TOPICS
Ransomware
Attacks that encrypt or lock systems and demand a ransom: how they are assessed, what a cyber policy covers and which controls matter to insurers.
Threat intelligence: vulnerabilities and ransomware from 6 to 12 November 2026
From 6 to 12 November 2026 there were 374 ransomware claims on leak sites, 47% above the average of the previous four weeks, and CISA added 11 exploited vulnerabilities to its KEV catalog, including a Barracuda email gateway and the SonicWall VPN. The bulletin covers vulnerabilities, the most active groups and sectors, Italian and European advisories and the questions to put to applicants.
Insights · Nov 14, 2026
ReadThreat intelligence: vulnerabilities and ransomware from 30 October to 5 November 2026
From 30 October to 5 November 2026 there were 277 ransomware claims on leak sites, 21% above the average of the previous four weeks, and CISA added two new Ivanti Connect Secure flaws to its KEV catalog. The bulletin covers exploited vulnerabilities, the most active groups and sectors, Italian and European advisories and the questions to put to applicants.
Insights · Nov 06, 2026
ReadSeptember 2026: side channels on post-quantum crypto, passwords stolen with smart glasses
September 2026 is CHES month: physical attacks recover keys from masked ML-KEM, Classic McEliece and even NIST's Hash-DRBG random generator. Smart glasses record passwords typed on phones, infostealer logs show 170,000 victims and shared compression exposes SSH channels. Agents run more than the user approves.
Research · Sep 30, 2026
ReadFebruary 2026: malicious agent skills, silent leaks, deanonymisation with LLMs
February 2026 puts the AI agent supply chain centre stage: third-party skills, bundles of instructions and scripts, carry malicious code and injections that agents follow up to 80% of the time. Agents can exfiltrate data while their answer looks harmless, and LLMs make online deanonymisation a mass operation. Android updates and passkeys round out the month.
Research · Feb 28, 2026
ReadBridgePay, payments down for days: the dependency small businesses cannot see
On 6 February 2026 ransomware stopped the US payment platform BridgePay for at least four days: merchants forced to go cash-only, municipalities and water utilities unable to collect online. The analysis: the hidden supplier, waiting periods and deductibles, aggregation on payments and questions for renewals.
Insights · Feb 28, 2026
ReadJanuary 2026: signed drivers as weapons, safety neurons, password managers
January 2026 is NDSS month. Malware brings its own signed, vulnerable drivers to switch off defences, and an architecture like ACE separates agent planning from untrusted apps. A handful of neurons hold up LLM alignment, desktop password managers give way to simulated keystrokes and email aliases confuse identities. IoT firmware, PLCs and PyPI packages round out the month.
Research · Jan 31, 2026
ReadAugust 2025: conflicting vulnerability scores, poisoned models, cloned voices
August 2025 questions some basic tools. CVSS, EPSS and other scoring systems rank the same vulnerabilities very differently, and AI model scanners miss most ways of poisoning them. Cloned-voice calls can be unmasked with listening challenges, and password strength meters reveal the passwords they were trained on.
Research · Aug 31, 2025
ReadIngram Micro: six days down for a distributor and its customers
On 3 July 2025 ransomware stopped ordering and licence provisioning at Ingram Micro, one of the largest technology distributors, for about six days. The analysis: dependent business interruption for resellers and managed service providers, waiting periods, aggregation in the IT channel and questions for renewals.
Insights · Jul 31, 2025
ReadJune 2025: agents fooled by what they see, ships under attack, cars that reveal the route
June 2025 shifts the focus to the physical world. Ship officers report spoofed GPS and ransomware on board, CAN bus data rebuild a car's route without GPS, and a video of a 3D printer is enough to steal its design. Computer-use agents fall for instructions hidden in screens, and fuzzing finds ten CVEs in 5G modems.
Research · Jun 30, 2025
ReadMarks & Spencer: 300 million of impact, 100 million of cover
In April 2025 an attack that began with a password reset at an outsourced help desk stopped Marks & Spencer's online orders for 46 days, with an estimated impact of 300 million pounds and cyber cover of up to 100 million. The analysis: limit and loss, the help desk, aggregation by actor and questions for renewals.
Insights · Apr 30, 2025
ReadDecember 2024: jailbreaks from the wild, flawed 5G cores, deceived FIDO2 keys
December 2024 is the month of the ACM CCS proceedings. Jailbreaks collected from the web bypass the safeguards of major LLMs. Fuzzing LTE and 5G cores finds 119 vulnerabilities and satellite modems show 18 new attacks. Even FIDO2 keys can be deceived, while address poisoning on Ethereum costs victims millions of dollars.
Research · Dec 31, 2024
ReadCleo, the second MOVEit: one file transfer product and hundreds of breaches
In December 2024 two vulnerabilities in Cleo's file transfer products were exploited at scale by Clop, with hundreds of claimed victims and confirmations such as Hertz and Chicago Public Schools. The analysis: data theft, insufficient patches, aggregation and questions for renewals.
Insights · Dec 31, 2024
ReadNovember 2024: LLM agents run pentests, a suspected RPKI backdoor, IoT updates at risk
November 2024 shows LLM agents able to automate a penetration test and backdoors that leak documents from RAG systems. On the infrastructure side, a critical flaw in an RPKI validator may be an intentional backdoor. Nearly half the apps updating IoT devices have flaws, and an e-scooter becomes the target of battery ransomware.
Research · Nov 30, 2024
ReadBlue Yonder: the supplier ransomware that stopped retail warehouses
On 21 November 2024 ransomware hit Blue Yonder's managed environment, stopping staff pay at Starbucks and fresh-food warehouses at Morrisons. The analysis: dependent business interruption, perishable stock, retail aggregation and questions for renewals.
Insights · Nov 30, 2024
ReadChange Healthcare, 100 million notices: aggregation on a single supplier
On 22 October 2024 Change Healthcare reported about 100 million notices for February's attack; the final count is 192.7 million. The analysis: concentration, dependent business interruption, notification, ransom and questions for renewals.
Insights · Oct 31, 2024
ReadOctober 2024: LLM agents under test, fragile encrypted cloud, DDoS data that disagree
October 2024 brings the first broad benchmarks of LLM agent security: attacks often succeed and defenses hold up poorly. In applied cryptography, four out of five encrypted cloud storage services show serious flaws and compilers undo constant-time protections. A study compares industry and academic DDoS data and finds diverging views.
Research · Oct 31, 2024
Read