Preventing the Access That Powers Ransomware Lateral Movement (Part 2/2)
Designing upstream controls that cut off access brokers, endpoint breakout, and perimeter device exploitation before T1021 starts
Tags /
#Ransomware
44 reports
Ransomware Lateral Movement in 2026: Detection Opportunities (Part 1/2)
Ransomware lateral movement techniques in 2026 are increasingly identity-led, cloud-aware, and executed through legitimate admin channels, forcing defenders to prioritise high-fidelity telemetry,…
Cyber Threats to the UK Financial System: Banking, Capital Markets, Asset Management and Central Banking (Transatlantic & Geopolitical Drivers, 2024–2026 Incident Case Studies)
UK financial stability and customer outcomes are increasingly shaped by operational cyber risk: attacks (and disruptive technology failures) that impair critical services, amplify fraud losses,…
BLACK BASTA - Threat Actor Profile
Operational profile of the Black Basta ransomware ecosystem (2022–2026) Black Basta, BASTA, ransomware, RaaS, double extortion, UNC4393, Storm-1811, QakBot, DarkGate, Quick Assist, vishing, MITRE…
Cyber Threats Facing UK Further and Higher Education
UK further education (FE) colleges and higher education (HE) institutions face a persistently high-volume threat environment driven by phishing, account compromise, ransomware/extortion, and…
BeyondTrust CVE-2026-1731: Pre-auth RCE escalates from rapid scanning to ransomware-linked intrusions
CISA has now flagged CVE-2026-1731 —a critical, pre-authentication remote code execution flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) as being used in ransomware…
Threat Actor Profile: LAPSUS$ (a.k.a. Microsoft “DEV-0537” / “Strawberry Tempest”)
LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity…
Cl0p Exploits Oracle E-Business Suite Zero-Day (CVE-2025-61882): What Defenders Need to Know
In October 2025, multiple threat intelligence and government sources reported active exploitation of a critical, unauthenticated remote code execution vulnerability in Oracle E-Business Suite…
Asahi Cyberattack and Data Breach: Ransomware-Driven Disruption and Nearly Two Million Records at Risk
In late September 2025, Asahi Group Holdings disclosed a cyberattack that disrupted core business systems in Japan and later confirmed that personal information linked to nearly two million…
Scattered Spider Attacks on Airlines (Qantas, WestJet, Hawaiian Airlines)
In late June to early July 2025, multiple airlines disclosed cybersecurity incidents affecting internal systems and/or customer data, with reporting and government/industry warnings pointing to…
Qilin Ransomware Attack on Lee Enterprises: Operational Disruption at a Major US Newspaper Publisher
In February 2025, Lee Enterprises disclosed a material cybersecurity incident that disrupted distribution, billing, collections, and vendor payments across its newspaper portfolio. In a regulatory…
Change Healthcare Ransomware Attack (UnitedHealth / Optum): ALPHV/BlackCat Disruption and Mass PHI Exposure
Note on timing: Public reporting and official disclosures indicate the intrusion began in February 2024 , while October 2024 is significant because Change Healthcare informed HHS OCR that ~ 100…