Cybercriminals are increasingly exploiting popular movies to spread malware, with recent cases involving fake torrents of Leonardo DiCaprio’s upcoming film, “One Battle After Another.” These malicious files hide dangerous scripts that, when run, install remote access tools like AgentTesla, allowing hackers to steal sensitive information such as passwords and screenshots. The attack cleverly uses encrypted scripts and hidden files to avoid detection, highlighting how hackers are becoming more sophisticated in their methods. Meanwhile, the pro-Russian hacking group CyberVolk, also known as GLORIAMIST, has resurfaced with a new ransomware called VolkLocker. This ransomware targets both Windows and Linux systems, encrypting files and deleting backups, but has a major flaw—the encryption keys are stored openly, making it easy for anyone to decrypt files without paying. They sell their ransomware on Telegram for hundreds to thousands of dollars and have expanded their activities to include remote access tools and keyloggers. Despite efforts to shut down their channels, CyberVolk remains active, showing how politically motivated hackers continue to adapt and use accessible platforms for their operations. CTIX analysts will continue to report on the latest malware strains and attack methodologies.