Loading story…
Advantest Corporation reported a cybersecurity incident in which an unauthorized party appears to have accessed parts of its network and deployed ransomware, impacting certain internal systems. The company said it detected unusual activity on Feb. 15 (JST), activated incident response procedures, isolated affected systems, and engaged third-party cybersecurity specialists to support investigation and containment; the investigation remains ongoing and findings may change as more facts are confirmed.
Public reporting echoed Advantest’s statement that the scope and responsible ransomware group are not yet identified, and noted the broader trend of increased ransomware targeting of industrial and manufacturing organizations, including the semiconductor sector. Advantest stated it will provide updates and, if the investigation determines customer or employee data was affected, it will notify impacted individuals directly with guidance on protective measures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By February 20, 2026, Advantest said it was continuing its investigation into the incident while assessing potential operational disruption and financial impact. At that time, no threat group had been publicly identified or claimed responsibility.
On February 19, 2026, Advantest publicly confirmed it was responding to a cybersecurity incident affecting parts of its internal network. The company said it would notify impacted individuals directly and provide guidance if customer or employee data exposure is confirmed.
Advantest's preliminary investigation found that an unauthorized third party had accessed parts of its network and may have deployed ransomware. The initial access vector, full scope of the intrusion, and whether data was stolen remained under investigation.
On February 15, 2026, Advantest detected unusual activity in its IT environment and activated incident response procedures. The company isolated affected systems and engaged third-party cybersecurity experts to help contain and investigate the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceadvantest.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Advantest**, a major semiconductor chip-testing company, was reported as being **hit by ransomware**, indicating a disruptive cyber incident affecting a critical supplier in the semiconductor manufacturing ecosystem. Public reporting did not provide detailed technical indicators, the initial access vector, or the scope of impacted systems, but the incident aligns with ongoing ransomware targeting of large enterprises and operationally critical technology providers. Separate reporting during the same period emphasized that ransomware operators and initial access brokers frequently gain entry via **network edge devices**, particularly **firewalls** exploited through known vulnerabilities or compromised accounts, and that legacy exposures can remain in active use for years. This broader trend context is consistent with ransomware tradecraft but is not specific attribution or confirmation of the intrusion method used against Advantest.
Jul 12, 2026
French industrial supplier **LISI Group** confirmed a cybersecurity incident affecting two ancillary sites after the **Qilin** ransomware gang claimed responsibility. The company said only a limited amount of information was stolen and that core operations and infrastructure were not impacted; however, data samples attributed to Qilin reportedly included internal business documents and sensitive records such as bank-transfer screenshots, bank account details, employee forms, contracts, and partner-related documentation. Dutch paints and coatings firm **AkzoNobel** also confirmed a contained intrusion limited to a single U.S. site following a leak attributed to the **Anubis** ransomware operation. Anubis claimed theft of roughly **170GB** (nearly **170,000 files**) and published partial leak samples allegedly including confidential client agreements, internal correspondence, passport scans, material testing documents, and technical specification sheets; AkzoNobel stated it is notifying impacted parties and coordinating with authorities. Separately, a BlackFog monthly ransomware roundup reported **82** publicly disclosed ransomware incidents in February 2026 (healthcare most targeted) and highlighted other claimed/extortion cases (e.g., **Everest** claims involving Hosokawa Micron and Iron Mountain), but it did not provide additional corroboration on the LISI Group or AkzoNobel incidents.
Jun 29, 2026
A major global equipment manufacturer suffered a severe ransomware attack orchestrated by the BlackSuit ransomware group, also known as Ignoble Scorpius. The attack began with a vishing (voice phishing) campaign in which an attacker impersonated the company's IT help desk and convinced an employee to enter their VPN credentials into a phishing site. Using these stolen credentials, the attackers gained initial access to the corporate network. Once inside, they escalated privileges by executing a DCSync attack on a domain controller, allowing them to steal highly privileged credentials, including those of a key service account. The attackers then moved laterally across the network using Remote Desktop Protocol (RDP), Server Message Block (SMB), and tools such as Advanced IP Scanner and SMBExec to map the environment and identify valuable assets. Persistence was established by deploying AnyDesk and a custom remote access trojan (RAT) as scheduled tasks on domain controllers. The threat actors compromised a second domain controller and extracted the NTDS.dit database, which contains all user password hashes, enabling further credential compromise. Over 400 GB of sensitive data was exfiltrated using a renamed rclone utility. To erase forensic evidence and hinder incident response, the attackers deployed CCleaner before launching the ransomware payload. The BlackSuit ransomware was deployed using Ansible, resulting in the simultaneous encryption of hundreds of virtual machines across nearly 60 VMware ESXi hosts, causing widespread operational disruption. The attackers demanded a $20 million ransom, which the organization refused to pay. In response, the manufacturer implemented several security measures, including upgrading to newer Cisco Adaptive Security Appliance firewalls, enforcing multi-factor authentication, segmenting the network, deactivating NTLM, and restricting administrative access to isolated VLANs. The incident highlights the significant risks posed by social engineering and credential theft, as well as the sophisticated tactics used by modern ransomware groups. The attack demonstrates the importance of robust incident response, credential hygiene, and layered security controls to mitigate the impact of such breaches. The use of legitimate remote access tools and living-off-the-land techniques by the attackers complicated detection and response efforts. The exfiltration of large volumes of sensitive data prior to encryption underscores the dual extortion tactics now common among ransomware operators. The manufacturer’s refusal to pay the ransom and rapid implementation of enhanced security controls serve as a case study in post-incident resilience. The attack also illustrates the growing trend of targeting virtualization infrastructure, such as VMware ESXi hosts, to maximize operational disruption. Security researchers and incident responders continue to analyze the tactics, techniques, and procedures (TTPs) used in this attack to inform defensive strategies for other organizations.
Jun 29, 2026