RansomHub Taps FakeUpdates to Target US Government Sector

Trend Micro researchers describe a multi-stage campaign dubbed "Water Scylla" in which SocGholish/FakeUpdates malvertising and rogue Keitaro TDS instances deliver RansomHub ransomware to victims—primarily US government organizations, with impacts also in banking, consulting, Japan, and Taiwan. The activity leverages compromised legitimate websites, obfuscated JavaScript loaders, domain shadowing, and rotating C2 infrastructure to increase infection success; the report highlights active exploitation, actor collaboration (including RaaS affiliates and ties to Scattered Spider), and recommends XDR, endpoint hardening, web reputation services, and network detection controls.