settra

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and integrity checking, which allows remote, unauthenticated attackers to bypass security restrictions and establish an unauthorized VPN connection. The vulnerabilities affect the GlobalProtect portal and gateway of PAN’s physical and virtual firewalls running PAN-OS software, as well as Prisma Access. Palo Alto Networks initially rated the flaw medium severity when it disclosed it on May 13 and, on May 29, updated its advisory to say it had “become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.” By then, Rapid7 had reported that attackers targeted the local administrator account on its customers’ devices starting May 17, and that some of them reached internal networks in a second wave on May 21. On October 19, Unit 42 updated its threat brief on the flaw, naming Qilin and Inc among the ransomware operators exploiting it. The company’s incident responders have been investigating intrusions linked to the vulnerability since early June. “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” wrote Andy Piazza, Senior Director of Threat Intelligence at Palo Alto Networks Unit 42. Once inside, the attackers use legitimate IT management tools to explore the network, spread to other machines, and bring in tools to steal passwords and data before deploying ransomware. In one case Unit 42 investigated, the attackers went from the compromised VPN gateway to the vCenter management appliance, turned off security controls on the ESXi hypervisors, and ran a custom tool against a domain controller’s virtual disk to extract credentials offline. “This tactic bypasses in-guest endpoint detection and response (EDR) and security controls, representing a highly sophisticated method for obtaining domain-wide credentials.” “We have also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact,” added Piazza. Intruders posing as remote employees ReliaQuest also tracked exploitation by several threat groups, including the Qilin and Settra ransomware operations, and found Cobalt Strike, BloodHound and SharpHound in the related activity. “Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway,” the company warned. Its analysts expect the attacks to go on, assessing that exploitation is “highly likely to continue over the next three months” as ransomware groups and initial access brokers look for unpatched systems. ReliaQuest advises organizations to upgrade affected deployments without delay, disable authentication override cookies where they are not needed, end all active GlobalProtect sessions after patching, and look into unexpected connections, including sessions with hostnames such as “kali.” “Patching alone may not remove access established before remediation,” the researchers cautioned. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Huntress researchers highlighted a new ransomware variant, named Settra, and the post-compromise techniques used in two recent attacks

Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough. So the threat landscape is not getting cleaner. It is just

I ricercatori del GRIT (GuidePoint Research and Intelligence Team) hanno scoperto un’insolita campagna anti ransomware. Si chiama  Ransom Busters e  contatta le organizzazioni che hanno già subito attacchi ransomware per offrire servizi di ripriticno per una cifra compresa tra $20.000 e $60.000. Gli analisti ritengono che dietro questa attività possa esserci un membro di uno dei gruppi ransomware. Gli esperti notano che la cosa più strana di questa situazione è il fatto che Ransom Busters scrive alle vittime ancor prima che le informazioni sull’ hacking diventino pubbliche . In genere, questo avviene normalmente, ma solo dopo che i criminali informatici pubblicano le informazioni sull’attacco. Nelle sue email, Ransom Busters chiede di essere messo in contatto con l’amministratore delegato o il capo del dipartimento IT dell’azienda. Il gruppo afferma di aver cercato per più di tre anni vulnerabilità nei pannelli di amministrazione di vari gruppi RaaS e di aver violato i loro server. Secondo l’aggressore, durante uno di questi hack sarebbe riuscito a scoprire i dati della vittima. Per un prezzo compreso tra 20.000 e 60.000 dollari, Ransom Busters offre la restituzione dell’accesso ai file dell’azienda e l’eliminazione di tutte le copie dei dati rubati detenuti dal ransomware. Gli esperti di GRIT si sono imbattuti in questo schema mentre indagavano su diversi attacchi associati ai gruppi DragonForce, Settra e Anubis . I ricercatori ritengono estremamente improbabile che Ransom Busters rappresenti un’organizzazione legittima , poiché gli attacchi alle infrastrutture  violano l’American Computer Fraud and Abuse Act. Inoltre, quando a Ransom Busters è stato chiesto perché volesse prendere dei soldi per aiutare le vittime, ha dato una spiegazione molto strana: secondo loro, la rimozione gratuita dei dati dal