extortion - Security Ticks

Ransomware, extortion groups adapt as payment rates reach historic lows

Coveware, data theft, Don't miss, extortion, Hot stuff, Insider Threat, News, Ransomware, remote access, social engineering, trends / SecurityTicks

Ransomware, extortion groups adapt as payment rates reach historic lows 2025-10-27 at 15:12 By Zeljka Zorz Ransomware groups are facing an economic downturn of their own: In Q3 2025, only 23 percent of victims paid a ransom, and for data theft incidents that involved no encryption, the payment rate dropped to just 19 percent, according […]

React to this headline:

Ransomware, extortion groups adapt as payment rates reach historic lows Read More »

Leaked Oracle EBS exploit scripts expected to drive new wave of attacks (CVE-2025-61882)

data theft, Don't miss, exploit, extortion, Hot stuff, Mandiant, News, Oracle, Resecurity, WatchTowr / SecurityTicks

Leaked Oracle EBS exploit scripts expected to drive new wave of attacks (CVE-2025-61882) 2025-10-07 at 15:36 By Zeljka Zorz Resecurity and watchTowr researchers have analyzed the leaked scripts used by attackers to exploit CVE-2025-61882 on internet-facing Oracle ESB instances. Whether the attackers were Cl0p or LAPSUS$, both, or even additional threat actors is still unknown,

React to this headline:

Leaked Oracle EBS exploit scripts expected to drive new wave of attacks (CVE-2025-61882) Read More »

Hackers launch data leak site to extort 39 victims, or Salesforce

Data leak, data theft, Don't miss, extortion, Hot stuff, News, Salesforce, social engineering / SecurityTicks

Hackers launch data leak site to extort 39 victims, or Salesforce 2025-10-06 at 17:44 By Zeljka Zorz Scattered Lapsus$ Hunters launched a data leak site over the weekend, aiming to pressure organizations whose Salesforce databases they have plundered into paying to prevent the stolen data from being released. Screenshot of Scattered Lapsus$ Hunters data leak

React to this headline:

Hackers launch data leak site to extort 39 victims, or Salesforce Read More »

Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882)

data theft, Don't miss, extortion, Hot stuff, Mandiant, News, Oracle / SecurityTicks

Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882) 2025-10-06 at 15:28 By Zeljka Zorz The Cl0p extortion gang exploited multiple Oracle E-Business Suite (EBS) vulnerabilities, including one zero-day flaw (CVE-2025-61882), “to steal large amounts of data from several victim[s] in August 2025,” Charles Carmakal, CTO at Mandiant – Google Cloud, stated

React to this headline:

Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882) Read More »

Hackers Extorting Salesforce After Stealing Data From Dozens of Customers

data breach, Data Breaches, Data leak, extortion, Salesforce, Scattered Spider, ShinyHunters / SecurityTicks

Hackers Extorting Salesforce After Stealing Data From Dozens of Customers 2025-10-06 at 15:28 By Ionut Arghire Salesforce says the extortion attempts are related to past or unsubstantiated incidents, and not to fresh intrusions. The post Hackers Extorting Salesforce After Stealing Data From Dozens of Customers appeared first on SecurityWeek. This article is an excerpt from

React to this headline:

Hackers Extorting Salesforce After Stealing Data From Dozens of Customers Read More »

Oracle Says Known Vulnerabilities Possibly Exploited in Recent Extortion Attacks

Cl0p, Data Breaches, E-Business Suite, EBS, extortion, FIN11, Oracle, Oracle hack / SecurityTicks

Oracle Says Known Vulnerabilities Possibly Exploited in Recent Extortion Attacks 2025-10-03 at 13:13 By Eduard Kovacs The software giant’s investigation showed that vulnerabilities patched in July 2025 may be involved. The post Oracle Says Known Vulnerabilities Possibly Exploited in Recent Extortion Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original

React to this headline:

Oracle Says Known Vulnerabilities Possibly Exploited in Recent Extortion Attacks Read More »

Oracle customers targeted with emails claiming E-Business Suite breach, data theft

Atmos, Don't miss, extortion, Google Cloud, Halcyon, Hot stuff, Mandiant, News, Oracle / SecurityTicks

