BBC Cyber correspondent Joe Tidy was directly targeted by the Medusa ransomware-as-a-service (RaaS) gang, which attempted to recruit him as an insider threat. The criminals offered 15–25% of a ransom payout (potentially tens of millions, based on 1% of BBC’s revenue) in exchange for his login credentials and access to BBC’s IT systems. The gang, linked to Russia or allied states, claimed prior success in breaching a UK healthcare company and a US emergency services provider via insider collusion. They pressured Tidy with deadlines, demanded he execute reconnaissance commands on his work laptop, and even triggered unauthorized two-factor authentication (2FA) login attempts after he stalled. The attack was thwarted, but the incident highlights the escalating risk of insider-enabled ransomware attacks targeting high-profile organizations. The BBC’s potential exposure included data theft, system encryption, and operational disruption, with the gang explicitly threatening to extort the corporation for a ransom in bitcoin. The National Crime Agency advises against paying ransoms, but the gang’s persistence underscores the financial and reputational stakes.

Major News Websites Hit by Ransomware-Laced Malvertising Campaign A widespread malvertising campaign targeted millions of users in the U.S. over the weekend, hijacking ads on high-traffic websites including the New York Times, BBC, AOL, and the NFL to deliver ransomware. Security researchers at Malwarebytes identified the attack, which exploited vulnerabilities in outdated software, including a recently patched flaw in Microsoft’s discontinued Silverlight plugin. The malicious ads redirected users to servers hosting the Angler exploit kit, a tool commonly used by cybercriminals to probe for weaknesses in a victim’s system. Once inside, the malware deployed cryptolocker-style ransomware, encrypting hard drives and demanding Bitcoin payments for decryption keys. While typical "drive-by" ransomware attacks demand a few hundred dollars, targeted incidents such as the $17,000 ransom paid by an L.A. hospital in February highlight the growing financial threat of such schemes. This attack underscores the risks of malvertising, where compromised ad networks serve as a delivery mechanism for malware. The incident also reignites debates over ad blockers, which some users employ to mitigate such threats, despite criticism from publishers reliant on ad revenue. Ransomware continues to rise as a preferred tool for cybercriminals, with even Mac OS X users recently falling victim via an infected BitTorrent client.