Krebs on Security

MARCH 1, 2022

A Ukrainian security researcher this week leaked several years of internal chat logs and other sensitive data tied to Conti , an aggressive and ruthless Russian cybercrime group that focuses on deploying its ransomware to companies with more than $100 million in annual revenue. On Sunday, Feb. It’s just some kind of sabotage.”

Ransomware 271

Ransomware Healthcare Cybercrime Government 271

Security Affairs

JANUARY 30, 2021

FonixCrypter ransomware operators shut down their operations, released the master decryption key for free, and deleted malware’s source code. Good news for the victims of the FonixCrypter ransomware, the operators behind the threat shut down their operations and released the master decryption key. Pierluigi Paganini.

Ransomware 133

Ransomware Encryption Malware Cybercrime 133

Thales Cloud Protection & Licensing

DECEMBER 13, 2023

Ransomware Sanctions: Do They Have Any Impact? madhav Thu, 12/14/2023 - 05:37 Ransomware is one of the most high-profile and high-value cybercrimes that organizations need to watch out for. What Can Organizations Do?

Ransomware 78

Ransomware Encryption Backups Accountability 78

Krebs on Security

SEPTEMBER 30, 2023

Earlier this week, KrebsOnSecurity revealed that the darknet website for the Snatch ransomware group was leaking data about its users and the crime gang’s internal operations. It continues: “Prior to deploying the ransomware, Snatch threat actors were observed spending up to three months on a victim’s system.

Ransomware 219

Ransomware Accountability Cybercrime Backups 219

Security Affairs

MAY 15, 2023

A previously unknown ransomware group known as RA Group is targeting companies in U.S. Cisco Talos researchers recently discovered a new ransomware operation called RA Group that has been active since at least April 22, 2023. The researchers assess with high confidence that the group is using the leaked Babuk ransomware source code.

Ransomware 84

Ransomware Encryption Cybercrime Insurance 84

Security Affairs

JULY 20, 2022

Kaspersky researchers discovered a new ransomware family written in Rust, named Luna, that targets Windows, Linux, and ESXi systems. Researchers from Kaspersky Lab detailed a new ransomware family named Luna, which is written in Rust and is able to target Windows, Linux, and ESXi systems. A notable example includes BlackCat and Hive.

Ransomware 131

Ransomware Encryption Malware Advertising 131

Krebs on Security

DECEMBER 16, 2019

As if the scourge of ransomware wasn’t bad enough already: Several prominent purveyors of ransomware have signaled they plan to start publishing data stolen from victims who refuse to pay up. The message displayed at the top of the Maze Ransomware public shaming site. Follow the news!”

Ransomware 218

Ransomware Data breaches Healthcare Cybercrime 218

Security Affairs

APRIL 20, 2023

Threat actors are hacking poorly secured and Interned-exposed Microsoft SQL servers to deploy the Trigona ransomware. Threat actors are hacking into poorly secured and public-facing Microsoft SQL servers to deploy Trigona ransomware. _locked” extension to the filename of encrypted files.

Ransomware 82

Ransomware Malware Encryption Hacking 82

SecureList

JULY 20, 2022

If we look back at what we covered last month, we will see that ransomware (surprise, surprise!) In this blog post, we provide several excerpts from last month’s reports on new ransomware strains. Luna: brand-new ransomware written in Rust. definitely stands out. Command line options available in Luna. Black Basta.

Ransomware 99

Ransomware Encryption Advertising Malware 99

Security Affairs

MAY 4, 2023

The City of Dallas, Texas, was hit by a ransomware attack that forced it to shut down some of its IT systems. The IT systems at the City of Dallas, Texas, have been targeted by a ransomware attack. However, CBS News Texas obtained an image the ransomware note dropped by the malware on the infected systems. Source J.D.

Ransomware 92

Ransomware Healthcare Education Encryption 92

Security Affairs

APRIL 19, 2022

Kaspersky discovered a flaw in the encryption process of the Yanluowang ransomware that allows victims to recover their files for free. The Yanluowang ransomware was first spotted by researchers from Symantec Threat Hunter Team in October 2021, the malware was used in highly targeted attacks against large enterprises.

Ransomware 87

Ransomware Encryption DDOS Malware 87

Security Affairs

JUNE 16, 2022

The BlackCat ransomware gang is targeting unpatched Exchange servers to compromise target networks, Microsoft warns. Microsoft researchers have observed BlackCat ransomware gang targeting unpatched Exchange servers to compromise organizations worldwide.

Ransomware 100

Ransomware Cybercrime Malware Advertising 100

Security Affairs

JUNE 12, 2022

Ransomware gangs are actively exploiting CVE-2022-26134 remote code execution (RCE) flaw in Atlassian Confluence Server and Data Center. Multiple ransomware groups are actively exploiting the recently disclosed remote code execution (RCE) vulnerability, tracked as CVE-2022-26134 , affecting Atlassian Confluence Server and Data Center.

