article thumbnail

Ransomware Group Turns to Facebook Ads

Krebs on Security

It’s bad enough that many ransomware gangs now have blogs where they publish data stolen from companies that refuse to make an extortion payment. Now, one crime group has started using hacked Facebook accounts to run ads publicly pressuring their ransomware victims into paying up. On the evening of Monday, Nov. ”

article thumbnail

Ransomware gangs target companies involved in time-sensitive financial events, FBI warns

Security Affairs

The FBI warns of ransomware attacks on businesses involved in “time-sensitive financial events” such as corporate mergers and acquisitions. Ransomware gangs target these companies because there is a high likelihood that they will pay the ransom to avoid the impact of the disclosure of sensitive data during these events.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Anti-Ransomware Company Exagrid Pays $2.6 Million Ransom

Adam Levin

You would think that ExaGrid, a backup appliance and anti-ransomware service might know how to avoid ransomware, but it was hit. . million after it was hit with Conti ransomware. . The FBI announced last month that Conti ransomware had been used against the Irish healthcare system and at least sixteen U.S.

article thumbnail

OmniVision disclosed a data breach after the 2023 Cactus ransomware attack

Security Affairs

The digital imaging products manufacturer OmniVision disclosed a data breach after the 2023 ransomware attack. In 2023, the imaging sensors manufacturer was the victim of a Cactus ransomware attack. The threat actors had access to the company systems between September 4 and September 30, 2023, when they deployed ransomware.

article thumbnail

Cactus ransomware gang claims the Schneider Electric hack

Security Affairs

Energy management and industrial automation firm Schneider Electric suffered a data breach after a Cactus ransomware attack. The attack was carried out by the Cactus ransomware gang , which claims to have stolen terabytes of corporate data from the company. The Cactus ransomware relies on multiple legitimate tools (e.g.

article thumbnail

Using the LockBit builder to generate targeted ransomware

SecureList

They generated a custom version of the ransomware, which used the aforementioned account credential to spread across the network and perform malicious activities, such as killing Windows Defender and erasing Windows Event Logs in order to encrypt the data and cover its tracks. In this article, we revisit the LockBit 3.0

article thumbnail

Why keeping track of user accounts is important

Malwarebytes

An attacker managed to compromise network administrator credentials through the account of a former employee of the organization. CISA suspects that the account details fell in the hands of the attacker through a data breach. CISA suspects that the account details fell in the hands of the attacker through a data breach.