WannaCry

CVE-2026-62781 - RPC Runtime Library Remote Code Execution Vulnerability

Microsoft disclosed CVE-2026-62781, a high-severity remote code execution flaw in the Windows RPC Runtime Library that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as CWE-122 and scored CVSS 8.1, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to T1210, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.

Detection: Splunk RCE via External Lookup Copybuckets | Splunk Security Content

Sophos MTR in Real Time: What is Astro Locker Team? | SOPHOS

Mount Locker emerged as a corporate-targeting ransomware operation that stole data before encrypting files and then demanded multi-million dollar payments while threatening to leak stolen information on a Tor-hosted extortion site. Reporting on early victims said the group had already listed multiple organizations on its leak portal and published at least one victim’s files after nonpayment. The malware used ChaCha20 for file encryption and an embedded RSA-2048 public key to protect encryption material, dropped a ransom note named RecoveryManual.html, and appended a .ReadManual.ID-style extension to encrypted files. Reverse-engineering of Mount Locker samples and later variants showed the ransomware also included operational features for enterprise-wide impact, including command-line options for targeting hosts, suppressing logs, avoiding process termination controls, and encrypting network resources. Analysts reported that newer builds added worm-like lateral movement by enumerating domain or network systems, requiring /LOGIN= and /PASSWORD= parameters for propagation, copying itself to remote machines, creating services named in an Update{GetTickCount()} pattern, and in some cases launching remotely through WMI under ROOT\CIMV2. The malware was also described as killing selected services and processes before encryption to maximize disruption.

Bluenoroff (APT38) Live Infrastructure Hunting - Darkatlas

North Korea-linked Lazarus Group and its financially motivated subgroup Bluenoroff/APT38 have been tied to long-running intrusions against banks, SWIFT-connected environments, cryptocurrency businesses, casinos, and other financial targets worldwide. Reporting from multiple investigations links the actors to operations including the Bangladesh Bank theft, compromises at Bancomext and Banco de Chile, and intrusions at banks in Southeast Asia and Europe. Investigators found that the group maintained access for months, compromised SWIFT Alliance infrastructure, patched SWIFT-related components to suppress integrity checks, harvested transaction data, and used keylogging, lateral movement, and anti-forensic measures to conceal activity and disrupt investigations. Researchers also documented recurring Lazarus tradecraft across these campaigns, including spear phishing, watering-hole attacks, brute force, exploitation of web and client vulnerabilities, fake-TLS command-and-control, service-based persistence, and reuse of malware families and tooling. Technical reporting connected incidents through shared backdoor design, tunneling tools, SWIFT-focused modules, and malware such as SQCSVC and SWPSVC, while newer infrastructure hunting identified phishing domains, linked IP space, and a macOS sample named localfile~.x64 communicating with 104.168.136.24. The combined findings reinforce attribution of these financially driven operations to the Lazarus ecosystem and show an adaptive capability spanning traditional banking networks and digital-asset platforms.

Malware-Traffic-Analysis.net - 2017-03-03 - Shade (Troldesh) ransomware infection

Shade, also known as Troldesh and Encoder.858, remained an active Windows ransomware threat through 2019, spreading largely through malspam that impersonated invoices, bills, and order-related correspondence. Multiple campaigns used ZIP archives or PDFs linking to ZIP downloads that contained malicious JavaScript downloaders, which fetched additional payloads from compromised servers and ultimately deployed the ransomware. Researchers reported the malware consistently appended the .crypted000007 extension, used Tor-based payment and decryption infrastructure, and in some cases relied on fake Comodo-issued signatures and files masquerading as csrss.exe to evade detection. Telemetry and campaign reporting showed Shade hitting Russian-speaking users as well as victims in the United States, Japan, India, Thailand, Canada, Ukraine, France, and Germany, with high-tech, wholesale and retail, and education among the most affected sectors. After operating since 2014 and maintaining broadly similar tactics for years, the operators announced they had ended distribution at the close of 2019 and released more than 750,000 decryption keys. Kaspersky validated the keys and published a free decryptor, and recovery assistance also became available through the No More Ransom project.

The Kaspersky ShadeDecryptor tool for decrypting files affected by Trojan-Ransom.Win32.Shade

Multi-Platform SMAUG RaaS Aims To See Off Competitors - SentinelLabs

SMAUG is a ransomware-as-a-service (RaaS) operation that advertises 64-bit payloads for Windows, Linux, and macOS, positioning itself as a multi-platform option for affiliates. The service reportedly charges a 20% affiliate fee plus a 0.2 BTC registration fee, and provides a web-based campaign builder, customizable ransom demands, offline encryption, and a "Company Mode" that allows a single decryption key to unlock multiple systems inside one targeted organization. Victims are directed to a Tor-based payment portal, while operators reportedly offer automated support for both affiliates and victims and bar attacks against CIS countries. On Windows, SMAUG uses obfuscated Go binaries that gather system details and stored browser credentials, establish persistence through Registry Run Keys consistent with MITRE ATT&CK T1547.001, and then encrypt files for impact using AES-256 with keys protected by RSA-2048, aligning with T1486 Data Encrypted for Impact tradecraft. The combination of credential collection, registry-based autostart, and hybrid cryptography reflects a mature ransomware model designed to support repeatable intrusions and broad enterprise targeting across multiple operating systems.

This new ransomware targets data visualization tool Jupyter Notebook | ZDNET

Researchers observed a new Python-based ransomware attack aimed at misconfigured, internet-exposed Jupyter Notebook environments, marking an unusual shift from the cryptojacking activity more commonly seen against these systems. In Aqua Security's honeypot, an attacker accessed an exposed Jupyter instance, opened a terminal session, downloaded malicious tools, and manually assembled a ransomware script designed to copy and encrypt files, delete the original unencrypted data, and then remove itself to reduce forensic evidence. The attack did not fully complete in the monitored environment, and no ransom note was recovered, suggesting the operator may have been testing tooling or was interrupted during execution. Researchers said artifacts from the intrusion indicate the actor may be linked to earlier campaigns targeting Jupyter servers for illicit cryptocurrency mining and may be Russian-speaking, underscoring the risk that poorly secured notebook servers can be turned into high-impact ransomware targets if they are exposed to the internet without hardening and reliable backups.