The Hidden Ransomware Economy Running on Exposed Databases

A mixed-security feed describing a range of active threats and incidents: a 5‑year study shows a large ransomware/ database‑extortion economy abusing 30,515 exposed databases; Laravel‑Lang Composer packages were poisoned via mass Git tag rewriting, delivering malware to downstream Laravel apps; Nimbus Manticore expanded wartime operations with AI‑assisted malware, fake Zoom installers and SEO poisoning; Lazarus is deploying a stealthy memory‑only (fileless) RAT to evade forensics; Ghost CMS sites remain widely unpatched and are being exploited in ClickFix campaigns (CVE‑2026‑26980) affecting 7