Latest cybersecurity reporting from selected sources.

A U.S. government agency paid $1M to Kairos, a group focused on data theft and extortion rather than ransomware, Ransom-ISAC reports. A new case study from Ransom-ISAC reconstructs a complete data-extortion incident involving a U.S. government body and a threat actor called Kairos, using a leaked negotiation transcript and blockchain tracing of the ransom payment. […]

A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and the blockchain trail the payment left

The FBI warned that the extortion gang Silent Ransom Group is targeting law firms and social-engineering its way into servers and databases.

A 5-year study on the Ransomware Economy found that 30,515 exposed databases were hit by ransom attacks, causing massive damage despite victims never paying. Database extortion doesn’t look like the ransomware stories that usually grab headlines. There’s no slick branding, no leak-site countdown, no gang posting memes on Telegram. In most cases, there’s just a […]

Angelo Martino helped accomplices extort a combined $75.3 million in ransom payments from five victim companies. The post Former DigitalMint ransomware negotiator pleads guilty to extortion scheme appeared first on CyberScoop.

Russia-Linked Ransomware Group Dumps Customer Data After Failed Extortion AttemptUnder Armour may trade on the "blood, sweat, respect" slogan, but a Russia-linked ransomware group hasn't been abiding, after they stole data pertaining to 72.7 million of the athleisure giant's customers, then leaked it on darkweb sites after saying the retailer refused to pay a ransom.

More Than 100,000 Affected by Hack Detected on Dec. 30The New Zealand government is probing a year-end ransomware hack of private healthcare service provider Manage My Health that impacted thousands of patients. Digital extortion group Kazu has claimed responsibility and threatened to leak the data on Jan. 15 unless it receives a $60,000 ransom.

Checkout.com will instead donate the amount to fund cybercrime research Ransomware is a huge business, because affected orgs keep forking over money to get their data back. However, instead of paying a ransom demand after getting hit by extortionists last week, payment services provider Checkout.com donated the demanded amount to fund cybercrime research.…

Digital Extortionists Try Recruiting Insiders, Email BarragesCollective efforts to bolster cybersecurity defenses have been taking a big bite out of ransomware groups' earnings, leading groups to reach for new strategies, including social engineering, supply chain attacks, extortion services and bribing insiders, warn incident response experts.

Cybersecurity researchers have discovered a new variant of an Android banking trojan called HOOK that features ransomware-style overlay screens to display extortion messages

Cryptocurrency Tracing Suggests Group Is Rebrand of Russian-Speaking BlackCat GroupEven lesser-known ransomware groups haul in serious extortion cash - although in the ransomware world, little is what it seems. Take relative newcomer Embargo, which appears to be a rebrand of, or successor to, the notorious BlackCat group, also known as Alphv.

7.2 Million Individuals' Personal Data Being Held to Ransom by Threat ActorA data-leak group extortion is shaking down the government of Paraguay for a ransom payment worth $7.4 million, or $1 for every one of the country's citizens. The group, calling itself Brigada Cyber PMC, claims the stolen data includes people's personally identifiable information.

An Iranian national has pleaded guilty in the U.S. over his involvement in an international ransomware and extortion scheme involving the Robbinhood ransomware

Some Patients Threatened Directly by Hackers; Center to Spend $13.5M on SecurityA Seattle cancer center has agreed to pay $11.5 million to settle a proposed class action lawsuit involving a 2023 double-extortion ransomware attack that affected 2.1 million people, with some patients directly threatened by hackers with swatting attacks if they didn't pay a ransom.

The non-ransomware extortion group has switched up tactics and victimology in a deliberate and focused campaign similar to those of other attackers focused on stealing sensitive data.

A ransomware-as-a-service (RaaS) operation called VanHelsing has already claimed three victims since it launched on March 7, 2025

Though the group initially stuck to classic ransomware TTPs before demanding the ransom, it went off script when it began threatening the group and detailing potential consequences the victim would face.

FBI Ties Group to Triple-Extortion Tactics Involving Follow-On Ransom DemandsThe Medusa ransomware group has been continuing to pummel critical infrastructure sectors across America, warns a joint U.S. government alert. The FBI said the group's tactics include triple extortion, meaning it continues to shake victims down for a ransom, even after they've paid.

The letters mimic typical ransom notes and threaten to delete or leak compromised data if payments aren't made, though none of the organizations that received them had active ransomware attacks.

Committee Witnesses Favor Resilience Over BansThe British government should focus on building operational resilience rather than imposing ransom payment bans, security experts told a parliamentary committee. The British government in January floated a ban on public sector and critical infrastructure owners paying digital extortion.