Ransomware EcosystemRansomware EcosystemCoverage from DeXpose, Cybersecurity Insiders, and others
00/00/0000
DailyWeekly
Ransomware is an ecosystem of criminal groups, affiliates, negotiators, access brokers, tools, victims, and law-enforcement responses.
It spans familiar tactics such as encrypting systems and threatening to leak stolen data, as well as social engineering, remote-support abuse, insider access, and ransomware-as-a-service arrangements. The ALPHV/BlackCat cases involving former cybersecurity professionals illustrate how legitimate expertise and negotiation roles can be turned toward extortion, while Silent Ransom Group campaigns show how attackers can obtain access without traditional malware. Enforcement, attribution, cryptocurrency seizures, sentencing, and efforts to improve negotiation oversight are also part of the subject.
Looking Back
211 Day Timeline
Articles published over time. Hover any bar for the period and its article count.
DragonForce affiliates reportedly stole and threatened to publish organizational data during 2025 ransomware attacks against Marks & Spencer, Co-op, and Harrods in the United Kingdom.
9/7/2026 • Cybersecurity (Privacy-Relevant) • General
Europol and Eurojust coordinated 11-country action in 2025 to dismantle AudiA6, a crypto-mixing service laundering ransomware proceeds using stolen or purchased identities.
6/21/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Mandiant reports Silent Ransom Group extortion attacks targeting U.S. law firms in 2026 using voice phishing and remote support tool installs to steal data quickly.
6/7/2026 • Cybersecurity (Privacy-Relevant) • General
US courts sentenced Matthew Isaac Knoot and Erick Ntekereze Prince to 18 months each for laptop-farm schemes enabling North Korean IT workers to obtain remote US jobs using stolen identities.
Resilience and Assured experts report in 2025 ransomware extortion trends centered on data theft, with suppression payments often failing and prevention planning increasing in priority.
6/11/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Germanys ZIT and BKA, with U.S. partners, seized Kratos servers and arrested its Indonesia developer in 2024, disrupting phishing-as-a-service used in 35 countries.
7/21/2026 • Cybersecurity (Privacy-Relevant) • General
Hackers compromised Ksenia Sobchak Telegram channels in Russia during the previous week, posting alleged private correspondence while Sobchak and intermediaries disputed authenticity.
7/13/2026 • Data Breaches & Exposure Events • General
Peter Stokes appeared in federal court in Chicago after extradition from Finland for alleged Scattered Spider involvement in a luxury retailer breach and $8 million crypto ransom demand.
7/1/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Symantec reported December 2025 findings that DragonForce ransomware used Backdoor.Turn to abuse Microsoft Teams TURN relays for hidden command and control.
6/16/2026 • Cybersecurity (Privacy-Relevant) • General
Ezekiel Dean Potter was sentenced in Iowa for insider cyberattacks that used retained credentials to delete district accounts and disrupt Schoology and Apple School Manager access.
6/13/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Catalin Dragomir was sentenced in the United States in 2026 to 56 months for credential-based hacking of Oregon's emergency management network after a Romania arrest.
5/27/2026 • Data Breaches & Exposure Events • General
Rapid7 research linked an Iranian MuddyWater intrusion to Chaos ransomware cover tactics, using Microsoft Teams social engineering and extortion-driven data publication.
5/7/2026 • Cybersecurity (Privacy-Relevant) • General
Ryan Goldberg and Kevin Martin were sentenced in 2023 ransomware extortion cases tied to ALPHV/BlackCat, using incident response roles and contributing to a patient data leak.
5/1/2026 • Cybersecurity (Privacy-Relevant) • General
Check Point investigators report a Gentlemen ransomware affiliate used SystemBC to power a proxy botnet exceeding 1,570 hosts, with victims concentrated in the US, UK, Germany, Australia, and Romania.
4/20/2026 • Cybersecurity (Privacy-Relevant) • General
In February 2026, University of Mississippi Medical Center ransomware disrupted Epic electronic health records across 35 clinics and 200+ telehealth sites while illustrating double and triple extortion tactics.
4/2/2026 • Cybersecurity (Privacy-Relevant) • General
DragonForce claimed a double-extortion ransomware attack on Ink in London through a dark web leak site, suggesting encrypted and exfiltrated data exposure.
6/14/2026 • Cybersecurity (Privacy-Relevant) • General
U.S. prosecutors sentenced Ukrainian national Oleksii Lytvynenko in 2026 to four years in prison for supporting Conti ransomware attacks that stole data from victims worldwide.
9/11/2026 • Cybersecurity (Privacy-Relevant) • General
The U.S. Department of Justice announced four-year sentences for Ryan Goldberg and Kevin Martin for BlackCat ransomware facilitation of 2023 attacks across the United States.
5/1/2026 • Cybersecurity (Privacy-Relevant) • General
Germanys BKA said it identified two Russian nationals as leaders of GandCrab and REvil ransomware operations from 2019 to 2021, citing extortion cases and Kaseya-related impacts.
4/6/2026 • Cybersecurity (Privacy-Relevant) • General
Broadcom, Symantec, and Carbon Black researchers report DragonForce used Backdoor.Turn with Microsoft Teams relay infrastructure during a U.S. company attack.
6/20/2026 • Cybersecurity (Privacy-Relevant) • General
A UK court sentenced Thalha Jubair and Owen Flowers for a 2024 Transport for London cyberattack that disrupted transit systems and compromised Oyster refund data.
7/16/2026 • Data Breaches & Exposure Events • General
The US Treasury sanctioned First VPN Service and two administrators in 2020s enforcement actions alleging ransomware concealment for attacks on US companies.
7/16/2026 • Cybersecurity (Privacy-Relevant) • General
Transport for London disclosed a 2024 breach, and UK sentencing on guilty pleas followed arrests of Thalha Jubair and Owen Flowers for hacking and customer data theft.
7/16/2026 • Data Breaches & Exposure Events • General
OFAC sanctioned 1VPNS and administrator Dmytro Rashevskyi in connection with Operation Saffron takedown efforts supported by the FBI Boston Field Office, impacting ransomware-related VPN anonymity and user data exposure.
7/14/2026 • Cybersecurity (Privacy-Relevant) • General
U.S. Treasury sanctioned First VPN Service in 2026, alleging the VPN provider and administrators supplied ransomware groups with identity-hiding and evasion tools.
7/13/2026 • Cybersecurity (Privacy-Relevant) • General
U.S. Department of Justice announced Angelo Martino was sentenced for BlackCat ransomware conspiracy while serving as a ransomware negotiator, with cryptocurrency assets seized exceeding $10 million.
7/10/2026 • Cybersecurity (Privacy-Relevant) • General
In the United States, Angelo Martino was sentenced in federal court for BlackCat ransomware extortion activities after FBI-linked breach and ransom-payment figures.
7/10/2026 • Cybersecurity (Privacy-Relevant) • General
Daniel Rhyne pleaded guilty in court after an extortion intrusion used Windows administrative access to delete domain accounts and alter passwords across servers in New Jersey during November 2023.
4/2/2026 • Cybersecurity (Privacy-Relevant) • General