DanSec

Threat actor

RansomExx

In 4 briefs, most recently 19 August 2025. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. The Workday CRM breach, unpatched N-able N-central servers under active exploitation, and RansomExx's PipeMagic backdoor abusing a Windows flaw.
  2. The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
  3. Marks & Spencer customer data theft, Microsoft May 2025 Patch Tuesday with five zero-days, and SAP NetWeaver exploitation by ransomware gangs.
  4. Microsoft's 134-flaw Patch Tuesday with a zero-day, RansomEXX exploiting a Windows CLFS zero-day, and Mirai botnet attacks on TVT DVRs.