Ransomware 126

Ransomware Encryption Malware Hacking 126

Heimadal Security

JUNE 29, 2021

Since the two prominent Russian-speaking cybercrime forums (XSS and Exploit) banned ransomware-related topics, most criminal operations have been forced to promote their service using alternative methods, therefore a new way of recruiting affiliates came to life.

Ransomware 53

Ransomware Cybercrime Encryption Cybersecurity 53

Security Affairs

MAY 12, 2023

The leak of the source code of the Babuk ransomware allowed 9 ransomware gangs to create their own ransomware targeting VMware ESXi systems. SentinelLabs researchers have identified 10 ransomware families using VMware ESXi lockers based on the source code of the Babuk ransomware that was leaked in 2021.

Ransomware 95

Ransomware Encryption Hacking Cybersecurity 95

Security Affairs

JULY 11, 2022

BleepingComputer reported a new ransomware operation named 0mega that is targeting organizations worldwide. 0mega is a new ransomware operation that is targeting organizations worldwide using a double-extortion model, BleepingComputer reported. Victims of the ransomware reported that the malware adds the .0mega

Ransomware 103

Ransomware Encryption Malware Hacking 103

Security Affairs

MAY 13, 2023

The CheckMate ransomware operators have been targeting the Server Message Block (SMB) communication protocol used for file sharing to compromise their victims’ networks. That’s quite unusual for a ransomware campaign since many prominent gangs brag about big targets and post them as victims on their data leak sites.

Ransomware 90

Ransomware Encryption Passwords Internet 90

Security Affairs

MAY 9, 2023

Researchers warn of a new ransomware family called CACTUS that exploits known vulnerabilities in VPN appliances to gain initial access to victims’ networks. The new ransomware operation has been active since March 2023, despite the threat actors use a double-extortion model, their data leak site has yet to be discovered.

Ransomware 74

Ransomware VPN Antivirus Encryption 74

Security Affairs

DECEMBER 10, 2022

The US Department of Health and Human Services (HHS) warns healthcare organizations of Royal ransomware attacks. The human-operated Royal ransomware first appeared on the threat landscape in September 2022, it has demanded ransoms up to millions of dollars. The malware changes the extension of the encrypted files to ‘.royal’.

Healthcare 88

Healthcare Ransomware Encryption Malware 88

Security Affairs

MAY 4, 2022

A security researcher discovered that samples of Conti, REvil, LockBit ransomware were vulnerable to DLL hijacking. hyp3rlinx conducted the DLL hijacking to load and execute a specially crafted DLL that was able to terminate the pre-encryption activities conducted by the malware strains. To nominate, please visit:? Pierluigi Paganini.

Ransomware 101

Ransomware Antivirus Malware Encryption 101

Security Affairs

MAY 17, 2023

The US government is offering a $10M reward for Russian national Mikhail Pavlovich Matveev (30) charged for his role in ransomware attacks The US Justice Department charged Russian national Mikhail Pavlovich Matveev (30), aka Wazawaka, m1x, Boriselcin, and Uhodiransomwar, for his alleged role in multiple ransomware attacks.

Ransomware 75

Ransomware Healthcare Cybercrime Encryption 75

The Last Watchdog

SEPTEMBER 7, 2022

The internet has drawn comparisons to the Wild West, making ransomware the digital incarnation of a hold-up. They could be on the other side of the globe, part of a cybercrime regime that will never be discovered, much less brought to justice. Ransomware usually starts with a phishing email. Prevalence. A typical attack.

Ransomware 124

Ransomware Education Financial Services Phishing 124

SecureList

DECEMBER 13, 2023

In recent months, we have written private reports on a wide range of topics, such as new cross-platform ransomware, macOS stealers and malware distribution campaigns. In this article, we share excerpts from our reports on the FakeSG campaign, the Akira ransomware and the AMOS stealer. AMOS Stealers are growing in popularity.

Ransomware 97

Ransomware Passwords Malware Encryption 97

Security Affairs

JULY 1, 2020

Xerox Corporation is the last victim of the Maze ransomware operators, hackers have encrypted its files and threaten of releasing them. Maze ransomware operators have breached the systems of the Xerox Corporation and stolen files before encrypting them. Blog Link) [link] — Cyble (@AuCyble) June 30, 2020.

Ransomware 99

Ransomware Hacking Encryption Banking 99

Security Affairs

APRIL 14, 2020

Recently organizations in healthcare, research, and government facilities have been hit by Coronavirus-themed attacks that deployed multiple malware families, including ransomware and information stealers (i.e. AgentTesla ). ” continues the analysis. ” concludes the report. Pierluigi Paganini. adrotate banner=”13″].

