[play]

July 17, 2026

• PLAY ransomware added Swedish direct-marketing firm Svensk Direktreklam to its leak site among five new victims (DarkWebInformer, FalconFeeds). · Threat Activity

in Live SonicWall Exploitation, a New C2 Release, and AI Agents Tricked Into Running Attacker Commands

June 29, 2026

• Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA ("if there is access, there is a target") and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer) · Threat Activity

in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week