Ransomware is not just a technical problem. It is a professional criminal business — and understanding how it works is the first step to defending against it.
Every year the government asks thousands of UK businesses, charities, schools, and universities a simple but important question: has your organisation been hit by a cyber attack in the past twelve months?
Each time, the mechanism has been the same: attackers find a way into a trusted update system, swap the legitimate contents for something malicious, and let the trust do the rest.
Imagine you are a builder, and you trust your supplier completely. You have been using them for years
The tool was litellm. The update was versions 1.82.7 and 1.82.8. And the damage was done before anyone knew it had started.
On the morning of 11 March 2026, staff at medical equipment manufacturer Stryker arrived at work to find a message on their screens. They were told not to turn on company devices and to disconnect from all networks immediately.