CVE-2024-54772

Ransomware and Wiper Attacks Disrupt Russian Businesses Across Industries in 2025-2026

Positive Technologies analysis reveals that ransomware and wiper attacks severely impacted Russian organizations throughout 2025 and early 2026, with 98% of incidents disrupting core business operations and a median downtime of seven days. Financially motivated groups and hacktivists each accounted for 44% of successful attacks, while small and medium businesses were targeted in 48% and 41% of cases respectively. Attackers primarily relied on social engineering in 53% of incidents, followed by credential compromise at 28% and vulnerability exploitation at 25%. Notable incidents included attacks on pharmacy chains Stolichki and VinLab, airline KrasAvia, and a major bakery producer in Vladimir region, with groups such as Thor, DarkGaboon, and Fluffy Wolf deploying tools like LockBit 3.0 and Pay2Key. One case involved the exploitation of CVE-2024-54772 in MikroTik RouterOS to establish persistent access before deploying BitLocker for encryption.