Log in Request a demo

Ransomware. From Our Analysts.

Ransomware research: active groups, leak-site activity, attack methods and trends, plus practical steps to reduce your exposure and prepare your response.

All497 APT Groups85 Dark Web31 Digital Risk Protection126 Fraud16 Ransomware51 Sector Analysis34 VIP Security7
Dark glass cascading row of glass padlocks with red neon lines, cover art for: The Gentlemen Ransomware Claims 38 Victims in One DayRansomware The Gentlemen Ransomware Claims 38 Victims in One Day On 26 October 2026 Blackhole recorded 38 victim entries credited to The Gentlemen, not verified by us. Here is the batch pattern and what to patch… Oct 27, 20266 Min Dark glass stacked glass ledger tablets with red neon lines, cover art for: Ransomware in September 2026: 857 Victims Across 82 GroupsRansomware Ransomware in September 2026: 857 Victims Across 82 Groups, and What October Added Atlas data: 857 ransomware victims from 82 groups in September 2026. See the top groups, sectors, countries and what October added so far. Oct 27, 20267 Min Cracked glass padlock with glowing red circuit patterns on a dark background, an image for AI ransomwareRansomware AI Ransomware: 4 AI Tools That Crews Use Four AI tools show up in primary reports on ransomware and extortion crews: Claude, Cursor Agent, DeepSeek and Qwen. Who used what, and what to watch. Oct 25, 20266 Min Dark glass a padlock around a cracked glass data cube with red neon lines, cover art for: Ransomware examples: attacks, types and groupsRansomware Ransomware examples: attacks, types and groups Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories. Oct 10, 20265 Min Dark glass cluster of crystalline dark glass shards with red fractures, with red neon lines, cover art for: Top 10 Ransomware Variants Reported to the FBI in 2025Ransomware Top 10 Ransomware Variants Reported to the FBI in 2025 The FBI IC3 2025 report names the 10 ransomware variants most reported to the FBI, from Akira to Medusa, with the sectors hit and the FBI… Oct 09, 20265 Min Triple extortion ransomware attack model showing layered cyber threatsRansomware What Is Triple Extortion? The Anatomy of the Encryption + Leakage + DDoS Trio Triple extortion ransomware is reshaping cyber threats. Discover how attackers operate and how to detect threats before encryption begins. Apr 03, 202614 Min Reynolds ransomware attack using BYOVD technique to disable EDR via vulnerable NSecKrnl driver before encryptionRansomware Reynolds Ransomware: BYOVD Evasion & NSecKrnl Abuse The newly emerged Reynolds ransomware group leverages BYOVD and NSecKrnl driver abuse to terminate security tools before encryption. Technical breakdown, IOCs and YARA rules. Feb 25, 20266 Min passwor spraying attacksRansomware Password Spraying Attacks: Complete Guide to Detection & Prevention Password spraying explained: how attackers try a few common passwords across many accounts, stay under detection thresholds, and how to detect and stop it. Jun 27, 202518 Min prompt injection attacksRansomware Prompt Injection Attacks: A New Challenge in AI Security What is a prompt injection attack? Learn how direct and indirect injection work, the risks to organisations and the defences that reduce them. Jun 20, 20256 Min Antivirus protection concept with a computer and virus graphics for cybersecurity awareness.Ransomware Why Does Ransomware Still Threaten Cybersecurity? Ransomware explained: the main types, how an attack moves from phishing to encryption and extortion, and which defenses help, with CISA guidance. Jun 19, 20259 Min Advanced cybersecurity team monitoring digital threats on multiple screens.Ransomware Managed Detection and Response (MDR): Enhancing Threat Visibility Managed detection and response (MDR) is a service that monitors, investigates and responds to threats around the clock. See how it works and how to choose. Jun 17, 20258 Min ransomware as a service raasRansomware Ransomware: How the Threat Evolved How ransomware changed in 2025: organized crime groups, ransomware-as-a-service, data theft before encryption, and what defenders should change now. Dec 26, 20246 Min
All 5 pages
FAQ

About The Blog.

Last updated June 9, 2026

  • Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.

  • New articles are added several times a month. The newest come first, and every article shows its publish date.

  • Use the topic chips above the list to open one topic, or type a word in the search box. Each topic has its own page.

  • Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.

  • The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.

  • Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.

  • The count at the top of the blog page shows the current total, and each topic chip shows how many articles that topic holds. You can open all of them or pick one topic, such as APT Groups, Dark Web, Ransomware or Fraud. Each article shows its publish date.

  • The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.

  • Yes. APT Groups is one of the topic chips above the list, and it opens only the articles on that topic. The Knowledge Hub also holds profiles of threat groups.

  • The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach. The blog has an article that explains the three layers in plain words.