Iran-linked Pay2Key re-emerged and encrypted a US healthcare provider's infrastructure. Researchers say the group used credential harvesting and Active Directory-focused evasion to move laterally and completed encryption in about three hours. Separately, pro‑Ukraine group Bearlyfy has carried out 70+ attacks on Russian firms and now deploys a custom Windows ransomware called GenieLocker to demand larger ransoms.
Pro-Ukraine hacker group Bearlyfy targets Russian companies with custom ransomware
A pro-Ukrainian hacker group known as Bearlyfy has carried out more than 70 cyberattacks against Russian companies over the past year and is now escalating its campaign with newly developed ransomware tools, researchers have found.