The Week in Ransomware - May 17th 2024 - Mailbombing is back

This weekly intelligence summary reports active ransomware and cybercrime activity: CISA/FBI attribution that Black Basta affiliates breached over 500 organizations, large-scale phishing via the Phorpiex botnet enabling LockBit Black attacks, attempts to sell INC Ransom source code, and multiple operational impacts including MediSecure and Firstmac data incidents. The report also documents new STOP ransomware variants (several file extensions and ransom notes), observed TTPs such as MS‑SQL brute-force, PureCrypter delivery, and social engineering exploiting Windows Quick Assist, plus industry guidance from NCSC and insurers.