server dei gruppi ransomware potrebbe mettere a repentaglio il loro accesso all’infrastruttura. Un’analisi di due attacchi alle cui vittime ha scritto Ransom Busters ha rivelato una serie di somiglianze. In entrambi gli attacchi, è stato utilizzato SoftPerfect Network Scanner per eseguire ricerche all’interno della rete. Inoltre s5cmd è stato utilizzato per esfiltrare i dati nel cloud AWS ed è stato scoperto lo strumento Remotely RMM , che è stato installato tramite uno script PowerShell. Inoltre, in entrambi i casi, gli aggressori hanno creato un account backdoor locale con la password “Numlock!123” e anche lo stesso nome host controllato dagli aggressori: DESKTOP-BBETH6K. Di conseguenza, i ricercatori suggeriscono che Ransom Busters non è un buon samaritano che hackera segretamente i gruppi ransomware. Molto probabilmente sotto questo pseudonimo si nasconde uno degli hacker , che partecipa lui stesso agli attacchi e poi cerca di ottenere denaro dalle vittime tradendo i suoi “colleghi”. GRIT sottolinea che pagare tali intermediari è estremamente rischioso , poiché non vi è alcuna garanzia che dopo il pagamento i dati rubati vengano effettivamente cancellati dal server degli aggressori. L'articolo Ransom Busters: il buon samaritano che ricatta le vittime del ransomware una seconda volta proviene da Red Hot Cyber .

DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting victims before the attacks become public and claiming it can provide decryption keys and delete stolen data for a fee. GuidePoint Security's Research and Intelligence Team (GRIT) disclosed this activity after responding to several recent ransomware attacks in which victims received emails from Ransom Busters offering to help recover from the attack. The messages were suspicious because they were sent to victims before the attacks became public, raising questions about how they knew about the cyberattacks in the first place. Ransom Busters claimed it exploited vulnerabilities in administrative panels used by ransomware-as-a-service (RaaS) operations, giving it access to encryption keys and data stolen from victims. The group offered to delete the stolen data from ransomware servers, including those belonging to DragonForce, Settra, and Anubis, for between $20,000 and $60,000. However, evidence from two incidents leads GRIT to believe Ransom Busters is likely not a true recovery firm, but the ransomware affiliate responsible for the attacks. In both cases, the attackers used the same software, including SoftPerfect Network Scanner, s5cmd, and the Remotely remote monitoring tool. They also utilized the same tactics, including creating a local backdoor account using the password 'Numlock!123' and the same attacker-controlled hostname, 'DESKTOP-BBETH6K'. GRIT says it observed overlapping activity across multiple RaaS operations and believes, with moderate confidence, that Ransom Busters is a single ransomware affiliate using its access to steal ransom payments from the ransomware gangs it works with. GRIT told BleepingComputer that it has not seen any victims pay Ransom Busters and discourages victims from doing so. However, in one incident involving Ransom Busters, the victim instead paid the RaaS operation behind the attack. The researchers say the victim's name and stolen data were not published on the ransomware operation's data leak site, and they found no evidence that Ransom Busters leaked the stolen data outside the RaaS environment. Ransomware negotiation firm Coveware confirmed to BleepingComputer that they too recently responded to at least one incident where the same group or individual contacted a victim. "This third party contacted the victim via email and claimed to have access to both the decryption key and the stolen data," Elizabeth Cookson, Senior Director of IR at Coveware, told BleepingComputer. Coveware says it has encountered similar "middlemen" using other names as far back as 2024, but says this activity is distinct from the typical "ambulance chasers" who contact victims only after their attacks have been publicly disclosed. "This type of interference on a non-public incident is much more concerning," Lizzie told BleepingComputer. Coveware says interference from a rogue party with access to stolen data increases risk for victims, as paying the ransomware operation may no longer ensure that everyone with access to the data will honor an agreement not to leak it. The company believes increased distrust within Ransomware-as-a-Service operations could lead to more of this behavior, as affiliates attempt to generate additional profits outside of normal revenue-sharing arrangements with ransomware operators. BleepingComputer has also previously warned that third-party ransomware recovery services create forum accounts and privately contact victims who publicly disclose ransomware infections, claiming they can decrypt affected files. However, those services generally approached publicly known victims, while Ransom Busters' knowledge of non-public incidents is far more concerning. