article thumbnail

FBI and CISA published a new advisory on AvosLocker ransomware

Security Affairs

FBI and CISA published a joint Cybersecurity Advisory (CSA) to disseminate IOCs, TTPs, and detection methods associated with AvosLocker ransomware. The joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort aimed at sharing technical details associated with various ransomware operations.

article thumbnail

Active Nitrogen campaign delivered via malicious ads for PuTTY, FileZilla

Malwarebytes

In the past couple of weeks, we have observed an ongoing campaign targeting system administrators with fraudulent ads for popular system utilities. Nitrogen is used by threat actors to gain initial access to private networks, followed by data theft and the deployment of ransomware such as BlackCat/ALPHV. dll (Nitrogen).

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Microsoft warns of Human-Operated Ransomware as a growing threat to businesses

Security Affairs

Microsoft is warning of human-operated ransomware, this kind of attack against businesses is becoming popular in the cybercrime ecosystem. Human-operated ransomware is a technique usually employed in nation-state attacks that is becoming very popular in the cybercrime ecosystem. ” reads the post published by Microsoft.

article thumbnail

How Did Authorities Identify the Alleged Lockbit Boss?

Krebs on Security

and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. ru , which at one point advertised the sale of wooden staircases. 2011 said he was a system administrator and C++ coder. Last week, the United States joined the U.K. “P.S.

article thumbnail

US authorities charged Dridex gang members for stealing over $100 Million

Security Affairs

The 10-count indictment unsealed today, concerning the distribution of the malware they used to automate the theft of sensitive financial and personal information like banking credentials, as well as for infecting their victims with ransomware in more recent attacks. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Banking 67
article thumbnail

IT threat evolution Q2 2021

SecureList

The malware starts as a system service and loads the payload, a “remote shell”-style backdoor, which in turns connects to the C2 to get commands. Andariel adds ransomware to its toolset. Evolution of JSWorm ransomware. Moreover, there’s now a well-developed eco-system underpinning ransomware attacks.

article thumbnail

The Phight Against Phishing

Digital Shadows

It’s still showing up to drop ransomware and Trojans, harvest credentials, and spy on organizations like yours. It could be a system administrator who has access to sensitive defense information and recently just met an attractive fitness influencer on social media (hello, Iran !). Figure 1: Typical marketing spam.