💀 cPanel Sorry ransomware mass-exploitation, 🔑 ConsentFix v3 automated Azure OAuth abuse, 🏔️ Everest hits Canadian financial processor Symcor

The cPanel authentication bypass has crossed into active ransomware deployment. Attackers are now using a Go-based encryptor called Sorry that appends the .sorry extension and protects its ChaCha20 keys with RSA-2048, making recovery impossible without the attacker's key. Hundreds of compromised sites are already indexed in search results, and Shadowserver's 44,000-plus compromised IPs show the size of the harvest surface. The cPanel campaign is now a ransomware problem, not just a patching problem.

ConsentFix v3 automates what was a manual OAuth phishing technique into a scalable pipeline against Azure tenants. Pipedream serves as the webhook receiver, token exchange engine, and collector in one, while lures live on Cloudflare Pages and phishing links hide inside DocSend-hosted PDFs to bypass spam filters. Captured tokens can be imported directly into attacker-controlled tenants, so consent-grant review and conditional access policies are the main defenses.

Everest ransomware claims to have breached Symcor, which processes check clearing and payments for major Canadian banks. Unconfirmed by the company, but a processor-level compromise would be a systemic event for the Canadian financial sector. Separately, a Maryland pharmacist was indicted for unauthorized access to patient records, a reminder that legitimate access remains one of the hardest insider threats to catch.

Watchlist: scan cPanel hosts for the Sorry encryptor and root backdoors, review OAuth consent grants and sign-in risk policies for Azure tenants, and watch for confirmation of the Symcor claim.