The Interlock ransomware group is an emerging threat actor that surfaced in 2024, quickly gaining attention for targeted, financially motivated attacks. Interlock appears to operate under a ransomware-as-a-service (RaaS) or affiliate-based model and primarily targets mid-sized to large organizations, particularly those with complex enterprise networks. Interlock employs double extortion ⟶

An Internet Protocol address, or IP address, is a unique numerical identifier assigned to every device connected to the Internet or a network. Computers use IP addresses to allow information to be sent between two devices on a network, on the Internet or on other networks.  ⟶

The Kairos ransomware group is a new and relatively obscure threat actor that emerged in 2024, adding to the growing list of short-lived ransomware brands. Public reporting on Kairos remains limited. Kairos follows the now-standard double extortion model, encrypting victim systems while exfiltrating sensitive data and threatening to leak ⟶

Keyloggers are malicious software that tracks and records every keystroke entry made on a computer or mobile keyboard, without the permission or knowledge of the user, and sends it to the attacker(s).

The Kill ransomware group is a threat actor that has surfaced intermittently in 2023–2024. Public information about the group is limited. Kill uses data encryption and extortion tactics, with some indications of double extortion, where stolen data is leveraged alongside system disruption to pressure victims. Targets are typically small ⟶

The Kill ransomware group, also known as KillSec or KillSecurity, is a cybercriminal organization. They employ a ransomware-as-a-service (RaaS) model, allowing affiliates to execute attacks using their malware infrastructure. KillSec is known for targeting various industries, including manufacturing and wholesale sectors. KillSec's ransomware variants, such as KillSecurity 2.0 and ⟶

What is an LLM (Large Language Model)? A Large Language Model (LLM) is a type of artificial intelligence system designed to understand, process, and generate human language. LLMs are trained on massive datasets containing text from books, websites, documents, and other written sources. Through this training process, the model ⟶

The LockBit ransomware group is one of the most prolific and impactful ransomware operations to date, first emerging in 2019 and evolving into a highly organized ransomware-as-a-service (RaaS) ecosystem. LockBit has targeted organizations of all sizes worldwide, across sectors including healthcare, manufacturing, financial services, education, and government. Its scale ⟶

LotAI, or “Living off the AI,” is an emerging cybersecurity threat technique in which attackers exploit legitimate artificial intelligence tools and assistants to conduct malicious activity.

What is Lotus C2? Lotus C2 is a command-and-control (C2) framework sold as a cybercrime toolkit that enables attackers to remotely control compromised systems and carry out a variety of malicious activities. Discovered on underground cybercrime forums, Lotus C2 is marketed as a professional security testing platform but is ⟶

The Lynx ransomware group is a relatively new threat actor that emerged in 2024, operating as part of the expanding ecosystem of modern ransomware operations. Lynx appears to be financially motivated and follows patterns consistent with a ransomware-as-a-service (RaaS) or affiliate-based model, targeting organizations across multiple industries. Lynx employs ⟶

Malvertising, also known as malicious advertising, refers to an attack in which cybercriminals inject malicious code into legitimate online advertising networks, redirecting users to malicious websites, with the goal of spreading malware. These malicious ads can exploit vulnerabilities in the user’s browser, operating system, or even in plugins like ⟶