Loading story…
Fresenius, Europe’s largest private hospital operator, disclosed a ransomware incident that disrupted parts of its global technology environment while saying patient care continued. Reporting on the attack cited Snake ransomware as the likely cause, a strain associated with targeting large enterprises and stealing unencrypted files before locking systems. The company said it detected a computer virus, activated containment measures, and notified authorities, but did not provide technical details or say whether it would pay a ransom.
Honda also investigated network disruptions in Europe and Japan that were widely linked to SNAKE/EKANS ransomware. Researchers said a malware sample appeared tailored for Honda, checking for the internal domain mds.honda.com and referencing an IP tied to the company, indicating deliberate targeting rather than opportunistic spread. The incidents unfolded amid broader warnings from INTERPOL that cybercriminals were intensifying ransomware attacks against critical healthcare institutions, underscoring how Snake operators were pursuing both industrial and healthcare organizations.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
INTERPOL said in April 2020 that it had detected a significant increase in attempted ransomware attacks against organizations involved in the COVID-19 response, including critical healthcare institutions.
Researchers identified a Snake ransomware sample that checked for the internal domain "mds.honda.com" and referenced IP address 170.108.71.15, which resolved to a Honda hostname. These artifacts were described as strong indicators that Honda was the intended target.
Honda confirmed that its IT network was not functioning properly in Europe and Japan and said it was investigating the issue. The company initially said Japanese production, dealers, and customers were not affected, and later said business impact appeared minimal.
A source cited by KrebsOnSecurity said the Fresenius incident affected operations globally and identified the apparent culprit as Snake ransomware. The report also noted that Snake operators were known to steal unencrypted files before encrypting systems.
Fresenius said its IT security detected a computer virus on company systems, took precautionary steps to prevent further spread, and informed relevant investigating authorities. The incident disrupted parts of its operations, though the company said patient care continued.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourcebleepingcomputer.com
Open sourcekrebsonsecurity.com
Open sourceinterpol.int
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Snake** (also known as **EKANS**) was used in targeted intrusions against industrial organizations, including reported victims such as **Honda** and **Enel Group**, with malware samples customized for specific environments. Analysis showed the ransomware embedded an internal domain name and expected IP address, then encrypted files only if DNS resolution matched the hard-coded value, indicating deliberate victim validation and an effort to prevent execution outside the intended network. Researchers assessed the ransomware was typically deployed as the final stage of a multistage compromise after attackers obtained privileged access, likely including compromised domain administrator credentials used to spread the payload through domain policies. Technical analysis of a Golang-based, Gobfuscate-obfuscated sample found Snake checked the victim environment through WMI and avoided encrypting **primary** or **backup domain controllers**, instead dropping a ransom note, while using those systems to preserve propagation capability. On non-controller hosts, the malware enabled and reconfigured Windows Firewall, killed numerous security and industrial-related processes and services, deleted shadow copies, and encrypted files using per-file **AES-CTR** keys protected with **RSA-2048 OAEP**; encrypted files were marked with the string `EKANS`. The malware also retained behavior relevant to operational technology environments, including attempts to terminate **General Electric ICS-related processes**, reinforcing concerns about its impact on industrial operations.
Aug 15, 2026
McLaren Health Care confirmed it was hit by a ransomware attack that disrupted clinical and business operations across its Michigan network, forcing the organization to rely on downtime procedures and warning that recovery would extend into September. Follow-up reporting said McLaren was still restoring systems weeks later and had not yet determined whether patient or employee data had been accessed or stolen, leaving the scope of any data compromise unclear as the health system worked to bring affected services back online. Ascension, one of the largest U.S. health systems, also suffered a major cyberattack that caused widespread outages, diverted ambulances, and disrupted electronic health records, phone systems, and other care operations; reporting at the time linked the incident to suspected **Black Basta** ransomware activity. Later disclosures said the attack resulted in a data breach affecting **5.6 million people**, exposing personal, insurance, medical, and payment-related information and underscoring how ransomware incidents in healthcare can escalate from operational disruption to large-scale compromise of sensitive patient data.
Jul 12, 2026
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026