Healthcare 114

Healthcare Ransomware Phishing Government 114

SecureWorld News

MARCH 21, 2023

Ransomware has gone through several game-changing milestones over the course of its decade-long evolution. In 2013, extortionists added encryption to their genre and started locking down victims' files instead of screens or web browsers. Encryption-less" extortion has since created ripples in the ransomware circles.

Ransomware 88

Ransomware Encryption Adware Data breaches 88

Krebs on Security

FEBRUARY 14, 2022

In January, KrebsOnSecurity examined clues left behind by “ Wazawaka ,” the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. The other handle that appeared tied to Wazawaka was “Orange,” the founder of the RAMP ransomware forum.

VPN 203

VPN Ransomware Cybercrime Accountability 203

Security Affairs

MAY 2, 2022

The REvil ransomware gang has resumed its operations, experts found a new encryptor and a new attack infrastructure. The Russian police arrested 14 alleged members of the ransomware gang and raided 25 addresses seizing computer equipment and cryptocurrency wallets. SecurityAffairs – hacking, REvil ransomware).

Ransomware 85

Ransomware Encryption Cryptocurrency Malware 85

eSecurity Planet

AUGUST 12, 2021

Accenture officials are saying they staved off a ransomware attack this week by a cybercriminal ring using the LockBit malware even as the hacker group claimed to have captured data from the massive global IT and business consulting firm and has threatened to release it. Further reading: How Zero Trust Security Can Protect Against Ransomware.

Ransomware 104

Ransomware Backups Cybercrime Artificial Intelligence 104

Security Affairs

APRIL 27, 2023

RTM ransomware-as-a-service (RaaS) started offering locker ransomware that targets Linux, NAS, and ESXi systems. The Uptycs threat research team discovered the first ransomware binary attributed to the RTM ransomware-as-a-service (RaaS) provider. The group threatens to ban every affiliate who does leak samples.

Encryption 85

Encryption Ransomware Malware Education 85

Security Affairs

MAY 12, 2023

CISA and FBI warned of attacks conducted by the Bl00dy Ransomware Gang against the education sector in the country. The FBI and CISA issued a joint advisory warning that the Bl00dy Ransomware group is actively targeting the education sector by exploiting the PaperCut remote-code execution vulnerability CVE-2023-27350.

Education 81

Education Ransomware Encryption Malware 81

Malwarebytes

MAY 28, 2021

On the 14th of May, the Health Service Executive (HSE) , Ireland’s publicly funded healthcare system, fell victim to a Conti ransomware attack, forcing the organization to shut down more than 80,000 affected endpoints and plunging them back to the age of pen and paper. Threat profile: Conti ransomware.

Healthcare 104

Healthcare Ransomware Encryption Passwords 104

Krebs on Security

JANUARY 30, 2024

Among those was the encrypted messaging app Signal , which said the breach could have let attackers re-register the phone number on another device for about 1,900 users. 12 blog post , the attackers used their access to Mailchimp employee accounts to steal data from 214 customers involved in cryptocurrency and finance.

Social Engineering 320

Social Engineering Mobile Cybercrime Passwords 320

SecureWorld News

JULY 2, 2020

Now we must add another type of high stakes negotiation to the list of items organizations should prepare for: negotiating with hackers who are demanding millions of dollars following a ransomware attack. The University of California vs. Netwalker ransomware operators. The ransomware negotiation and conversation.

Ransomware 106

Ransomware Encryption Healthcare IoT 106

Security Affairs

APRIL 23, 2022

The analysis of encryption techniques employed in the attack allowed the government experts to associate the campaign with the cybercrime group Trickbot. To nominate, please visit:? Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini. SecurityAffairs – hacking, Ukraine).

Phishing 86

Phishing Cybercrime Ransomware Encryption 86

SecureWorld News

FEBRUARY 2, 2022

DeadBolt ransomware was recently used to target customers of QNAP, a Taiwanese company that produces network attached storage (NAS) devices. Emsisoft offers decryption key for DeadBolt ransomware. QNAP's forced update removes the ransomware payload and, without that, the decryptor supplied by the criminals will not work.

Ransomware 86

Ransomware Firmware Encryption Internet 86

Security Boulevard

JUNE 8, 2022

Ransomware Trends Show Lockbit Most Active, New Tactics, Healthcare Hit Hard. LockBit replaced Conti as the most active ransomware gang and continued to evolve its operations in the first quarter, according to a report (PDF) from KELA Cybercrime Intelligence. Another notable Ransomware trend: new methods of intimidation.

Healthcare 52

Healthcare Ransomware Encryption Cybercrime 52