home users alike. Synology is also advising customers to enable automatic updates so that future security fixes don’t depend entirely on someone checking for them manually.

“Synology also recommends enabling automatic updates to keep DSM up to date at all times.” concludes the advisory.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, NAS)

A ransomware affiliate known as 3AM compromised a UK school network using a mix of traditional intrusion techniques and patterns suggesting the involvement of artificial intelligence. According to Bitdefender’s investigation on November 3, this operation appears to follow a suspected hybrid workflow: a human operator selects the targets while a language model may handle repetitive […]

The post 3AM Ransomware Hackers Use AI-Assisted Attacks to Breach UK Schools and Spread Across Windows Domains appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The National Institute of Standards and Technology (NIST) released new cybersecurity guidance to help solo business owners protect themselves against threats like phishing, ransomware, and account compromise. Published on November 2, 2026, NIST Cybersecurity White Paper 50 simplifies the Cybersecurity Framework 2.0 and offers practical actions for businesses with limited IT infrastructure. The publication, Small […]

The post NIST Releases New Cybersecurity Guidelines to Protect Small Businesses From Phishing and Ransomware Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A widespread Synology NAS ransomware wave targets exposed devices via patched DSM vulnerabilities. Update firmware immediately to prevent encryption.

Related Posts:

• NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks
• Rust Doorway Botnet Exploits Routers, Cameras, and Servers
• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace

The post Synology NAS Ransomware Targets Unpatched Devices appeared first on Daily CyberSecurity.

Synology NAS devices are facing C3RB3R ransomware attacks linked to 2024 security flaws, prompting the company to urge users to update outdated DiskStation Manager versions and packages.

The warning followed reports from the 360 Security Team and Solar Emergency Response Team on October 29. Victims found their files encrypted with the .L0CK3D extension and a ransom note named read-me3.txt.

Security teams provisionally identified the ransomware as C3RB3R. The available reporting does not establish how many devices have been compromised.

The Synology security advisory, tracked as Synology-SA-24:20, covers three vulnerabilities disclosed following Pwn2Own 2024. Published on November 5, 2024, it received several updates as fixes became available across DSM branches.

Although Appinn described the weaknesses as fixed by December 2024, Synology’s revision history shows that several patches arrived during November.

Cyber Security News previously examined the critical CVE-2024-10441 flaw in Synology DSM, which carries a CVSS score of 9.8 and allows unauthenticated remote code execution without user interaction.

Synology NAS Hit by C3RB3R Ransomware Attacks

The advisory also lists CVE-2024-50629, a webapi flaw that lets remote attackers read limited files, and CVE-2024-10445. This update certificate validation flaw lets an adjacent attacker write limited files. These carry scores of 5.3 and 4.3, respectively.

Public reporting has not established which individual vulnerability was used in each ransomware incident or whether attackers combined them.

Early coverage raised concerns because Solar reportedly investigated an affected device running DSM 7.4.1-90080 Update 1. At that stage, researchers were still examining the entry point and had not ruled out an unknown vulnerability.

The later report attributed Synology’s findings to older, patched weaknesses. The published accounts do not explain the apparent mismatch or confirm a new zero-day attack.

Synology NAS devices have faced ransomware threats before. Cyber Security News covered the Diskstation ransomware investigation, involving criminals who targeted Synology storage systems. That separate case provides background on the threat to NAS users. However, the available reports do not establish any connection to C3RB3R.

Synology’s advisory lists fixed releases including DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. These are historical patch thresholds, not a recommendation to stop updating. Administrators should install the latest release supported by their NAS model and update official packages and third-party components.

Appinn’s initial incident report recommends removing direct internet access to DSM management and SSH, using a VPN for remote connections, and checking for unusual logins, unknown administrators, and scheduled tasks.

It also advises enabling two-factor authentication and keeping independent offline or off-site backups. For affected users, those separate backups may provide a route to recover encrypted files. Updating remains necessary, but it does not itself restore files already encrypted by ransomware.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Patched Synology NAS Vulnerabilities to Deploy C3RB3R Ransomware and Encrypt Files appeared first on Cyber Security News.

Acronis analyzes Qilin ransomware after 900+ attacks in 2026. See how ESXi Qilin ransomware scripts hijack VMware hosts and leak data on WikiLeaksV2.

Related Posts:

• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace
• INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud
• CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices

The post Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026 appeared first on Daily CyberSecurity.

Hackers reduced the GMO Internet ransom demand from $50M to $1M and leaked victim files after the Japanese conglomerate ignored multiple bug warnings.

Related Posts:

• UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
• Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems
• Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison

The post GMO Internet Ransom Demand Slashed After Cloud Breach appeared first on Daily CyberSecurity.

Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator.

A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for the Eastern District of New York announced it in a press release, and it also says an $11 million reward remains for a co-conspirator who’s still at large.

“Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims.” reads the DoJ’s press release. “The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers.  “

In December, Artem Aleksandrovych Stryzhak pleaded guilty in the U.S. for Nefilim ransomware attacks. The Ukrainian citizen was arrested in Spain in 2024 and extradited to the US in April 2025. He pleaded guilty to conspiracy to commit computer fraud, extortion, and related activity

Nefilim ransomware was used to encrypt networks worldwide, including in the Eastern District of New York, causing millions in losses from ransom payments and system damage. Attackers employed a customized ransomware executable in each attack, generating unique decryption keys and tailored ransom notes for victims. In June 2021, Nefilim administrators granted Artem Stryzhak access to the ransomware code in exchange for 20% of his ransom proceeds, which he deployed via his account on the administrators’ online platform.

Stryzhak and co-conspirators researched victims using online databases to collect information on their net worth, size, and contacts. After gaining network access, they stole data to pressure companies into ransom payments. Nefilim notes warned that stolen data would be posted on publicly accessible “Corporate Leaks” sites maintained by the administrators if victims did not comply.

Volodymyr Tymoshchuk, Stryzhak’s co-defendant and Nefilim admin, is a serial ransomware cybercriminal who is still at large. 

According to court documents, his first role was with Nefilim. Starting around June 2021, he joined the ongoing Nefilim conspiracy as an affiliate and got access to the ransomware. In exchange, he agreed with one of the group’s administrators, Volodymyr Tymoshchuk, to pay the administrators 20 percent of the ransom proceeds. Even crime has licensing fees.

One of those attacks came in June 2021, when Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, he created email addresses that went into a ransom note sent to the victim. He kept deploying Nefilim ransomware through at least October 2021.

Separately, he also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive’s conspirators attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. The attacks caused major disruption to daily operations around the world and affected responses to the COVID-19 pandemic. One hospital had to give up digital technology to treat its patients and couldn’t take in new ones right after the attack.

As a Hive affiliate, Stryzhak and his co-conspirators hit seven victims, including law firms, a dentist’s office and a healthcare provider, during the pandemic. Those victims couldn’t get to their encrypted data. The FBI, as part of a months-long effort to disrupt Hive, gave a decryption key to one of Stryzhak’s victims, so that victim recovered its data without paying a ransom.

U.S. Attorney Joseph Nocella, Jr. thanked the FBI’s New York Field Office, the Justice Department’s Office of International Affairs and its Computer Crime and Intellectual Property Section, and Spanish law enforcement for helping to capture him.

“Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” stated United States Attorney Nocella. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”

The State Department’s Transnational Organized Crime Rewards Program is offering up to $11 million for information that leads to the arrest, conviction or location of Tymoshchuk.

Anyone with information can call the FBI at +1-917-242-1407 or email TymoTips@fbi.gov, contact a local field office if in the United States, or reach the nearest U.S. Embassy if overseas.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A Hive ransomware affiliate who also used Nefilim ransomware got 70 months in prison. A co-conspirator remains at large with an $11M reward.

Related Posts:

• Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets
• Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets
• GMO Desktop Cloud Breach Exposes 26,000 FX Servers

The post Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison appeared first on Daily CyberSecurity.

Japan’s GMO Internet Group urged Onamae.com Desktop Cloud customers to back up their data, disconnect computers from networks, shut them down, and unplug connected cables after suspected attackers threatened to publish customer information and launch ransomware at noon on October 27. The emergency instructions followed unauthorized access to the company’s cloud desktop service and an […]

The post Japan’s GMO Internet Warns Customers to Unplug PCs as Hackers Threaten Ransomware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SOCRadar reveals 7 servers run by INC Ransomware affiliates, exposing an INC Ransomware affiliates AI workbench, Phantom, and 46 encryptors.

Related Posts:

• Skynet LLMjacking Agent Hijacks Exposed AI Models to Hack Servers and Mine Crypto
• BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor
• SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning

The post INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors appeared first on Daily CyberSecurity.

A suspected initial access broker behind FortiGate GlobalProtect attacks exposed 70,000+ credentials. See how k0t operates and how to defend.

Related Posts:

• Doppelganger Campaign Targets Israel Elections With Fake News and AI Poisoning
• Storm-0940 Uses ARTEX AI Agent to Probe IT and Software Vendors for Supply Chain Access
• Token Replay Attack Hits 79 Organizations Through Stolen Microsoft 365 Sessions

The post Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials appeared first on Daily CyberSecurity.