LIVE
LATEST THREAT: HYFLOCK Ransomware: Check Point Maps Four Builds and Finds Encryption Flaws That Allow Partial File Recovery (2026) THREAT ALERT ACTIVE
Threat Intelligence Feed — Active Monitoring

RANSOMWARE
THREAT INTELLIGENCE
GROUPS // CAMPAIGNS // TTPs // VICTIMS

Track active ransomware groups, ongoing campaigns, and emerging tactics. Timely intelligence to help defenders stay ahead of threat actors.

View All Intelligence RSS Feed
$2.1B+ 2025 Ransom Payments
480+ RansomHub Victims
$1.2M Median Settlement
11 days Median Dwell Time
// Featured Intel
Group Profile RansomHub Aug 9, 2026

RansomHub: The Most Active RaaS Operation of 2025-2026

RansomHub emerged in February 2024 and rapidly became the highest-volume ransomware operation following LockBit's February 2025 disruption. This profile covers the group's affiliate model, technical tooling, victim statistics, and the specific sectors and countries under sustained targeting.

Access Report →
Threat Level
8/10
Sectors Targeted
— healthcare— critical-infrastructure— finance— manufacturing
// Active Threats
All Reports →
Decryptor News HYFLOCK Nov 15, 2026

HYFLOCK Ransomware: Check Point Maps Four Builds and Finds Encryption Flaws That Allow Partial File Recovery (2026)

Check Point's analysis of HYFLOCK's four builds found a 4,096-byte encryption limit on large files and a file-processing defect. Partial recovery of Office data was possible without a key; Check Point did not develop a general decryption method.

3
Intel Report BlackNevas Nov 14, 2026

BlackNevas ESXi Attack Anatomy: Kaspersky GERT's Ten-Day vCenter-to-Backup Destruction Case (2026)

Kaspersky GERT details a ten-day intrusion that destroyed four ESXi hosts, their VMs, two vCenter appliances and backups, with no virtualization vulnerability exploited. Chain, indicators and defender priorities.

6
Group Profile BYOD Nov 13, 2026

BYOD Ransomware: Campus Extortion Group Claims Vanderbilt, UNM and Michigan State

BYOD claimed the Vanderbilt University attack on 9 November 2026 and has posted 19 leak-site entries since early October. We separate what Vanderbilt has confirmed from what the group claims, and list what remains unknown about its tooling and origin.

8
Campaign Alert Sn00py Nov 12, 2026

Citrus Ransomware: Contractor Credentials, Certighost Attempts and a Fake 'Kaspersky' GPO

Kaspersky documents a previously undocumented group, Citrus, that enters through compromised contractors, tunnels with VLESS, and pushes Sn00py ransomware via a malicious Group Policy Object. We cover the attack chain, what is and is not established, and what defenders can check.

9
Intel Report Nov 11, 2026

Kaspersky Q3 2026: Qilin Holds 15% of Leak-Site Victims as New Ransomware Variants Jump to 4,470

Kaspersky's Q3 2026 desktop statistics put Qilin first on leak-site share at 15.39%, record 4,470 new ransomware variants, and log three sentencings of RaaS members. We summarise the figures and what the method can and cannot show.

6