MeridianMeridian

Ransomware and Wiper Attacks Disrupt Russian Businesses Across Industries in 2025-2026

Positive Technologies analysis reveals that ransomware and wiper attacks severely impacted Russian organizations throughout 2025 and early 2026, with 98% of incidents disrupting core business operations and a median downtime of seven days. Financially motivated groups and hacktivists each accounted for 44% of successful attacks, while small and medium businesses were targeted in 48% and 41% of cases respectively. Attackers primarily relied on social engineering in 53% of incidents, followed by credential compromise at 28% and vulnerability exploitation at 25%. Notable incidents included attacks on pharmacy chains Stolichki and VinLab, airline KrasAvia, and a major bakery producer in Vladimir region, with groups such as Thor, DarkGaboon, and Fluffy Wolf deploying tools like LockBit 3.0 and Pay2Key. One case involved the exploitation of CVE-2024-54772 in MikroTik RouterOS to establish persistent access before deploying BitLocker for encryption.

HabrTranslated from Russian

Read at source

Positive Technologies has published a detailed study of ransomware and wiper attacks against Russian organizations, covering incidents from 2025 into early 2026. The research shows that such attacks caused operational disruption in 98% of cases, with median downtime reaching seven days for internal and external services.

Financially motivated groups carried out 44% of successful attacks, primarily seeking ransom payments, while hacktivist groups accounted for another 44%, focusing on sabotage and data destruction. Hacktivists were responsible for 88% of wiper attacks, compared to only 6% from financially motivated actors.

Small and medium businesses were the most frequent targets, hit in 48% of financially motivated attacks and 41% of hacktivist incidents. Large enterprises faced 37% and 39% respectively. Non-profit organizations were targeted more often by hacktivists (15%) than by profit-driven groups (6%).

Industry distribution showed the highest share of ransomware and wiper attacks in services (67%) and telecom (71%), though absolute numbers were lower than in manufacturing. In industry, these attacks represented 30% of incidents, while IT companies saw 38%, and both transport and retail recorded 43%.

Real-world examples include the July 2025 attack on pharmacy chain Stolichki, which forced many stores to close and disrupted loyalty program access for over a week. Retailer VinLab suffered a similar incident affecting more than 2,100 locations, with full infrastructure recovery taking over a month. Airline KrasAvia had to switch to manual operations after its systems were hit, and a major bakery producer in Vladimir region operated without IT systems for two months.

Initial access methods were dominated by social engineering (53%), credential compromise (28%), and exploitation of vulnerabilities (25%). Groups such as DarkGaboon and Fluffy Wolf used phishing emails themed around accounting documents or tax authorities, often delivering LockBit 3.0 or Pay2Key. The group Thor struck over 100 organizations across 19 sectors between May and November 2025.

In one case, attackers exploited CVE-2024-54772 in MikroTik RouterOS to create a tunnel and later deployed BitLocker for encryption. Another incident involved the wiper consumerWiper distributed as a malicious MSI installer. Supply-chain compromises accounted for 8% of entries, often through less-protected contractors.

ThorLockBit 3.0CVE-2024-54772DarkGaboonFluffy WolfMythic Likho
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Ransomware & Extortion

Tape Libraries Provide Air-Gapped Defense Against Ransomware Targeting Backup Systems
Ransomware & Extortion

Tape Libraries Provide Air-Gapped Defense Against Ransomware Targeting Backup Systems

Modern ransomware attacks increasingly target backup repositories first to eliminate recovery options before encrypting production data. Tape libraries remain the only widely deployed medium that stays physically disconnected from networks during storage, making them immune to remote encryption or deletion. The article details how LTO generations from LTO-7 to LTO-10 deliver capacities up to 30 TB native per cartridge, with WORM mode ensuring immutability for regulatory compliance. Selectel offers rental of Quantum, HPE, and IBM tape libraries integrated with backup software such as Veeam, Bacula, and Bareos through Fibre Channel or SAS connections. The service supports the 3-2-1-1-0 backup methodology by combining object storage with offline tape copies and optional offsite cartridge storage. Organizations in finance, telecom, and healthcare can meet long-term retention and immutability requirements without large capital expenditures.

HabrOct 31, 2026Translated from Russian

Cerber Ransomware Variant C3RB3R Targets Synology NAS Devices via Two Recently Disclosed Vulnerabilities
Ransomware & Extortion

Cerber Ransomware Variant C3RB3R Targets Synology NAS Devices via Two Recently Disclosed Vulnerabilities

Since October this year, 360 Anti-Ransomware teams have responded to multiple incidents involving encryption attacks on Synology NAS appliances. Analysis by 360 AI security experts identified the threat as C3RB3R, a variant of the long-standing Cerber ransomware family that has historically focused on NAS targets. Attackers leveraged two high-risk remote vulnerabilities disclosed only one month earlier, CVE-2026-13639 and CVE-2026-13684, in classic 1-day exploitation scenarios. After gaining access, the malware follows traditional ransomware behavior: it scans file systems while skipping 27 system directories and specific extensions, then encrypts files using ChaCha8 combined with RSA-2048 before appending the .L0CK3D extension and dropping ransom notes. Synology released patches for eight vulnerabilities, including the two exploited ones, across multiple DSM versions starting 18 September 2026. The report includes detailed encryption logic, a full list of 187 priority extensions, and a set of practical hardening recommendations for NAS administrators.

安全客Oct 30, 2026Translated from Chinese

Ransomware Group Emperador Claims 3.9 GB Data Theft from AB InBev
Ransomware & Extortion

Ransomware Group Emperador Claims 3.9 GB Data Theft from AB InBev

The ransomware group Emperador has added AB InBev, the manufacturer of Budweiser and Corona beers, to its list of alleged victims. The group claims to possess 3.9 GB of internal data and is demanding a $1 million Bitcoin ransom. The listing includes 329,244 social listening alerts, 2,510 corporate emails from subsidiaries, around 19,000 access records, internal service portal logs, and public key infrastructure certificates. Most of the data volume, 3.2 GB, is attributed to Azure storage assets. AB InBev has neither confirmed nor denied the claims, and no samples have been published to verify authenticity. The announcement provides no details on how the data was allegedly obtained, such as an exposed storage account or leaked credentials. While access records and certificates could aid network mapping and lateral movement, the lack of private keys or confirmed encryption of systems limits the immediate impact assessment.

BoletimSecOct 27, 2026Translated from Portuguese