BRB, pausing for a "Sanctuary Moon" marathon
Summary: Cisco Talos Incident Response identified a new ransomware-as-a-service group called Chaos, which it assesses with moderate confidence was likely formed by former members of the BlackSuit (Royal) gang and which targets organizations of all sizes using phishing, remote management tool abuse, and double extortion. The same newsletter also notes that attackers exploited the SharePoint Server zero-day tracked as CVE-2025-53770 to compromise US government agencies and other businesses, and that Europol issued seven arrest warrants against the NoName057(16) DDoS collective.
What you should know: A new RaaS crew staffed by veterans of an established gang inherits proven tooling and double extortion playbooks, and Talos notes your company can be affected even if it is not the direct target, through partners or sector-wide tactics.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026