ransomware

Cursor AI hack spurs multinational push for agent governance rules

A Russian-speaking ransomware operator used the AI coding agent built into Cursor to help breach at least seven companies across three continents, according to an investigation by Israeli cybersecurity firm Gambit Security first reported by Reuters on August 27, 2026.…

Russian hackers used SpaceX’s Cursor AI to breach seven firms, report finds

A Russian-speaking ransomware gang used SpaceX's AI coding assistant Cursor to breach at least seven companies earlier this year, according to a report published Thursday by cybersecurity startup Gambit Security and data reviewed by Reuters.

Ransomware operator used Claude Code to breach VPNs, steal credentials across 8 firms

A threat intelligence report from Gambit Security has documented one of the most detailed real-world cases of artificial intelligence being weaponized inside an active ransomware campaign. A suspected affiliate of The Gentlemen ransomware-as-a-service operation used Anthropic's Claude Code to drive…

Suspected China-linked hackers exploit VMware flaw across 47 countries

A suspected China-linked advanced persistent threat actor has been actively exploiting a critical vulnerability in Broadcom's VMware vCenter Server, compromising systems across 47 countries and deploying ransomware derived from the Babuk family, according to research published by German incident response…

Cl0p claims mass data theft from Shell, Philips, GE and dozens more

The Russia-linked ransomware group Cl0p has claimed responsibility for stealing large volumes of data from nearly 50 companies worldwide, including Shell, Philips Koninklijke Philips N.V., Fiserv, and GE, according to a posting on the group's website first reported by Dutch…

Treasury sanctions on ransomware VPN accidentally broke Telegram links worldwide

The U.S. Treasury Department on July 13 designated a virtual private network provider, its Ukrainian administrator, and a Belarusian malware tool seller for enabling ransomware attacks against American hospitals, schools, businesses, and local governments — marking the first time OFAC…

Sysdig documents first ransomware attack run entirely by an AI agent

Cloud security firm Sysdig has documented what its researchers assess to be the first ransomware operation driven entirely by an autonomous large language model agent, marking what cybersecurity experts say is an alarming new chapter in AI-enabled cybercrime.

FortiBleed campaign tied to INC and Lynx ransomware groups

A massive credential-harvesting operation targeting hundreds of thousands of Fortinet firewalls worldwide has been directly tied to two ransomware-as-a-service groups, INC Ransom and Lynx, according to new research published by cybersecurity firm SOCRadar on Wednesday.

Second hacker group demands ransom from Klue breach victims

Market intelligence platform Klue is now caught in a double extortion scenario after the original hackers behind its June 12 breach claim to be deleting stolen data while a second criminal group has surfaced demanding ransom from affected customers.

Microsoft and Europol dismantle major malware networks

Microsoft, Europol, and a coalition of international law enforcement and private-sector partners announced on Wednesday the dismantling of criminal infrastructure behind the Amadey and StealC malware families, two tools that together formed a core link in the global cybercrime supply…