Loading story…
Michigan State University said its network was breached by the NetWalker ransomware gang, which claimed to have stolen university data and threatened to publish it unless a ransom was paid within days. The attackers posted alleged proof of compromise, including directory listings, a passport scan, and financial documents, but the university did not disclose the intrusion timeline, operational disruption, or ransom demand. The incident reflected NetWalker’s broader shift toward larger enterprise and institutional victims in the US, Australia, and Western Europe.
Security researchers said NetWalker operators combined commodity remote-access tools such as TeamViewer, AnyDesk, and PsExec with credential theft, SMB-based lateral movement, and exploitation of known flaws including CVE-2020-0796 and weaknesses in outdated Tomcat or WebLogic servers or exposed RDP. Analyses of recovered samples showed a heavily obfuscated multi-stage PowerShell loader that injects the ransomware into explorer.exe, deletes shadow copies, dynamically resolves APIs to hinder analysis, and uses a layered cryptographic scheme based on X25519, ChaCha8, and HMAC-SHA256; Sophos also reported the gang used legitimate antivirus uninstallers to disable ESET, Trend Micro, and Microsoft protections and distributed unique DLL builds per victim.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CERT-AGID published a technical analysis concluding that NetWalker itself does not exfiltrate data or use network communication during encryption. The report described the malware's PowerShell-delivered DLL execution, encrypted JSON configuration, and cryptographic design based on X25519, ChaCha8, and HMAC-SHA256.
Michigan State University was listed by the Netwalker ransomware gang, which claimed to have stolen data and set a roughly six-day deadline for payment before public release. The attackers posted alleged proof including directory listings, a passport scan, and financial documents.
SophosLabs reported on a Netwalker ransomware campaign after recovering attacker tooling and at least 12 archived deployment packages. The research detailed use of legitimate remote-access tools, credential theft utilities, public exploit code, and enterprise-focused lateral movement methods, and noted IOCs were published on GitHub.
A reverse-engineering blog analyzed a Netwalker sample and described a three-stage obfuscated PowerShell loader that XOR-decrypted payloads, compiled C# via Add-Type, and injected the ransomware into explorer.exe. The analysis also documented API hashing, missing MZ headers, and anti-memory-forensics techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
en.wikipedia.org
Open sourcecert-agid.gov.it
Open sourcebleepingcomputer.com
Open sourcenews.sophos.com
Open sourcetccontre.blogspot.com
Open sourceen.wikipedia.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NetWalker, also tracked as **Mailto** and **Koko**, emerged in 2019 as a ransomware family that increasingly targeted enterprise networks and later matured into a **ransomware-as-a-service (RaaS)** operation. Early campaigns used spam lures, including COVID-19-themed emails carrying a Visual Basic Script dropper, while other intrusions were linked to exposed **RDP**, vulnerable **Pulse Secure VPN** (`CVE-2019-11510`), **Telerik UI** (`CVE-2019-18935`), Oracle WebLogic, and Apache Tomcat. The malware encrypted Windows systems, deleted shadow copies, appended victim-specific extensions such as `.mailto[{mail1}].{id}`, and dropped ransom notes like `{ID}-Readme.txt`; over time, operators shifted from email-based negotiations to **Tor** payment portals and leak sites.
Aug 15, 2026
Sophos reported that the ransomware group **Warlock Group**, tracked as **GOLD SALEM**, has been compromising enterprise networks and deploying **Warlock ransomware** since March 2025, with 60 publicly named victims through mid-September across North America, Europe, and South America. The operation used a Tor-based leak site, activity on underground forums, and possibly relationships with initial access brokers to support intrusions and extortion. Observed attacks began with exploitation of the **SharePoint ToolShell** exploit chain, followed by deployment of an **ASPX web shell** and a Golang-based WebSockets backdoor for persistence. Sophos said the actors stole credentials with **Mimikatz**, moved laterally with **PsExec** and **Impacket**, deployed ransomware through **Group Policy Objects**, and disabled endpoint protection using a **bring-your-own-vulnerable-driver** technique involving a vulnerable **Baidu Antivirus** driver; investigators also observed abuse of **Velociraptor** to establish a **Visual Studio Code** network tunnel. Microsoft tracks the activity as **Storm-2603** and assesses it with moderate confidence as China-based, though Sophos said it could not independently confirm that attribution.
Jun 29, 2026
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026