Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

SpiderLabs Ransomware Tracker Update September 2025: Qilin, Akira Top Ransomware Attackers

The threat groups Qilin and Akira together conducted about one-quarter of the 402 ransomware attacks tracked by Trustwave SpiderLabs in September, with the manufacturing and technology sectors receiving the brunt of these efforts. This information was derived from a new SpiderLabs ransomware tracking tool that gathers information from a variety of open intelligence sources and our own proprietary research.

Hunting GTPDOOR: The case of the "Black Hat Positive"

Ben Reardon, Lead Researcher Corelight Labs / NOC crew I'm a researcher on the Labs team at Corelight and, for me, working in the Black Hat Network Operations Center (NOC) at the USA show in Las Vegas is up there as one of the most interesting and intense activities on the calendar.

Preventing Data Breaches: Essential Steps Your Business Needs Today

The average total cost of a data breach is now $3.86 million, making prevention a top priority for businesses of every size. Yet most organizations still struggle to stay ahead. Studies reveal that it takes nearly 280 days on average to identify and contain a breach, and the shift to remote work has only made matters worse. More than three quarters of companies report longer detection and containment times, adding an estimated $137,000 to the cost of each incident.

Olymp Loader: A new Malware-as-a-Service written in Assembly

Olymp Loader is a Malware-as-a-Service (MaaS) advertised on underground forums and Telegram since June 5, 2025. The seller, “OLYMPO”, presents Olymp Loader as fully written in assembly language and frequently markets it as FUD (Fully UnDetectable). Despite its recent appearance, many underground forum users have already posted positive reviews.

Harvest Now, Decrypt Later: Why Enterprises Must Prepare Now

In Dune, Frank Herbert’s eponymous sci-fi work, there is a phrase that is often repeated – ‘fear is the mind killer’. We can juxtapose this saying with the cybersecurity landscape, as the fear of not being future-ready is what keeps CISOs up at night. The very thought that a cybersecurity strategy, created and implemented with great effort, won’t be able to keep every evolving and increasingly sophisticated threat at bay is disconcerting.

When Firewalls Age Out: What the Akira Attack Can Teach Us About Lifecycle Security

Cyberattacks evolve faster than aging infrastructure can keep up, and expired hardware is one of the biggest blind spots organizations face today. The recent Akira ransomware campaign targeting SonicWall VPNs is a powerful reminder of what happens when devices slip out of support.

Hypervisor Encryption: Shutting Down Recovery

Ransomware isn’t just about locking files anymore; attackers like Scattered Spider can take entire backup systems offline. Joe Hladik explains how hypervisor encryption lets them access virtualization interfaces and encrypt entire ESXi clusters, leaving organizations with no way to recover. Joe lays out why this tactic is so dangerous: it turns a backup, your last line of defense, into another point of failure.

From Ransomware to Exposed ATMs: How Adversaries Target Financial Institutions

The financial sector remains one of the most targeted industries for cybercriminals and nation-state actors due to the sensitivity of customer data, the high value of financial transactions, and the critical role these institutions play in global stability. Bitsight’s 2025 State of the Underground report found that underground markets listed nearly 14.5 million compromised credit cards in 2024, representing a 20% increase over 2023. This growth was driven entirely by a surge in US-issued cards.