Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang

Fortinet FortiGuard Labs identified a new Phobos ransomware variant named "Faust" delivered via a malicious XLAM Excel add-in that downloads Base64-encoded payloads from Gitea, drops a faux "AVG updater.exe" downloader, and executes fileless shellcode to perform file encryption; the report also surveys related ransomware families, common TTPs (including TeamViewer and LockBit builder abuse), and declining victim ransom-payment rates.