The Insider Threat: How Everest Ransomware Is Recruiting Your Employees
Since its emergence in December 2020, Everest has claimed responsibility for breaching more than 200 organizations across five years of operations. Seventy-three percent of those victims are located in the United States. But the group's evolution from traditional ransomware operator to a hybrid model combining direct extortion with initial access brokerage makes it particularly dangerous for large enterprises.
The numbers tell a grim story. According to threat intelligence from the Department of Health and Human Services, Everest has conducted at least 20 confirmed attacks on healthcare organizations between April 2021 and July 2024, with medical imaging providers disproportionately represented among the victims.
The Phone Call That Changed Everything: Inside the $1 Million Ransomware Operation Targeting Enterprise America
The operation, led by the notorious ShinyHunters cybercrime syndicate in collaboration with Scattered Spider and remnants of the Lapsus$ group, has compromised at least 39 companies across multiple industries in recent months.
Among the victims are household names. The financial toll is staggering. According to communications intercepted by security researchers monitoring underground forums, the group's leader, operating under the alias ShinyCorp, is selling stolen corporate datasets for upwards of $1 million per company.
When Anubis Ransomware Chooses Destruction Over Profit: A New Calculus for Enterprise Security
The ransomware economy has operated on a simple premise for the better part of two decades: attackers encrypt corporate data, victims pay for the decryption key, and business eventually resumes. That implicit contract, as distasteful as it may be, has at least offered organizations a path to recovery. But a new player in the ransomware landscape is upending that calculus entirely, and chief information security officers at major enterprises should take notice.
Anubis, a ransomware operation that surfaced in December 2024, has introduced what security researchers are calling a dual-threat capability. The malware not only encrypts files using sophisticated cryptographic methods but also includes an optional wiper function that permanently erases data, reducing file contents to zero bytes while leaving filenames intact as hollow shells. Even if a victim pays the ransom, recovery becomes impossible.
The New Ransomware Threat Costing Enterprises Millions: Inside the Rise Of Lynx
Since emerging last July, Lynx has claimed nearly 300 victims across 20 countries, with U.S. companies bearing the brunt of the assault. According to threat intelligence from FortiGuard Labs, more than 60 percent of confirmed victims operate within American borders, where manufacturing firms and professional services companies have found themselves particularly vulnerable. The manufacturing sector alone accounts for over one-fifth of all attacks, a troubling trend for an industry already grappling with supply chain disruptions and digital transformation challenges.
The Managed Service Provider Blind Spot: How Sinobi Ransomware Is Exploiting Corporate America's Weakest Link
The attack represents a troubling evolution in ransomware operations. Rather than targeting companies directly, criminal groups are increasingly compromising the trusted third parties that maintain corporate networks. These managed service providers often hold privileged access to dozens or hundreds of client environments, making a single breach exponentially more valuable to attackers.