MOXFIVE @mox_five

First observed in 2023, INC Ransom has rapidly emerged as one of the most active ransomware groups of 2025, operating under a Ransomware-as-a-Service (RaaS) model. The INC RaaS model allows affiliates to deploy the ransomware, most often using double-extortion tactics —…

Reminder to sign up for our next webinar - Next-Gen Data Mining: Bridging Legal Strategy with Technical Precision - on Tuesday, Sept. 23rd at 2pm ET! Our expert panel - Lee Trotter from MOXFIVE, Eric Benson from McDonald Hopkins, and Nadeema Safi from ACTFORE - will cover: 🔸…

Join us for our next webinar - Next-Gen Data Mining: Bridging Legal Strategy with Technical Precision - on Tuesday, Sept. 23rd at 2pm ET! In today’s fast-evolving cybersecurity and data privacy landscape, effective incident response requires seamless coordination across legal,…

Our latest MOXFIVE Monthly Insights is out! July brought a surge in ransomware activity with Inc. emerging as the most deployed variant, overtaking Akira and Qilin. The Technology sector was the most targeted, followed by Healthcare and Manufacturing. Several campaigns deploying…

🚨Salesforce Campaign by ShinyHunters: What You Should Know A sophisticated social engineering campaign is targeting major organizations by impersonating IT help desk staff to gain access to Salesforce data. The campaign is believed to be attributed to ShinyHunters. However, the…

🚨 SonicWall Vulnerability Exploited in August Akira Campaign Recent Akira ransomware intrusions have been linked to CVE-2024-40766, a previously disclosed vulnerability affecting SonicWall firewall appliances. Initial reporting suggested the possibility of a zero-day…

In the first half of 2025, Play (also known as Playcrypt) was one of the most active ransomware groups, publicly naming more than 200 victims. The group claims to operate as a closed set of threat actors and employs a double extortion model, exfiltrating data before encryption to…

If you missed our MOXFIVE Mid-Year Ransomware Briefing yesterday, no worries, the replay is now available on our website! Watch now at bit.ly/3IU6L5y If you have any questions or would like more information on a topic discussed, just reach out to us! #ransomware…

Reminder that it's not too late to register for our MOXFIVE Mid-Year Ransomware Briefing TOMORROW - Wednesday, July 30th at 2pm ET! Join Lee Trotter, John Beers, Dylan Duncan, and Justin Boncaldo to discuss key trends for cyber incidents so far this year and practical strategies…

📢 Shout out to Michael Rogers and Sara Watts for teaching three classes and running a ransomware simulation for high schoolers participating in the University of South Florida's High School CyberCon yesterday! We love seeing our team supporting their local cybersecurity…

📢 Stay Up to Date on Emerging Cyber Threats with MOXFIVE Monthly Insights! This month’s report highlights steady ransomware activity, notably driven by Qilin and DragonForce. Learn how these threat actors are evolving, absorbing former RansomHub affiliates, and adapting their…

Our latest MOXFIVE Threat Spotlight is out focusing on World Leaks! Emerging in January of this year, World Leaks has adopted a single-extortion model that focuses exclusively on data theft and public exposure—without relying on file encryption. Believed to be a rebrand of the…

Join us on Wednesday, July 30th for our Mid-Year Ransomware Briefing! Our team will review the key developments and trends so far in 2025 and what's working/not working for risk mitigation. We'll also take a deeper look at Scattered Spider and share some lessons learned from…

We’re thrilled that MOXFIVE has been named an @Inc Best Workplaces Honoree for 2025 – our third time on the list! What excites us most isn't the accolade itself, but what it signifies: that we're creating something meaningful at MOXFIVE. We believe our culture is a key…

In May we continued to see an overall dip in ransomware activity, due in part to the disappearance of the RansomHub leak site last month. It also likely contributed to the significant rise in Qilin-related incidents as it moved up to become the second most active ransomware…

While we're busy tackling complex threats, we often overlook simple maintenance tasks that can make a huge difference. With summer is right around the corner, now is the perfect time to get some spring cleaning done and give your organization's cybersecurity posture a thorough…

Scattered Spider has reemerged in 2025 as a major threat, leveraging social engineering, Living off the Land (LOTL) techniques, and ransomware-as-a-service (RaaS) partnerships to target high-profile retail and e-commerce entities in the UK and US. Despite a wave of law…

If you missed the Ransomware Advisory Board session at NetDiligence® in San Diego earlier this month, it's now available on-demand at bit.ly/3HjPnGB! #ransomware #incidentresponse #ir #cybersecurity #cyberrisksummit