Oracle customers targeted with emails claiming E-Business Suite breach, data theft 2025-10-02 at 16:19 By Zeljka Zorz Unknown attackers claiming affiliation with the Cl0p extortion gang are hitting business and IT executives at various companies with emails claiming that they have exfiltrated sensitive data from the firms’ Oracle E-Business Suite (EBS). The email campaign According

React to this headline:

Oracle customers targeted with emails claiming E-Business Suite breach, data theft Read More »

Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations

Anthropic, APT, Artificial Intelligence, cybercriminals, data theft, Don't miss, ESET, extortion, Hot stuff, LLMs, News, North Korea / SecurityTicks

Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations 2025-08-28 at 15:29 By Zeljka Zorz Cybercriminals have started “vibe hacking” with AI’s help, AI startup Anthropic has shared in a report released on Wednesday. An attacker used the agentic AI coding assistant Claude Code for nearly all steps of a data extortion operation

React to this headline:

Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations Read More »

Alleged Rapper Bot DDoS botnet master arrested, charged

arrest, botnet, DDoS, Don't miss, extortion, Hot stuff, News, USA / SecurityTicks

Alleged Rapper Bot DDoS botnet master arrested, charged 2025-08-20 at 21:47 By Zeljka Zorz US federal prosecutors have charged a man with running Rapper Bot, a powerful botnet that was rented out to launch large-scale distributed denial-of-service (DDoS) attacks around the world. According to court documents, 22-year-old Ethan Foltz of Eugene, Oregon, is accused of

React to this headline:

Alleged Rapper Bot DDoS botnet master arrested, charged Read More »

Ransomware groups shift to quadruple extortion to maximize pressure

Akamai, attacks, cybercrime, cybersecurity, extortion, Malware, News, Ransomware, report, threats / SecurityTicks

Ransomware groups shift to quadruple extortion to maximize pressure 2025-08-05 at 07:33 By Help Net Security Threat actors are using a new quadruple extortion tactic in ransomware campaigns, while double extortion remains the most common approach, according to Akamai. Ransomware extortion tactics (Source: Akamai) The emerging trend of quadruple extortion includes using DDoS attacks to

React to this headline:

Ransomware groups shift to quadruple extortion to maximize pressure Read More »

Attackers fake IT support calls to steal Salesforce data

data theft, Don't miss, enterprise, extortion, Google, Hot stuff, News, Salesforce, social engineering, vishing / SecurityTicks

Attackers fake IT support calls to steal Salesforce data 2025-06-04 at 17:47 By Zeljka Zorz Over the past several months, a threat group has been actively breaching organizations’ Salesforce instances and exfiltrating customer and business data, Google Threat Intelligence Group (GTIG) has warned. The attackers in question – currently tracked as UNC6040 – are masters

React to this headline:

Attackers fake IT support calls to steal Salesforce data Read More »

Coinbase suffers data breach, gets extorted (but won’t pay)

Coinbase, Cryptocurrency Exchange, cybercrime, data breach, Don't miss, extortion, Hot stuff, Insider Threat, News / SecurityTicks

Coinbase suffers data breach, gets extorted (but won’t pay) 2025-05-15 at 17:35 By Zeljka Zorz Cryptocurrency exchange platform Coinbase has suffered a breach, which resulted in attackers acquiring customers’ data that can help them mount social engineering attacks, the company confirmed today by filing a report with the US Securities and Exchange Commission (SEC). The

React to this headline:

Coinbase suffers data breach, gets extorted (but won’t pay) Read More »

North Korean IT workers set their sights on European organizations

blockchain, CMS, data theft, Don't miss, EU, extortion, Hot stuff, Insider Threat, News, North Korea, UK, web application, web development / SecurityTicks

North Korean IT workers set their sights on European organizations 2025-04-02 at 13:05 By Zeljka Zorz North Korean IT workers are expanding their efforts beyond the US, and are seeking to fraudulently gain employment with organizations around the world, but most especially in Europe. According to Google’s threat researchers, they are also increasingly attempting to

React to this headline:

North Korean IT workers set their sights on European organizations Read More »

