Malware & Ransomware coverage from Sandbox Dispatch holds 13 articles, 10 of them reference guides. The newest was published on October 13, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include UK National Cyber Security Centre and CISA: Stop Ransomware.
Attackers tested a critical arbitrary file access vulnerability in Atlassian Data Center products within two hours of technical details being released by watchTowr.
A 24-hour spike shows N0N dominating ransomware activity with 14 claims, while US firms face the highest volume of reported breaches across multiple sectors.
Germany jailed a Russian suspect linked to Qilin ransomware after extradition from Japan, yet the group continues targeting victims.
Clipboard hijackers operate silently in memory, swapping your cryptocurrency wallet address with an attacker’s address the moment you copy it.
Legitimate executables often load unsigned libraries from unexpected directories, masking malicious code as routine background processes.
Remote access tools give attackers the same control you have, turning your convenience into a permanent security hole that standard antivirus often ignores.
Most malware leaves no files on the disk, so you must analyze volatile memory to find processes that exist only while the computer is running.
Mobile malware often hides inside legitimate apps, using system permissions you granted to bypass standard security controls and steal data silently.
Most script blocking failures stem from allowing scripts in the wrong execution context, not from missing signatures or weak perimeter defenses.
Malware removal fails not because scanners miss files, but because the operating system actively restores deleted components through hidden persistence hooks.
Extended detection and response correlates siloed telemetry to find attacks that bypass single-layer security controls, revealing hidden lateral movement across your infrastructure.
Most ransomware decryption tools only work because the criminals made a mistake in their encryption logic, not because law enforcement cracked the code.
Persistence relies on the operating system’s startup routines, turning legitimate system features into reliable backdoors that survive reboots and user logoffs.