This week, the SonicWall Capture Labs threat research team analyzed a ransomware that not only encrypts files but also accuses the victim of harboring explicit content on their computer and then threatens to turn it over to authorities if ransom is not paid.
Extortion attacks often come as unsolicited emails, and GoZone has stooped to pretending to find explicit content on victims’ machines to extract payment. This ransomware is written in Go. It is apparent that it uses Chacha20 and RSA encryption packages as evidenced by its strings.
Read more…
Source: SonicWall Capture Labs
Related:
- Hackers are breaking into company networks via hacked CCTV camera software
October 29, 2026
Attackers abused camera management software to gain initial access and establish persistence on networks. Campaign used DLL sideloading and reverse shells to evade detection and maintain control. Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity. Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news and insights delivered ...
- Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat
October 28, 2026
GMO warned customers to back up data, disconnect devices, and shut down systems after a cyberattack. Attackers allegedly stole customer data, leaked information, and threatened ransomware deployment. Compromised trading-platform credentials and reports of unauthorized transactions raised concerns for affected users. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber security news and insights delivered ...
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
October 28, 2026
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data in a previously undisclosed breach at the government department earlier this year. The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, ...
- Data breach at Sony ISP subsidiary exposes 2.5 million customer records as Japan hit with another major cyberattack
October 28, 2026
A subsidiary of Sony Network Communications, the Japanese tech giant’s Internet Service Provider (ISP) arm, has confirmed suffering a data breach which saw it lose sensitive data on roughly 2.5 million people. Among the stolen files were people’s phone numbers, email addresses, and in some cases – email passwords. The company confirmed the news in an apology ...
- Rogue AI agent engages ‘Skynet mode’ to search the internet for exposed LLMs to hijack and run malware attacks
October 26, 2026
Researchers uncovered an autonomous AI attack campaign that hijacks exposed AI agents and infrastructure. The malicious “Skynet” agent deployed cryptominers, stole credentials, and recruited new AI systems autonomously. Security teams are urged to secure AI endpoints, restrict permissions, and protect high-value API keys. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber security news ...
- Patient records exposed in Quest breach
October 26, 2026
Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in ...