BlackLock ransomware onslaught: What to expect and how to fight it

Don't miss, enterprise, ESXi, extortion, Hot stuff, News, Ransomware, ReliaQuest, SMBs, tips, VMWare, Windows / SecurityTicks

BlackLock ransomware onslaught: What to expect and how to fight it 2025-02-18 at 18:33 By Zeljka Zorz BlackLock is on track to become the most active ransomware-as-a-service (RaaS) outfit in 2025, according to ReliaQuest. Its success is primarily due to their unusually active presence and good reputation on the ransomware-focused Russian-language forum RAMP, and their

React to this headline:

BlackLock ransomware onslaught: What to expect and how to fight it Read More »

Ransomware payments plummet as more victims refuse to pay

Chainalysis, Cisco, Don't miss, extortion, Hot stuff, News, Ransomware, Rapid7, trends / SecurityTicks

Ransomware payments plummet as more victims refuse to pay 2025-02-06 at 15:49 By Zeljka Zorz Chainalysis’ latest report on how the ransomware landscape changed from 2023 to 2024 shows a promising trend: An increasing number of victims refuses to pay the ransom. The total volume of ransom payments decreased year-over-year by approximately 35%, the blockchain

React to this headline:

Ransomware payments plummet as more victims refuse to pay Read More »

Man charged with stealing $65 million by exploting DeFI protocols vulnerabilities

Cryptocurrency, Don't miss, extortion, finance, fraud, Hot stuff, News, USA, vulnerability / SecurityTicks

Man charged with stealing $65 million by exploting DeFI protocols vulnerabilities 2025-02-04 at 12:16 By Help Net Security A Canadian man has been indicted in federal court in New York for exploiting vulnerabilities in two decentralized finance (DeFi) protocols to fraudulently obtain about $65 million from the protocols’ investors. The fraudulent scheme According to court

React to this headline:

Man charged with stealing $65 million by exploting DeFI protocols vulnerabilities Read More »

North Korean IT workers are extorting employers, FBI warns

data theft, Don't miss, enterprise, extortion, Hot stuff, News, North Korea, USA / SecurityTicks

North Korean IT workers are extorting employers, FBI warns 2025-01-24 at 16:48 By Zeljka Zorz The FBI is on a mission to raise awareness about the threat that North Korean IT workers present to organizations in the US and around the world. While corporate espionage comes to mind first, the threat goes beyond that: “In

React to this headline:

North Korean IT workers are extorting employers, FBI warns Read More »

Attackers are encrypting AWS S3 data without using ransomware

AWS, cloud storage, Don't miss, enterprise, extortion, Halcyon, Hot stuff, News, Ransomware / SecurityTicks

Attackers are encrypting AWS S3 data without using ransomware 2025-01-13 at 19:03 By Zeljka Zorz A ransomware gang dubbed Codefinger is encrypting data stored in target organizations’ AWS S3 buckets with AWS’s server-side encryption option with customer-provided keys (SSE-C), and asking for money to hand over the key they used. They do not exfiltrate the

React to this headline:

Attackers are encrypting AWS S3 data without using ransomware Read More »

8Base hacked port operating company Luka Rijeka

data theft, Don't miss, EU, Europe, extortion, Hot stuff, maritime industry, News, Ransomware / SecurityTicks

8Base hacked port operating company Luka Rijeka 2024-12-09 at 14:48 By Zeljka Zorz Luka Rijeka, a company that offers maritime transport, port, storage of goods and forwarding services in Rijeka, Croatia, has been hacked by the 8Base ransomware group. The group claimed the attack on their dark web data leak site and professed that they’ve

React to this headline:

8Base hacked port operating company Luka Rijeka Read More »

Private US companies targeted by Stonefly APT

APT, Don't miss, enterprise, extortion, government-backed attacks, Hot stuff, Mandiant, News, North Korea, Symantec, USA / SecurityTicks

Private US companies targeted by Stonefly APT 2024-10-03 at 14:01 By Zeljka Zorz Undeterred by the indictment issued against one of its alleged members, North Korean APT group Stonefly (aka APT45) continues to target companies in the US, Symantec threat analysts warned. About Stonefly Also known as Andariel and OnyxFleet, Stonefly has been linked to

React to this headline:

Private US companies targeted by Stonefly APT Read More »