Lumma now leads the infostealer ecosystem in 2026, after Operation Magnus took out RedLine and META in late 2024. RedLine’s…

A stealer log is the data dump that an infostealer malware produces after it compromises a device. It typically contains…

We analysed 16,699 ransomware leak-site posts from 200 groups over 24 months. The data shows ransomware now runs on a workweek calendar: 84% of leaks land Monday to Friday, half of all activity happens in 8 UTC hours, October is open season, and the ecosystem is growing not consolidating. Here is the full timing picture.

Lithuania’s Centre of Registers (Registrų centras) disclosed a May 2026 breach exposing roughly 600,000 records. Attackers reused credentials of authorised institutions, queried from abroad. Alerts.bar data shows 117 stealer-log accounts tied to the agency and 60+ live infected staff endpoints across the wider Lithuanian institutional ecosystem.

A 5-year census of 65,907 exposed databases found 30,515 carry a ransom or wipe marker. Of 512 attacker wallets we traced on-chain, 318 received nothing. The 9.78 BTC ($753K) that did move concentrates into the top 10 wallets, which captured 43% of receipts. Mass database extortion is industrial, automated, and mostly failing.

Inside the May 2026 pivot to encryption-less extortion. The ShinyHunters–Instructure breach, Nitrogen’s hit on Foxconn, EDR killers as standard tooling, and what a 28% payment rate means for defenders.

A practical OSINT walkthrough for investigating ransomware leak sites: workflow, sources, pitfalls, and how to verify victim claims without breaking operational security.

Prompt injection is now the dominant attack vector against LLM-powered applications, and most teams shipping AI features don’t have a defensive playbook. We map the attack taxonomy, walk through real exploit patterns, and lay out the controls that actually contain the blast radius.

Initial Access Brokers (IABs) are the middlemen of the modern ransomware economy, specialists who break into corporate networks and resell that access to ransomware operators. We break down the marketplaces, the pricing tiers, the dominant brokers of 2026, and how to disrupt the chain.

Multi-factor authentication was supposed to end the credential-theft era. In 2026, it hasn’t, because adversaries skip the credential entirely and steal the session cookie that the authentication produced. Here’s how the attack works, why MFA doesn’t stop it, and the four controls that do.