Home/Digest/Transportation/Past issues
Transportation digest,
Transportation: Surge in Ransomware and DDoS Attacks Targeting… (+1 more)
Ransomware
Surge in Ransomware and DDoS Attacks Targeting Critical Infrastructure in Europe and Asia
In September 2026, a significant increase in ransomware attacks and DDoS incidents was reported, particularly affecting critical infrastructure in Europe and Japan. The ENISA report highlights ransomware as the most destructive threat, with nearly a third of incidents targeting public sector organizations. Concurrently, Ahnlab's report noted DDoS attacks claimed by hacktivist groups against financial institutions and universities in Japan. Additionally, a ransomware attack in Nepal disrupted trading systems for securities firms. The reports indicate that unauthorized access and data breaches are prevalent across various sectors, with a notable rise in the exploitation of known vulnerabilities. Law enforcement agencies are actively investigating these incidents, but many claims of responsibility from threat actors remain unverified. The situation reflects an interconnected threat landscape exacerbated by geopolitical tensions.
APT · 2 sources · score 67 · Lapsus$ Group, Montage
Threat actors and malware
UAC-0099 Enhances MATCHBOIL Malware Targeting Ukrainian Industries
ESET Research has documented the evolution of MATCHBOIL, a C# downloader used by the Russia-aligned group UAC-0099, which has targeted Ukrainian transportation, manufacturing, and energy sectors. The malware, first noted by CERT-UA in August 2025, has been under development since at least April 2024. MATCHBOIL is delivered via spear phishing emails containing malicious links that download a VBScript file, which then executes the downloader. ESET's telemetry indicates that all observed victims are in Ukraine, with notable targets including transportation companies in mid-2025, a manufacturing firm in late 2025, and an energy company in June 2026. The malware has undergone significant changes, including improved obfuscation techniques and sandbox evasion capabilities, making it harder to detect. The latest version, as of April 2026, can communicate with its command-and-control server every two minutes, enhancing its persistence and functionality. ESET researchers emphasize that MATCHBOIL is a crucial tool in UAC-0099's cyberespionage operations.
APT · 10 sources · score 60 · Sandworm, Uac-0099, MatchBoil, Matchwok
New on leak sites
45 victims listed on ransomware leak sites by 8 groups in the 7 days before this issue. The most active:
Get the next one by email
The transportation digest is free and arrives on Tuesdays. One click to leave.
Subscribe to the transportation digest
A free account turns the digest into a personal watchlist: choose what you want to follow.