UK Government Agency Warns AI-Powered Malware in Ransomware Attacks on Critical Infrastructure Is Highly Likely by 2028

Ransomware and Wiper Attacks Disrupt Russian Businesses Across Industries in 2025-2026

Positive Technologies analysis reveals that ransomware and wiper attacks severely impacted Russian organizations throughout 2025 and early 2026, with 98% of incidents disrupting core business operations and a median downtime of seven days. Financially motivated groups and hacktivists each accounted for 44% of successful attacks, while small and medium businesses were targeted in 48% and 41% of cases respectively. Attackers primarily relied on social engineering in 53% of incidents, followed by credential compromise at 28% and vulnerability exploitation at 25%. Notable incidents included attacks on pharmacy chains Stolichki and VinLab, airline KrasAvia, and a major bakery producer in Vladimir region, with groups such as Thor, DarkGaboon, and Fluffy Wolf deploying tools like LockBit 3.0 and Pay2Key. One case involved the exploitation of CVE-2024-54772 in MikroTik RouterOS to establish persistent access before deploying BitLocker for encryption.

Tape Libraries Provide Air-Gapped Defense Against Ransomware Targeting Backup Systems

Modern ransomware attacks increasingly target backup repositories first to eliminate recovery options before encrypting production data. Tape libraries remain the only widely deployed medium that stays physically disconnected from networks during storage, making them immune to remote encryption or deletion. The article details how LTO generations from LTO-7 to LTO-10 deliver capacities up to 30 TB native per cartridge, with WORM mode ensuring immutability for regulatory compliance. Selectel offers rental of Quantum, HPE, and IBM tape libraries integrated with backup software such as Veeam, Bacula, and Bareos through Fibre Channel or SAS connections. The service supports the 3-2-1-1-0 backup methodology by combining object storage with offline tape copies and optional offsite cartridge storage. Organizations in finance, telecom, and healthcare can meet long-term retention and immutability requirements without large capital expenditures.

Cerber Ransomware Variant C3RB3R Targets Synology NAS Devices via Two Recently Disclosed Vulnerabilities

Since October this year, 360 Anti-Ransomware teams have responded to multiple incidents involving encryption attacks on Synology NAS appliances. Analysis by 360 AI security experts identified the threat as C3RB3R, a variant of the long-standing Cerber ransomware family that has historically focused on NAS targets. Attackers leveraged two high-risk remote vulnerabilities disclosed only one month earlier, CVE-2026-13639 and CVE-2026-13684, in classic 1-day exploitation scenarios. After gaining access, the malware follows traditional ransomware behavior: it scans file systems while skipping 27 system directories and specific extensions, then encrypts files using ChaCha8 combined with RSA-2048 before appending the .L0CK3D extension and dropping ransom notes. Synology released patches for eight vulnerabilities, including the two exploited ones, across multiple DSM versions starting 18 September 2026. The report includes detailed encryption logic, a full list of 187 priority extensions, and a set of practical hardening recommendations for NAS administrators.