Ransomware Activity — 48 Hours
44 victims · 13 groups — Qilin dominates with 16 victims across 8 countries. Direwolf adds 2 US healthcare; LockBit5 hits a German energy utility.
| Group | Victim | Country | Sector |
|---|---|---|---|
| Qilin | Teikoku USA | 🇺🇸 US | Manufacturing |
| Qilin | AGUNSA | 🇨🇱 CL | Transportation |
| Qilin | Coface | 🇮🇹 IT | Financial Services |
| Qilin | Spoonful of Comfort | 🇺🇸 US | Hospitality |
| Qilin | Mulino Padano | 🇮🇹 IT | Agriculture |
| Qilin | MOSAID Technologies | 🇨🇦 CA | Technology |
| Qilin | INVENSITY | 🇩🇪 DE | Technology |
| Qilin | Megawide | 🇵🇭 PH | Manufacturing |
| Qilin | Desatera Sdn Bhd | 🇲🇾 MY | — |
| Qilin | Loescher editore | 🇮🇹 IT | Education |
| Qilin | Botek | 🇩🇪 DE | Manufacturing |
| Qilin | Zanichelli | 🇮🇹 IT | Education |
| Qilin | Arnall Golden Gregory | 🇺🇸 US | Professional Services |
| Qilin | ASCII Group | 🇯🇵 JP | Technology |
| Qilin | Double H Equipment | 🇺🇸 US | Manufacturing |
| Qilin | WEBA Meubelen | 🇧🇪 BE | Retail |
| Direwolf | ⚠️ PayrHealth | 🇺🇸 US | Healthcare |
| Direwolf | ⚠️ Colla Health | 🇺🇸 US | Healthcare |
| Direwolf | DXS International | 🇬🇧 GB | Technology |
| Direwolf | TOTVS | 🇧🇷 BR | Technology |
| Direwolf | AAM:HOA Management | 🇺🇸 US | Professional Services |
| MedusaLocker | Twal Family IT Lab | — | Technology |
| MedusaLocker | All Parts Dry Cleaning | 🇬🇧 GB | Retail |
| MedusaLocker | Idex Group | 🇩🇪 DE | Technology |
| MedusaLocker | Bija Industrie | 🇫🇷 FR | Manufacturing |
| MedusaLocker | Thecourierguy | 🇿🇦 ZA | Transportation |
| LockBit5 | ⚠️ vgrn.de | 🇩🇪 DE | Energy & Utilities |
| LockBit5 | tecosim.com | 🇩🇪 DE | Technology |
| LockBit5 | agricolagalbusera.it | 🇮🇹 IT | Agriculture |
| LockBit5 | dupouy-associes.fr | 🇫🇷 FR | Professional Services |
| LockBit5 | actua.fr | 🇫🇷 FR | Professional Services |
| xpl0itrs | Oz Hair & Beauty | 🇦🇺 AU | Retail |
| xpl0itrs | ********* | — | — |
| xpl0itrs | RapidFort | 🇺🇸 US | Technology |
| Blackwater | shalina.com | 🇮🇳 IN | — |
| Blackwater | amca.org.ar | 🇦🇷 AR | Professional Services |
| Panzer | SAGASTA sro | 🇨🇿 CZ | — |
| Panzer | Infosat | — | Technology |
| Emperador | Albania national teacher portal | 🇦🇱 AL | Education |
| Helix | Kennedy Jenks | 🇺🇸 US | Professional Services |
| ms13089 | servmarmg.cl | 🇨🇱 CL | — |
| Orova | Smartsoft | 🇹🇼 TW | Technology |
| SpaceBears | SEARS (Grupo Sanborns) | 🇲🇽 MX | Retail |
| Barracuda | VR Advogados | 🇧🇷 BR | Professional Services |
Security News
SafePal data breach: 39,798 customers' data for sale (BleepingComputer) — Order info including names, addresses and emails stolen via exploited flaw; second crypto hardware wallet breach this week following Trezor/ShipMonk.
Large-scale DDoS disrupted Threema secure messaging (BleepingComputer) — Significant outages to encrypted messaging service used by European government organisations.
AmnesiaStealer: macOS malware with live browser session hijacking (BleepingComputer) — ClickFix delivery; remote control module enables MFA bypass by operating in authenticated sessions.
Wireshark 4.6.8 released — 28 vulnerabilities patched (SANS ISC) — Update now.
Microsoft blames AI bug-finders for delayed Exchange CU (The Register) — AI tooling surfacing more issues than team can clear; no confirmed ship date.
Chinese GLM-5.3 claims superior vulnerability discovery vs US models (The Register) — AI offensive security capability is now an explicit US-China competitive benchmark.
Ordinary WiFi signals used to image people through walls (Slashdot) — Passive sensing identifies individuals within seconds from standard router signals.