Welcome to ISMG's Ransomware Resource Center!

Ransomware has rapidly become one of the world's most prevalent types of cybercrime. The lure for criminals is easy to see: Using highly automated and easily distributed crypto-locking malware to forcibly encrypt systems, attackers can demand bitcoin ransoms in exchange for decryption keys. Use this Ransomware Resource Center for the latest details on emerging ransomware variants, threat intelligence on attackers, plus best practices for detection, response and remediation.

'The Gentlemen' Ransomware Targets Asia Pacific

Akshaya Asokan • September 10, 2025

A newly identified ransomware group is targeting victims across the Asia Pacific region using custom-built evasion capabilities that could pose a "significant threat" to organizations, warn researchers at security firm Trend Micro. The Gentlemen deploys customized methods tailored to each target.

Endpoint Detection & Response (EDR)

Embargo Ransomware Group Tied to $34M in Ransom Profits

Latest

Artificial Intelligence & Machine Learning

Koi Raises $48M to Safeguard AI Models, Code and Extensions

Michael Novinson • September 10, 2025

With $48 million in funding, Koi is scaling up efforts to help enterprises secure browser extensions, AI models and package code often missed by legacy tools. CEO Amit Assaraf says Koi is the only firm offering centralized governance for this fast-growing risk category.

Healthcare

Feds Release Updated HIPAA Security Risk Analysis Tool

Marianne Kolbasuk McGee • September 10, 2025

Federal regulators have updated their HIPAA security risk assessment tool that's long been aimed at helping small and midsized providers and business associates with risk analysis - an activity that many healthcare organizations can't seem to get right.

Data Breach Notification

Georgia Hospital Notifying 163,000 of 2024 Ransomware Hack

Marianne Kolbasuk McGee • September 8, 2025

A public Georgia community hospital is notifying more than 163,000 individuals that their sensitive health information was compromised in a June 2024 ransomware attack. The cybercriminal gang Monti on its dark website last summer claimed Wayne Memorial Hospital as one of its victims.

Artificial Intelligence & Machine Learning

UltraViolet Adds AppSec Services Depth With Black Duck Deal

Michael Novinson • September 5, 2025

UltraViolet Cyber’s acquisition of Black Duck's application security testing services deepens its offensive capabilities and adds 400 people to its global workforce. The deal enables greater integration of assessment and defense across the software development lifecycle.

AI-Powered SASE

Netskope's IPO Filing Reveals Surging Sales, Improved Losses

Michael Novinson • August 22, 2025

Netskope became the second cybersecurity company to pursue an initial public offering this year, revealing increased sales, improved losses and a heavy reliance on channel partners. Nearly 95% of its $328.5 million in revenue in the first half of fiscal year 2025 flowed through indirect channels.

Infrastructure as Code / Programmable Infrastructure

Aikido Security Buys AI Code Startup Trag to Outpace Rivals

Michael Novinson • August 21, 2025

Aikido Security acquired Trag, an AI-native code review startup, to bring repository-wide review capabilities to its platform. The acquisition accelerates delivery of new features, such as logic risk detection and English-language rule writing, aimed at beating legacy rivals.

Fraud Management & Cybercrime

Scattered Spider and ShinyHunters' Next Move: Leaking Data

Mathew J. Schwartz • August 11, 2025

Extortionists tied to the Scattered Spider and ShinyHunters hacking collectives have begun naming victims and leaking data via a new, dedicated Telegram channel. Many of the breaches appear to trace to social engineering attacks that gained attackers access to a victim's Salesforce instance.

Cybercrime

Google and Cisco Report CRM Software Breaches Via Vishing

Mathew J. Schwartz • August 6, 2025

Technology giants Google and Cisco separately said they've both suffered recent data breaches after attackers socially engineered their employees via voice phishing attacks, leading to a breach of their customer relationship management software, exposing customer data.

Identity & Access Management

It's Official: Palo Alto Networks to Buy CyberArk for $25B

Michael Novinson • July 30, 2025

Palo Alto Networks announced the biggest deal in its 21-year history, bursting into the identity security market with its $25 billion buy of CyberArk. While Palo Alto Networks has offered ITDR since 2023, buying CyberArk marks the company's first foray into the broader access management market.

Access Management

Why Palo Alto Networks Is Eyeing a $20B+ Buy of CyberArk

Michael Novinson • July 29, 2025

Less than five months after Google agreed to spend $32 billion on red-hot cloud security startup Wiz, Palo Alto Networks is on the precipice of paying more than $20 billion for PAM goliath CyberArk, The Wall Street Journal reported Tuesday. Here's why the deal represents a major pivot for Palo Alto.

Agentic AI

Dropzone AI Gets $37M to Build Out Cyber AI Agent Ecosystem

Michael Novinson • July 28, 2025

Dropzone AI raised $37 million to scale its flagship AI SOC analyst and build new agentic AI tools for cybersecurity operations. CEO Edward Wu says the funding supports demand surges as enterprises shift toward human-augmenting AI to handle alert fatigue and security tool sprawl.

Business Continuity Management / Disaster Recovery

Another Medical Practice Closes Its Doors After Cyberattack

Marianne Kolbasuk McGee • July 22, 2025

Another small medical care provider has shut its doors forever as the result of a recent "devastating" cyberattack. Georgia-based Alpha Wellness & Alpha Medical Centre has permanently pulled the plug on its operations following a data theft attack by cybercriminal gang RansomHub.