UNC6671 uses fake IT helpdesk calls to steal Microsoft 365 and Okta session tokens for corporate data theft and extortion.

Microsoft Threat Intelligence has identified a new ransomware campaign attributed to the financially motivated threat actor Storm-1175 that began deploying a previously undocumented ransomware strain, StormEncryptor, on August 2, 2026.

Semana del 26 Octubre del 2026

TLP:WHITE

NIVEL ANALÍTICO: EJECUTIVO

Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing.

DeadLock ransomware uses double extortion, encrypting files and threatening to leak data after targeting 80+ victims worldwide.

Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion…

Play ransomware is using a familiar Windows-administration disguise to reduce suspicion during intrusions: a custom service binary named PSexesvc.exe.

Ransomware attackers target managers to exploit trusted accounts, steal corporate data, and gain access to critical business systems.

Jewelbug compromised government webmail to steal browser cookies and spy on officials across Asia and the Middle East.

Gunra ransomware exploits FortiOS/FortiProxy flaws to gain admin access, steal data, and encrypt Windows and Linux systems.

China-based hackers-for-hire group is breaking into government ministries across the Middle East and Asia from the same control panel it uses to run an industrial-scale cryptocurrency fraud business.