SiteCountry Blog

Sign in Subscribe

Cybersecurity

Technician reviewing a warning screen in a server room during a StormEncryptor ransomware incident response

StormEncryptor Ransomware: What Hosting Customers Need to Know About the N-central Attack Chain

A China-linked threat actor known as Storm-1175 has been observed deploying a previously undocumented ransomware strain called StormEncryptor, with researchers pointing to an N-central vulnerability as the likely intrusion vector.

Cybersecurity analyst reviewing blockchain transaction data on dual monitors while working through a ransomware incident

DeadLock Ransomware Turns to Polygon Smart Contracts for Harder-to-Kill Extortion Sites

A new ransomware operation called DeadLock is storing extortion infrastructure on Polygon smart contracts and the Session messaging network, making victim shaming sites much harder to take offline.

Office workstation at night showing a Windows Safe Mode boot screen, illustrating a ransomware Safe Mode attack scenario.

Akira Ransomware Safe Mode Attack: Why It Failed and What It Teaches Defenders

An Akira ransomware affiliate tried to disable endpoint security by forcing a Safe Mode reboot, but the stripped-down environment starved the encryptor of memory. The incident still ended in data theft, and it highlights why MFA and boot-mode alerting matter.

Network operations center monitoring perimeter firewall appliances and patch dashboards during a ransomware response.

Gunra Ransomware Targeting Critical Infrastructure: What Website and Hosting Operators Should Know

US federal agencies warn that Gunra ransomware affiliates are exploiting Fortinet vulnerabilities to break into critical infrastructure networks, steal data, and encrypt systems.

Network operations center monitoring Fortinet appliances and industrial control dashboards during a ransomware incident

Gunra Ransomware Targeting Fortinet and Schneider Electric Edge Devices

A joint South Korean and U.S. advisory warns that Gunra ransomware operators are chaining Fortinet and Schneider Electric vulnerabilities to breach critical infrastructure networks worldwide.

Security team monitoring TeamCity build server dashboards and network alerts in an operations center

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation

CISA has confirmed active exploitation of a critical TeamCity deserialization vulnerability, CVE-2026-63077. Here is what website owners and DevOps teams running on-premise build servers need to do next.

Security analyst reviewing CISA Known Exploited Vulnerabilities catalog entries on a dual-monitor workstation inside a dimly

CISA Adds Langflow, Tomcat, and N-central Flaws to the KEV Catalog: What Website Owners Should Do

On August 5, 2026, CISA added three actively exploited flaws to its KEV catalog, including a critical Langflow RCE, an Apache Tomcat path handling bug, and an N-central remote code execution chain. Here is what hosting customers and developers should patch first.