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research and Intelligence Team (GRIT) said in a report shared with The Hacker News. "While cybersecurity firms commonly reach out to ransomware victims to offer consulting or recovery services, it is generally done only after the attack becomes public knowledge." The cybersecurity company said it has responded to several recent ransomware incidents involving the threat actor, who is believed to be an affiliate with employment across multiple ransomware-as-a-service (RaaS) operations. In emails sent to the victims, Ransom Busters is seen requesting contact with their CEO or IT leadership, while claiming to have found vulnerabilities in administrative panels maintained by RaaS groups and breaking into the servers for over three years. The financially motivated threat actor also claims in their message that they found data stolen from the company on one of the servers they recently accessed and asks them to make a payment that's anywhere between $20,000 and $60,000 to help them regain access to their files and data and delete all backups held by the ransomware group. GuidePoint said it observed the modus operandi when responding to incidents from threat groups including DragonForce, Settra, and Anubis, adding that the possibility that it could be the work of a legitimate organization is extremely unlikely, as it amounts to a violation of the U.S. Computer Fraud Abuse Act. "This suggests that the operators were very likely either obfuscating the true origin of their access or they were not operating within the confines of the law," Justin Timothy, a Principal Consultant at GRIT, said. "When pressed on why they charged for their help, the group offered a puzzling explanation: that acting without compensation would put their access to the threat actor's infrastructure at risk." An analysis of two different incidents where Ransom Busters contacted victims has uncovered "striking" similarities, including overlaps in the tools used - SoftPerfect Network Scanner for internal reconnaissance s5cmd for exfiltrating data to cloud storage via AWS Remotely remote monitoring and management (RMM) tool, which is installed through a PowerShell script Other commonalities involve the creation of a local backdoor account using the password of "Numlock!123" and the detection of the same attacker-controlled hostname, DESKTOP-BBETH6K, across both intrusions. This raises the possibility that a single operator, mostly an affiliate and not a third-party, is behind the activity. "The implications for ransomware victims are clear: criminal actors cannot be trusted and may employ deceptive tactics to encourage even more limited extortion payments," Timothy said. "'Ransom Busters' or, more likely, the ransomware affiliate maintaining this persona, has shown it will betray even its own criminal partners in pursuit of financial gain." "Payment to any criminal party offers no guarantee that stolen data will be deleted. There are no 'magic bullets' for remedying data exfiltration and 'Ransom Busters' masquerading as beneficent saviors should be treated as a hoax." UNC6671's Extortion Attacks The disclosure comes as GuidePoint sheds light on a sustained adversary-in-the-middle (AitM) operation orchestrated by UNC6671 (aka Cordial Spider and O-UNC-045) targeting financial services, legal, and other industries since April under various extortion brands, such as Falcon, Helix, Pink, Redact, and BlackFile. "The observed behavior, which mirrors similar SaaS-centric targeting from groups such as Shiny Hunters, reflects a departure from opportunistic ransomware deployment and data extortion towards purposeful targeting of large victim organizations, also known as 'big game hunting,'" GIRT said. More than $8 million in payments have been made across 15 Bitcoin wallets attributed to the five data extortion brands during the time period. The average extortion amount stood at $600,000. As many as 78 unique victim-targeted phishing sub-domains have been identified across 76 distinct organizations spanning 15 industry sectors. Of these, 40% are related to hedge funds, venture capital, private equity, asset management, and other financial services firms. As recently detailed by Okta, UNC6671 operates a custom console called Work Panel that enables role-based access control, integrated target reconnaissance via commercial B2B data APIs, automated infrastructure provisioning, and real-time credential relay management using phishing templates that impersonate identity providers like Okta and Microsoft 365. According to GuidePoint, it represents a "meaningful evolution" in the industrialization of vishing-driven credential theft. "The separation of duties – callers who know only their next target's phone