New ransomware group uses phone calls to pressure victims, researchers say

Researchers disclosed a new ransomware operator called "Volcano Demon" that has executed at least two recent attacks against manufacturing and logistics firms using a new variant named LukaLocker; the actors exfiltrated data prior to encrypting systems (double extortion), exploited common administrative credentials, cleared logs to frustrate forensic analysis, and rely on threatening phone calls rather than a public leak site to pressure victims.