Loading story…
Danish hosting and email provider webhot.dk disclosed a serious ransomware attack that forced it to take all systems offline and begin a full reconstruction of its environment. According to the company’s incident notice and subsequent reporting, the outage began on July 15 after a major security incident, and investigators concluded within hours that normal restoration was not possible. The provider rebuilt core systems from scratch rather than attempting a standard recovery.
webhot.dk said email service was restored later, but all email received before restoration was permanently lost, creating a significant data-loss event for customers. The company also required users to recreate accounts during recovery, and reports noted an unusual verification process that asked customers to provide the first or last three characters of their password along with their public IPv4 address, raising concerns about the sensitivity of the recovery workflow.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
On July 17, 2026 at 15:22, webhot.dk restored email service. The company said all email received before that time was permanently lost and that user accounts would need to be recreated during recovery.
By early July 16, 2026, the company's investigation concluded that normal restoration was not possible. webhot.dk decided to fully rebuild its systems as part of recovery from the incident.
webhot.dk disclosed that it shut down all systems on July 15, 2026 at 19:22 following a major security incident. The outage affected the provider's hosting and email services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Washington Hotel (WHG Hotels/Fujita Kanko Inc.) in Japan** disclosed a **ransomware infection** after attackers gained **unauthorized access to multiple servers**, impacting parts of its internal network. The intrusion was detected on **February 13, 2026, around 22:00 local time**, prompting IT staff to **disconnect external/internet access** to contain spread; the company also notified **law enforcement**, formed an internal **task force**, and brought in **external cybersecurity experts** to investigate root cause, scope, and recovery. Initial findings indicate the attacker accessed **various business-related data** on affected servers, while the company said **customer membership/loyalty data** (including the “Washington Net” program) is likely unaffected because it is hosted/managed on **separate third-party systems** with no confirmed unauthorized access. Operational impact was described as limited, though some properties experienced **temporary credit card terminal outages**; broader guest services reportedly remained functional, and restoration is underway while the company evaluates potential **business/financial impact**. As of reporting, **no ransomware group had publicly claimed** the incident on monitored extortion sites.
Jun 29, 2026
**Kyowon Group**, a major South Korean education and lifestyle conglomerate, confirmed it suffered a **ransomware attack** that disrupted operations and forced the company to shut down parts of its internal network to contain the incident. Kyowon reported detecting abnormal activity and isolating affected servers, with multiple affiliate websites and services becoming inaccessible during recovery efforts. The company said it notified the **Korea Internet & Security Agency (KISA)** and is working with government authorities and external security specialists to investigate the cause and scope. Kyowon stated there are indications of **external data leakage** and later confirmed that an attacker **exfiltrated data**, while it continues to determine whether **customer information** was included. Korean media reporting cited in coverage suggested the potential exposure could involve **millions of accounts** and that a large portion of Kyowon’s server estate may have been impacted; reporting also indicated the attackers issued an **extortion demand**. Kyowon said it will provide transparent updates and notify customers if the investigation confirms customer data was affected.
Jun 29, 2026
A major global equipment manufacturer suffered a severe ransomware attack orchestrated by the BlackSuit ransomware group, also known as Ignoble Scorpius. The attack began with a vishing (voice phishing) campaign in which an attacker impersonated the company's IT help desk and convinced an employee to enter their VPN credentials into a phishing site. Using these stolen credentials, the attackers gained initial access to the corporate network. Once inside, they escalated privileges by executing a DCSync attack on a domain controller, allowing them to steal highly privileged credentials, including those of a key service account. The attackers then moved laterally across the network using Remote Desktop Protocol (RDP), Server Message Block (SMB), and tools such as Advanced IP Scanner and SMBExec to map the environment and identify valuable assets. Persistence was established by deploying AnyDesk and a custom remote access trojan (RAT) as scheduled tasks on domain controllers. The threat actors compromised a second domain controller and extracted the NTDS.dit database, which contains all user password hashes, enabling further credential compromise. Over 400 GB of sensitive data was exfiltrated using a renamed rclone utility. To erase forensic evidence and hinder incident response, the attackers deployed CCleaner before launching the ransomware payload. The BlackSuit ransomware was deployed using Ansible, resulting in the simultaneous encryption of hundreds of virtual machines across nearly 60 VMware ESXi hosts, causing widespread operational disruption. The attackers demanded a $20 million ransom, which the organization refused to pay. In response, the manufacturer implemented several security measures, including upgrading to newer Cisco Adaptive Security Appliance firewalls, enforcing multi-factor authentication, segmenting the network, deactivating NTLM, and restricting administrative access to isolated VLANs. The incident highlights the significant risks posed by social engineering and credential theft, as well as the sophisticated tactics used by modern ransomware groups. The attack demonstrates the importance of robust incident response, credential hygiene, and layered security controls to mitigate the impact of such breaches. The use of legitimate remote access tools and living-off-the-land techniques by the attackers complicated detection and response efforts. The exfiltration of large volumes of sensitive data prior to encryption underscores the dual extortion tactics now common among ransomware operators. The manufacturer’s refusal to pay the ransom and rapid implementation of enhanced security controls serve as a case study in post-incident resilience. The attack also illustrates the growing trend of targeting virtualization infrastructure, such as VMware ESXi hosts, to maximize operational disruption. Security researchers and incident responders continue to analyze the tactics, techniques, and procedures (TTPs) used in this attack to inform defensive strategies for other organizations.
Jun 29, 2026