Why pure extortion is replacing traditional ransomware

Feed roundup: ransomware groups are shifting from system encryption to ‘pure extortion’ (data theft and leak threats). Belarus-linked APT Ghostwriter (UAC-0057 / UNC1151) resumed phishing against Ukrainian government targets using a legitimate e-learning service as bait, delivering malware and Cobalt Strike. Law enforcement seized First VPN and disrupted criminal infrastructure; a 23‑year‑old alleged Kimwolf botnet operator was arrested. Hunt.io mapped concentrated C2 hosting in the Middle East. CISA added multiple flaws to its Known Exploited Vulnerabilities catalog (including CVE-2025-34291)