The Hidden Ransomware Economy Running on Exposed Databases

Multiple active threats and large-scale incidents were reported: a 5-year study found 30,515 exposed databases targeted by extortion-style ransomware operations; Laravel-Lang Composer packages were poisoned by attackers rewriting >700 Git tags to inject malware; Nimbus Manticore expanded wartime operations with AI-assisted malware, fake Zoom installers and SEO poisoning; Lazarus deployed a fileless, memory-only RAT to evade forensics; Ghost CMS sites (700+ victims) are being actively exploited via CVE-2026-26980 to push ClickFix malware; a zero-click WhatsApp iOS16 account-takeover campaign is