Last Update: 10/27/2026 at 6:00 AM EST

Ransomware Ecosystem

Coverage from DeXpose, Cybersecurity Insiders, and others

Ransomware Ecosystem topic image

Ransomware is an ecosystem of criminal groups, affiliates, negotiators, access brokers, tools, victims, and law-enforcement responses.

It spans familiar tactics such as encrypting systems and threatening to leak stolen data, as well as social engineering, remote-support abuse, insider access, and ransomware-as-a-service arrangements. The ALPHV/BlackCat cases involving former cybersecurity professionals illustrate how legitimate expertise and negotiation roles can be turned toward extortion, while Silent Ransom Group campaigns show how attackers can obtain access without traditional malware. Enforcement, attribution, cryptocurrency seizures, sentencing, and efforts to improve negotiation oversight are also part of the subject.

Looking Back
211 Day Timeline
Feb 13Mar 27May 8Jun 19Jul 31Sep 11
All Articles36 articles
Important19 articles · CI Score 60 and above
DeXpose / Mark Cyber
DragonForce affiliates reportedly stole and threatened to publish organizational data during 2025 ransomware attacks against Marks & Spencer, Co-op, and Harrods in the United Kingdom.
9/7/2026 • Cybersecurity (Privacy-Relevant) • General
Cybersecurity Insiders / Holger Schulze
Europol and Eurojust coordinated 11-country action in 2025 to dismantle AudiA6, a crypto-mixing service laundering ransomware proceeds using stolen or purchased identities.
6/21/2026 • Cybersecurity Tech (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Europol and partner authorities dismantled AudiA6 across 11 countries after linking the service to ransomware laundering from 2022 to 2025.
6/11/2026 • Cybersecurity Tech (Privacy-Relevant) • General
BleepingComputer / Lawrence Abrams
Mandiant reports Silent Ransom Group extortion attacks targeting U.S. law firms in 2026 using voice phishing and remote support tool installs to steal data quickly.
6/7/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Sergiu Gatlan
US courts sentenced Matthew Isaac Knoot and Erick Ntekereze Prince to 18 months each for laptop-farm schemes enabling North Korean IT workers to obtain remote US jobs using stolen identities.
5/7/2026 • Risk, Harm & Societal Impact • General
Risk & Insurance
Enterprises worldwide face data extortion in 2025, replacing encryption based ransomware.
3/4/2026 • Data Breaches & Exposure Events • General
Infosecurity Magazine
Resilience and Assured experts report in 2025 ransomware extortion trends centered on data theft, with suppression payments often failing and prevention planning increasing in priority.
6/11/2026 • Cybersecurity Tech (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Germanys ZIT and BKA, with U.S. partners, seized Kratos servers and arrested its Indonesia developer in 2024, disrupting phishing-as-a-service used in 35 countries.
7/21/2026 • Cybersecurity (Privacy-Relevant) • General
The Record / Daryna Antoniuk
Hackers compromised Ksenia Sobchak Telegram channels in Russia during the previous week, posting alleged private correspondence while Sobchak and intermediaries disputed authenticity.
7/13/2026 • Data Breaches & Exposure Events • General
The Record / Joe Warminsky
Peter Stokes appeared in federal court in Chicago after extradition from Finland for alleged Scattered Spider involvement in a luxury retailer breach and $8 million crypto ransom demand.
7/1/2026 • Cybersecurity Tech (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
ESET researchers reported Gentlemen RaaS EDR evasion tools using BYOVD and driver swapping to disable endpoint defenses during ransomware attacks.
6/18/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Symantec reported December 2025 findings that DragonForce ransomware used Backdoor.Turn to abuse Microsoft Teams TURN relays for hidden command and control.
6/16/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Lawrence Abrams
Ezekiel Dean Potter was sentenced in Iowa for insider cyberattacks that used retained credentials to delete district accounts and disrupt Schoology and Apple School Manager access.
6/13/2026 • Cybersecurity Tech (Privacy-Relevant) • General
The Record / Suzanne Smalley
Catalin Dragomir was sentenced in the United States in 2026 to 56 months for credential-based hacking of Oregon's emergency management network after a Romania arrest.
5/27/2026 • Data Breaches & Exposure Events • General
The Record / Jonathan Greig
Rapid7 research linked an Iranian MuddyWater intrusion to Chaos ransomware cover tactics, using Microsoft Teams social engineering and extortion-driven data publication.
5/7/2026 • Cybersecurity (Privacy-Relevant) • General
The Record / Jonathan Greig
Ryan Goldberg and Kevin Martin were sentenced in 2023 ransomware extortion cases tied to ALPHV/BlackCat, using incident response roles and contributing to a patient data leak.
