Loading story…
Government and industry reporting highlighted ransomware and hybrid cyber activity increasingly intersecting with geopolitical conflict and critical infrastructure risk. The UAE Cyber Security Council said it thwarted a ransomware operation targeting the country’s “digital infrastructure and vital sectors,” describing attempted network intrusions, ransomware deployment, and phishing, and alleging the use of AI-enabled tooling to increase sophistication; the statement did not attribute the activity publicly but came amid broader reporting on Iran-linked cyber pressure against the UAE. In Romania, the head of the National Cybersecurity Directorate warned that recent ransomware incidents affecting critical services (including the national water agency and energy providers) appear systematic and aligned with Russian strategic interests, with attacks claimed by or attributed to Russian-speaking groups including Qilin and Gentlemen.
Separately, Air Côte d’Ivoire confirmed a cyberattack impacting parts of its information system after the INC ransomware group claimed theft of 208 GB of data and threatened publication if a ransom was not paid; the airline said it notified regulators (including France’s ANSSI) and engaged national and international incident response support. Broader sector analysis reported manufacturing as a leading ransomware target due to interconnected IT/OT environments, legacy systems, and high downtime costs, with surveys indicating a significant portion of manufacturers paid ransoms in 2025 and median payments around $1M. Strategic context reporting assessed Russia is likely to escalate coordinated hybrid warfare (cyber, influence, sabotage) against NATO members, while public-opinion polling in several NATO countries showed majorities view disruptive cyberattacks on hospitals or power grids as potential acts of war—underscoring rising expectations for stronger state responses to such campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In its 2026-02-24 statement, the UAE Cyber Security Council characterized the attempted ransomware campaign as 'of a terrorist nature' and said the attackers used artificial intelligence to develop more sophisticated offensive tools. The claim was presented amid broader concerns about alleged Iran-linked cyber activity targeting the UAE.
On 2026-02-24, the UAE said it stopped a ransomware incident targeting the country's digital infrastructure and vital sectors. The UAE Cyber Security Council said the activity involved intrusion attempts, ransomware deployment efforts, and systematic phishing against national platforms.
Ukraine, Moldova, and Romania signed a memorandum in Kyiv to strengthen regional cooperation against Russian cyber threats. The agreement was reported in the context of growing warnings about Moscow-linked cyber activity across the region.
On 2026-02-23, Romania's top cybersecurity official said recent ransomware attacks on the country's critical infrastructure, including the national water agency and energy providers, likely formed part of a broader Russian hybrid campaign. He said some incidents were claimed by or attributed to Russian-speaking groups such as Qilin and Gentlemen and appeared to coincide with Romanian political decisions and support for Ukraine.
On 2026-02-23, Air Côte d'Ivoire publicly confirmed the cyberattack and said it had notified France's ANSSI and Côte d'Ivoire's regulator ARTCI. It also said CI-CERT and international experts were investigating the scope of any data breach and potential impact on providers, passengers, and employees.
Following the February 8 incident, the INC ransomware gang claimed responsibility for the attack on Air Côte d'Ivoire, alleging it stole 208 GB of data. The group threatened to publish the data unless a ransom was paid by 2026-02-24.
On 2026-02-08, Air Côte d'Ivoire said a cyberattack affected parts of its information system, prompting business continuity measures and the involvement of technical teams to maintain flight and operational continuity. The airline later said flight operations remained stable and compliant with safety standards.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcetherecord.media
Open sourcetherecord.media
Open sourcetechtarget.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting highlighted elevated ransomware activity and evolving access-broker ecosystems. BlackFog’s February ransomware roundup counted **82 publicly disclosed ransomware incidents** across **20 countries**, with the **U.S.** most affected (51 incidents) and **healthcare** the most targeted sector (31%). The report attributed publicly claimed attacks to **24 ransomware groups**, led by **Shiny Hunters** (8) and **Qilin** (6), while noting **41%** of incidents were not yet attributed; it also cited individual victim disclosures/claims involving **Nova Biomedical** (PII exposure affecting 10,764 people), **Hosokawa Micron** (files accessed; **Everest** claimed ~30GB theft), and **Iron Mountain** (Everest claim of 1.4TB theft, while Iron Mountain stated access was limited to a single marketing folder via a compromised credential). Separately, Huntress described how investigation of a “routine” **RDP brute-force** success led to discovery of credential-hunting behavior and **geo-distributed infrastructure** consistent with a **ransomware-as-a-service** ecosystem and associated initial access activity, illustrating how exposed remote access can connect to broader ransomware operations. Arctic Wolf warned of **heightened cyber risk** following the February 2026 U.S./Israel-Iran escalation (*Operation Epic Fury*), advising increased vigilance—especially for sectors historically targeted by Iranian-linked actors (e.g., energy, defense, transportation, healthcare, government)—and anticipating potential **wiper activity, DDoS, targeted intrusions, supply-chain risk**, and possible collaboration with ransomware-affiliate activity amid geopolitical retaliation dynamics.
