U.S. Authorities Seize RAMP, a Major Ransomware Marketplace
Read Our Expert Analysis
Create an account or login for free to unlock our expert analysis and key takeaways for this development.
By continuing, you agree to receive marketing communications and our weekly newsletter. You can opt-out at any time.
Recommended for you
Ransomware Shift: Low Payouts Force Return to Encryption and Targeted Disruption
Mass data-theft campaigns have lost their profit edge as corporate resistance to paying ransoms grows, prompting ransomware operators to favor encryption and more disruptive tactics. High-profile law-enforcement seizures of prominent forums (e.g., RAMP) are adding friction for criminals but also driving them into more private, invitation-only channels.
Machine identities missing from ransomware playbooks
Enterprise ransomware playbooks commonly treat credential resets as a human-only control, leaving service accounts, API keys, tokens and certificates intact — a blind spot that accelerates lateral movement and drives recovery costs. Market shifts toward targeted, disruption-focused extortion and faster weaponization via agentic AI make that omission more dangerous: defenders must pair machine-identity governance with identity-first detection and quicker containment to blunt modern ransomware economics.
Ransomware strike at Ingram Micro exposes sensitive records of ~42,500 people
A July ransomware incident at Ingram Micro led to the theft of employment and applicant records for about 42,521 people and service outages that were largely resolved within a week. A threat actor later published roughly 3.5 TB of claimed data; the company is offering two years of identity protection while facing regulatory notification, legal exposure, and heightened supply‑chain scrutiny.
Handala: U.S. Links Hackers to Iran’s MOIS and Seizes Domains
The U.S. Justice Department publicly attributed the Handala campaign to Iran’s Ministry of Intelligence and Security, executed court-authorized seizures of four domains used to publish threats and doxed material, and paired the action with a $10,000,000 State Department reward offer — a move that reduces a visible propaganda node, preserves evidence for potential prosecutions, but also increases escalation risk amid contested attribution and strained defensive capacity.
U.S. Justice Department seizes $578M in crypto tied to Chinese syndicates
The U.S. Department of Justice announced it froze and seized roughly $578 million in digital assets tied to transnational Chinese criminal groups, an enforcement action framed as a path to victim restitution. Federal tracing and seizure work — including U.S. Marshals‑led blockchain forensics coordinated with private analytics vendors — underscores both growing interagency muscle and the operational limits imposed by mixers, bridges and fast‑moving laundering chains.
Advantest Hit by Ransomware; probe ongoing
Japan’s chip-test equipment maker reported an IT intrusion on Feb. 15 and says investigators found signs of ransomware on parts of its network. The company has not confirmed data theft and is evaluating impacts for customers and employees while response teams continue containment work.
Patch Rush, Penalties and Power Plays: This Week’s Cybersecurity Events
A fast-exploited Fortinet flaw and an agentic-AI vulnerability in ServiceNow forced urgent remediation, while telecoms, a university, and a logistics provider faced data and security crises that drew enforcement and public scrutiny. National agencies issued OT and zero-trust guidance and investors poured $136M into defense-focused software, highlighting shifting incentives toward resilience and regulatory accountability.
Tycoon 2FA Disrupted After Microsoft, Coinbase and Europol Action
A coordinated coalition led by Microsoft , Coinbase and Europol dismantled key infrastructure tied to Tycoon 2FA , blocking 330 domains and tracing blockchain payments to identify an alleged administrator. The disruption directly targets a major phishing-as-a-service pipeline that enabled session-token theft and MFA bypass, shifting attacker economics and prompting near-term tactical pivots.