5/1/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Check Point investigators report a Gentlemen ransomware affiliate used SystemBC to power a proxy botnet exceeding 1,570 hosts, with victims concentrated in the US, UK, Germany, Australia, and Romania.
4/20/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer
In February 2026, University of Mississippi Medical Center ransomware disrupted Epic electronic health records across 35 clinics and 200+ telehealth sites while illustrating double and triple extortion tactics.
4/2/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Sergiu Gatlan
Nigerian national hacked Massachusetts tax firms between 2016 and 2021 to steal client data and file fraudulent refunds in the United States.
2/19/2026 • Data Breaches & Exposure Events • General
Interesting17 articles · CI Score 45–59
Tech Jacks Solutions Security Command Center
DragonForce claimed a double-extortion ransomware attack on Ink in London through a dark web leak site, suggesting encrypted and exfiltrated data exposure.
6/14/2026 • Cybersecurity (Privacy-Relevant) • General
Krebs on Security
Germany's BKA said Daniil Maksimovich Shchukin led GandCrab and REvil ransomware and helped carry out extortion attacks in Germany from 2019 to 2021.
4/4/2026 • Cybersecurity (Privacy-Relevant) • General
IT Brew / Billy Hurley
Ransomware actors shift from encryption to data exfiltration in late 2025, prompting updated breach response and detection practices.
2/13/2026 • Data Breaches & Exposure Events • General
BleepingComputer / Sergiu Gatlan
U.S. prosecutors sentenced Ukrainian national Oleksii Lytvynenko in 2026 to four years in prison for supporting Conti ransomware attacks that stole data from victims worldwide.
9/11/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Sergiu Gatlan
Goldberg and Martin were sentenced in federal court for BlackCat (ALPHV) ransomware extortion targeting U.S. companies between May and November 2023.
5/1/2026 • Cybersecurity (Privacy-Relevant) • General
The Hacker News
The U.S. Department of Justice announced four-year sentences for Ryan Goldberg and Kevin Martin for BlackCat ransomware facilitation of 2023 attacks across the United States.
5/1/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
German Federal Police (BKA) said Shchukin and Kravchuk led GandCrab and REvil from 2019 to July 2021, tied to at least 130 German extortion cases.
4/6/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Bill Toulas
Germanys BKA said it identified two Russian nationals as leaders of GandCrab and REvil ransomware operations from 2019 to 2021, citing extortion cases and Kaseya-related impacts.
4/6/2026 • Cybersecurity (Privacy-Relevant) • General
DigitalShield / Alberto Payo
Broadcom, Symantec, and Carbon Black researchers report DragonForce used Backdoor.Turn with Microsoft Teams relay infrastructure during a U.S. company attack.
6/20/2026 • Cybersecurity (Privacy-Relevant) • General
The Record / Alexander Martin
A UK court sentenced Thalha Jubair and Owen Flowers for a 2024 Transport for London cyberattack that disrupted transit systems and compromised Oyster refund data.
7/16/2026 • Data Breaches & Exposure Events • General
CNET / Alex Valdes
The US Treasury sanctioned First VPN Service and two administrators in 2020s enforcement actions alleging ransomware concealment for attacks on US companies.
7/16/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Sergiu Gatlan
Transport for London disclosed a 2024 breach, and UK sentencing on guilty pleas followed arrests of Thalha Jubair and Owen Flowers for hacking and customer data theft.
7/16/2026 • Data Breaches & Exposure Events • General
BleepingComputer / Sergiu Gatlan
OFAC sanctioned 1VPNS and administrator Dmytro Rashevskyi in connection with Operation Saffron takedown efforts supported by the FBI Boston Field Office, impacting ransomware-related VPN anonymity and user data exposure.
7/14/2026 • Cybersecurity (Privacy-Relevant) • General
The Record / Suzanne Smalley
U.S. Treasury sanctioned First VPN Service in 2026, alleging the VPN provider and administrators supplied ransomware groups with identity-hiding and evasion tools.
7/13/2026 • Cybersecurity (Privacy-Relevant) • General
TechCrunch
U.S. Department of Justice announced Angelo Martino was sentenced for BlackCat ransomware conspiracy while serving as a ransomware negotiator, with cryptocurrency assets seized exceeding $10 million.
7/10/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Sergiu Gatlan
In the United States, Angelo Martino was sentenced in federal court for BlackCat ransomware extortion activities after FBI-linked breach and ransom-payment figures.
7/10/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Sergiu Gatlan
Daniel Rhyne pleaded guilty in court after an extortion intrusion used Windows administrative access to delete domain accounts and alter passwords across servers in New Jersey during November 2023.
4/2/2026 • Cybersecurity (Privacy-Relevant) • General