Why are once-dominant ransomware gangs collapsing at such a rapid pace?

Why are once-dominant ransomware gangs collapsing at such a rapid pace?

The ransomware landscape is experiencing unprecedented turbulence in 2025, characterized by the rapid collapse of once-dominant groups, hostile takeovers, and internal betrayals. This upheaval has exposed deep instability within the cybercriminal ecosystem, as major ransomware-as-a-service (RaaS) outfits such as RansomHub, LockBit, Everest, and BlackLock have faced abrupt shutdowns, operational failures, and even public defacements of their dark web infrastructure. What brought these powerful groups to their knees?
Researchers discover vulnerabilities in Bluetooth chipsets that can be exploited for eavesdropping and data theft.

Researchers discover vulnerabilities in Bluetooth chipsets that can be exploited for eavesdropping and data theft.

A serious set of vulnerabilities has been identified in Bluetooth chipsets used in more than two dozen audio devices from ten major vendors, including Beyerdynamic, Bose, Sony, Marshall, Jabra, JBL, Jlab, EarisMax, MoerLabs, and Teufel. These chipsets, manufactured primarily by Airoha, are widely used in True Wireless Stereo (TWS) earbuds, headphones, speakers, and wireless microphones.
Secret Easter egg discovered in 27-year-old Power Macintosh G3 that shows entire develpment team behind the classic Apple computer.

Secret Easter egg discovered in 27-year-old Power Macintosh G3 that shows entire develpment team behind the classic Apple computer.

A recently uncovered Easter egg in the ROM code of the 27-year-old Power Macintosh G3 reveals a hidden image of the development team behind this classic Apple computer. The secret was unearthed by software engineer Doug Brown, who discovered the method to display this long-hidden JPEG after years of the image being known but inaccessible to users.
Patient’s death officially linked to 2024 ransomware attack that brought down London hospitals.

Patient’s death officially linked to 2024 ransomware attack that brought down London hospitals.

A patient’s death has been officially confirmed as linked to the June 2024 ransomware attack on Synnovis, a pathology services provider for the UK’s National Health Service (NHS), particularly affecting hospitals in southeast London. The attack was carried out by the Qilin ransomware group and severely disrupted diagnostic and pathology services, including blood testing and transfusion services.
Researchers find Remcos malware remains highly active into 2025 with attackers adapting their techniques to bypass protections.

Researchers find Remcos malware remains highly active into 2025 with attackers adapting their techniques to bypass protections.

Cybersecurity experts at Forcepoint’s X-Labs are raising alarms about the ongoing and evolving threat posed by Remcos malware. Their research highlights that Remcos remains highly active through 2024 and into 2025, with attackers continually adapting their techniques to bypass security measures and maintain a stealthy presence on infected computers.
CTA call to action urges businesses to begin the transition to quantum-resistant cryptography immediately.

CTA call to action urges businesses to begin the transition to quantum-resistant cryptography immediately.

The Cyber Threat Alliance (CTA) has joined a growing consensus among cybersecurity experts and organizations urging businesses to begin transitioning to quantum-resistant cryptography immediately. Their recent report, Approaching Quantum Dawn: Closing the Cybersecurity Readiness Gap Before It’s Too Late, emphasizes that quantum risk is not a distant threat but a present one, as attackers are already employing tactics like “Harvest Now, Decrypt Later.” In these attacks, adversaries steal encrypted data now with the intent to decrypt it once quantum computers become powerful enough to break current encryption methods.
Norway’s Lake Risevatnet dam is hacked giving remote control to attackers who opened valves to full capacity.

Norway’s Lake Risevatnet dam is hacked giving remote control to attackers who opened valves to full capacity.

Authorities say that in April 2025, Norway’s Lake Risevatnet dam, located near the city of Svelgen in Southwest Norway, was the target of a cyberattack. Unidentified hackers gained unauthorized access to a remote control panel managing a valve at the dam. They opened the valve to full capacity, which led to an extra 497 liters per second flowing beyond the mandated minimum water discharge for nearly four hours before the breach was detected.