Jun 29, 2026
Latvia’s National Security Service (SAB) reported that **2025 saw a record high in registered cyber threats** targeting the country, with **Russia** assessed as the primary source of cyber risk amid Latvia’s support for Ukraine. SAB said most activity was linked to cybercrime and digital fraud, but the most serious cases included **intrusion attempts, malware distribution, equipment compromise, and DDoS attacks**, and it warned that **operational technology (OT)** in energy, water, and transport often lacks sufficient protections. The agency also noted that Russian-linked hacktivist activity has shown willingness and capability to target industrial control systems for short-term disruption and intimidation, and that DDoS activity against government and critical services often aligns with politically sensitive events. In the UK, senior national security figures warned Parliament that resilience alone may be insufficient against **cyber and hybrid threats** (including sabotage and disinformation), arguing the country needs an **offensive deterrence** component to impose costs on hostile states rather than “absorbing” attacks. Separately, Check Point Research data cited by Dark Reading indicated **Latin America and the Caribbean** experienced the highest average weekly attack volume globally (3,065 attacks per week; **+26% YoY**), with prevalent activity including **information disclosure**, attempts at **remote code execution** and **authentication bypass**, and a shift toward **data-leak extortion**, credential theft, and **edge-device exploitation**; the report also projected continued ransomware growth, particularly affecting healthcare and manufacturing.
Jun 29, 2026
Multiple organizations disclosed or were linked to **ransomware/data-extortion** activity with material operational or privacy impact. **Air Côte d’Ivoire** confirmed a cyberattack affecting parts of its information systems after **INC ransomware** claimed theft of **208 GB** and threatened to leak data, while the airline said it engaged the national CERT and external experts to contain impact and maintain flight operations. In the US healthcare sector, **University of Mississippi Medical Center (UMMC)** reported a ransomware incident that forced statewide clinic closures and disrupted access to **Epic** electronic medical records, prompting engagement with the **FBI** and **CISA** and use of downtime procedures to sustain patient care. Separately, **Conduent**’s earlier ransomware-linked breach continued to expand in scope, with breach notifications indicating at least **~25 million** people affected across multiple states and exposure of sensitive PII (including **SSNs** and health/insurance data). **Wynn Resorts** also confirmed an unauthorized party accessed and stole employee data after being listed by the **ShinyHunters** extortion group, with the company stating the actor claimed the data was deleted and that guest operations were not impacted. Other items in the set describe distinct, unrelated security events and broader threat research rather than the same incident: alleged data leaks involving **Burger King France** and **Wendy’s UK**; **Qilin** ransomware claims against a New York City transit union; Russian cyber operations against Ukraine’s power grid focused on intelligence collection; and a New Zealand healthcare application (**MediMap**) taken offline after apparent unauthorized access and **patient record tampering** (e.g., records marked deceased). Additional references cover threat research and trends (airline brand impersonation domains, edge-device exploitation telemetry, MuddyWater’s *Operation Olalampo*, Google Ads cloaking via **1Campaign**, freight/logistics phishing by “Diesel Vortex,” and various governance/AI/5G/quantum commentary), which provide context on the threat environment but do not substantively report on the same specific breach event.
Jun 29, 2026