number, managers who see the live session queue but nothing else, admins who own the infrastructure – is almost certainly a deliberate organizational design decision that solves the insider risk problem inherent in running criminal operations with hired labor," GIRT said. "Callers are treated as interchangeable commodity labor, recruited through public underground channels, paid per successful capture and deliberately prevented from accessing the product of their own work." Ransomware Landscape in Flux The developments dovetail with the continued evolution of the ransomware landscape, with the emergence of new groups like Tengu, CRPx0, Majinahanashi, Elite Enterprise, BARADAI, Aur0ra, Lalia, QV Ransomware, Friends, Doommageddon, PicMo, and Orova in recent months. Unlike Tengu and CRPx0, which have heavily focused on entities located in the U.S. and Turkey, Majinahanashi has mostly targeted Switzerland, Italy, Germany, Bulgaria, and India. The data leak site associated with Majinahanashi has the tagline "DECISION REQUIRES CLARITY." "Majinahanashi is a mid-tier ransomware family with several interesting technical choices (especially network control and I/O prioritization) but does not exhibit extremely advanced anti-analysis or novel cryptography," security researcher Rakesh Krishnan said. "Majinahanashi's implementation looks more carefully engineered and performance-aware. Its combination of classic double-extortion with selective modern techniques makes it worth monitoring." According to Check Point's State of Ransomware Q2 2026 report, 2,139 organizations were listed on data leak sites. The share of top 10 groups dropped from 71% the previous quarter to 57.6%, even as the number of active groups jumped from 71 to 93, indicating an increasingly fragmented ecosystem. "Modern ransomware campaigns are shifting toward pre-positioned access operations, prioritizing credential harvesting, reconnaissance, privilege escalation, and environment preparation to maximize operational success prior to encryption," CYFIRMA noted last month. "Ransomware groups are increasingly abusing trusted enterprise infrastructure, including collaboration platforms, legitimate cloud services, signed binaries, and remote administration tools, to blend malicious activity with normal enterprise operations." In the month of July 2026 alone, a total of 873 claimed ransomware victims were recorded, up from 722 the previous month. The highest number of ransomware victims claimed in a single month this year was 909 in March 2026. The most active groups include The Gentlemen, Qilin, and CRPx0, each claiming 138, 133, and 46 victims, respectively. CRPx0, which was initially assumed to be a RaaS operation, appears to be an aberration, what with the locker previously distributed via lures claiming to offer OnlyFans accounts. "The most notable one is the group’s insistence on supporting white-label operations. CRPx0 provides RaaS buyers with the resources to manage ransomware campaigns under the buyer's name and markets a 100% profit-sharing model, allowing buyers to keep all profits," Bitdefender said. "What's also unusual is CRPx0's simultaneous marketing of a Hacking-as-a-Service (HaaS) program. The program includes data breach, network compromise, and other services intended to disrupt businesses." What's more, the group has employed ClickFix commands embedded in fake CAPTCHA webpages and resorts to cryptocurrency theft using a clipper payload that sets it apart from other ransomware groups. In contrast stands Akira, which is estimated to have claimed only 22 victims in July 2026. The ransomware group, however, continues to engage in defense evasion tactics to fly under the radar. In one recent incident highlighted by Huntress, an Akira affiliate is said to have rebooted a victim host into Safe Mode with Networking to knock security tools offline after obtaining initial access through a SonicWall VPN. "In this incident, Safe Mode also broke the ransomware," security researcher James Northey said. "In its stripped-down memory environment, the Akira process tree hit an out-of-virtual-memory failure seconds after launching. While the anti-EDR effort backfired and the ransomware did not deploy, the attacker had already exfiltrated credentials and file shares. Even without encrypting anything, they can still extort the victim by threatening to leak the stolen information." Veeam-owned Coveware, in its analysis of the threat in Q2 2026, said the average ransom payment surged 176% from Q1 ($680,081) to $1,880,612, while the median payment declined 50% to $150,000. "This widening gap stems primarily from a handful of unusually high, 'lumpy' payments for extortions involving data exfiltration rather than traditional data encryption," Coveware said. "A key driver behind this spike was the ongoing campaign by Silent Ransom (also known as Luna Moth) against high-profile law firms."