Security bugs in ransomware leak sites helped save six companies from paying hefty ransoms

A security researcher audited command-and-control and data-leak web panels for over 100 ransomware/extortion groups and found trivial security flaws (default credentials, exposed directories/APIs, and an IDOR) that revealed server IPs, targets in progress, and two decryption keys; his actions helped two victims recover data and alerted four crypto firms before encryption occurred, illustrating both the active ransomware threat and opportunities for disruption.