EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
8 matching stories
RansomwareN-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor
Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.
Silent Ransom Group Claims Troutman Pepper Locke Leak as Its Site Lists 64 Law Firms
Silent Ransom Group's leak site listed 64 law firms in August 2026, according to DataBreaches.net, and the group claims it leaked data taken from Troutman Pepper Locke. The firm says an employee was targeted by social engineering and sent documents to an unauthorised party, but that no one gained access to its environment.
DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer
DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.
CoinbaseCartel Extortion Group Has Listed More Than 200 Claimed Victims
CoinbaseCartel, a data-theft extortion group that appeared in September 2025, has 207 claimed victims on ransomware.live, 76 of them in the US; researchers link its access mainly to reused infostealer credentials, while a suggested tie to the Scattered LAPSUS$ Hunters ecosystem remains unconfirmed.
AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'
AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.
Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day
In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.
CISA Issues #StopRansomware Advisory for Gunra Ransomware
On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Republic of Korea's National Police Agency published #StopRansomware advisory AA26-222A on Gunra, a ransomware family first seen in April 2025 that launched a formal RaaS affiliate programme in January 2026 and uses ChaCha20 and RSA-4096 encryption with double extortion.
Background: Trend Micro's 2025 Analysis of The Gentlemen Ransomware's Driver Abuse and Anti-AV Tools
In September 2025 Trend Micro published an analysis of The Gentlemen, then a previously undocumented ransomware group, describing a vulnerable-driver process killer, Group Policy abuse and attacks on manufacturing, construction, healthcare and insurance in at least 17 countries. This article summarises that research as background.
