Qilin Ransomware Administrator Identified as Aleksey Yakovtsev in St. Petersburg

Maersk Confirms Data Breach on Legacy LF Logistics System as WhiteArmor Ransomware Demands $5 Million

Shipping giant Maersk has confirmed a data breach affecting a company it acquired in 2022, with the WhiteArmor ransomware group claiming responsibility and demanding a $5 million ransom payment. The threat actor alleges theft of approximately 100 GB of data from the OCF/LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, and 27,842 mobile device logs. Maersk stated that the incident is isolated to a local system with no evidence of impact on other systems, customer data, or operations, and no sensitive information has been disclosed so far. The company emphasized that customers can continue using its booking and shipment management systems without disruption. This marks the second major ransomware incident for Maersk, following the 2017 NotPetya attack that forced the rebuild of over 4,000 servers and 45,000 workstations at a cost of up to $300 million. WhiteArmor has listed Maersk on its data leak site and given the company 30 days to pay the ransom in Bitcoin, highlighting the financial scale of the targeted logistics operations.

Threat Actors Target Qlik Sense Servers with Reverse Shells and Stage ActiveMQ and Veeam Exploits

Cybersecurity researchers at Cynet have detected threat actors attempting to compromise Qlik Sense servers by deploying PowerShell reverse shells in multiple environments during October 2026. The activity shows overlap with a 2023 campaign attributed to the CACTUS ransomware operation that exploited newly disclosed vulnerabilities in Qlik Sense Enterprise for Windows. Although the exact entry vector remains unknown, the commands were executed under scheduler.exe and attempted to establish persistence through additional payloads including a Windows Go reverse shell. The infrastructure also hosted exploits for Apache ActiveMQ CVE-2023-46604 and a modified Veeam toolchain targeting CVE-2024-40711, suggesting preparation for wider attacks. Earlier intrusions linked to CACTUS involved deployment of ManageEngine UEMS, AnyDesk, and Plink after initial access via the Qlik flaws. Cynet blocked the reverse shell attempts but confirmed the backdoor's use for reconnaissance and persistence mechanisms such as scheduled tasks and OpenSSH installation.

Ransomware Recovery Now Serves as Key Client Retention Metric for MSPs

Ransomware recovery has evolved beyond technical restoration into a critical factor for maintaining client trust and contract renewals among managed service providers. Even after systems are restored, clients often question delays in updates, unexpected costs, and gaps in communication that erode confidence in their MSP relationship. Industry data shows that only 16% of organizations fully recover within a day, while 55% take up to a week, amplifying business disruption and raising doubts about provider competence. Kaseya’s 2026 Cybersecurity Outlook report indicates that 12% of MSPs lose clients after security incidents including ransomware, account takeover, and business email compromise. Fragmented tools for backup, monitoring, ticketing, and billing create handoff failures, untracked emergency labor, and inconsistent client updates that turn successful restores into renewal risks. The solution lies in unified platforms like Kaseya Trifecta that integrate RMM, PSA, and BCDR to provide a single source of truth, faster resolution, and transparent billing. MSPs that track metrics such as time to first client update, time to restore, and time to invoice can close process gaps and protect long-term client relationships.