Heimadal Security

JANUARY 4, 2024

Security research and consulting firm SRLabs exploited a vulnerability in the encryption algorithm of a specific strain of Black Basta ransomware to develop and release a decryptor tool named Black Basta Buster.

Ransomware 81

Ransomware Encryption Malware Cybersecurity 81

Heimadal Security

FEBRUARY 21, 2024

International law enforcement operation disrupts LockBit ransomware gang and offers victims free decryption tool. Police Arrests Staff Members and Gives Victims Free Decryptor appeared first on Heimdal Security Blog. The campaign was dubbed Operation Cronos and was a collaboration between the U.K.’s

Ransomware 88

Ransomware Cybersecurity 88

Heimadal Security

DECEMBER 20, 2023

Justice Department (DoJ) announced on December 19th that the Federal Bureau of Investigations had disrupted the BlackCat ransomware threat group’s activity. The FBI offered a decryption tool to more than 500 affected victims. They also encourage potentially unknown BlackCat/ ALPHV victims to speak up.

Ransomware 86

Ransomware Cybersecurity 86

Graham Cluley

MARCH 17, 2023

Security researchers have released a new decryption tool which should come to the rescue of some victims of a modified version of the Conti ransomware, helping them to recover their encrypted data for free. Read more in my article on the Tripwire State of Security blog.

Ransomware 104

Ransomware Encryption Malware 104

Krebs on Security

MAY 11, 2020

Diebold Nixdorf , a major provider of automatic teller machines (ATMs) and payment technology to banks and retailers, recently suffered a ransomware attack that disrupted some operations. Suspecting a ransomware attack, Diebold said it immediately began disconnecting systems on that network to contain the spread of the malware.

Ransomware 341

Ransomware Retail Malware Data breaches 341

Security Affairs

JANUARY 30, 2021

FonixCrypter ransomware operators shut down their operations, released the master decryption key for free, and deleted malware’s source code. Good news for the victims of the FonixCrypter ransomware, the operators behind the threat shut down their operations and released the master decryption key.

Ransomware 135

Ransomware Encryption Malware Cybercrime 135

Heimadal Security

MARCH 21, 2022

Good news for victims of Diavol ransomware. Emsisoft, the well-known cybersecurity company, has just provided a free decryptor for this ransomware family linked to the TrickBot gang. Now victims can use this free decryption tool to recover their files without having to pay a ransom.

Ransomware 109

Ransomware Cybersecurity 109

Krebs on Security

MAY 14, 2021

The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The DarkSide message includes passages apparently penned by a leader of the REvil ransomware-as-a-service platform.

Ransomware 364

Ransomware Cryptocurrency Cybercrime Healthcare 364

Security Affairs

APRIL 19, 2022

Kaspersky discovered a flaw in the encryption process of the Yanluowang ransomware that allows victims to recover their files for free. Researchers from Kaspersky discovered a vulnerability in the encryption process of the Yanluowang ransomware that can be exploited to recover the files encrypted by the malware without paying the ransom.

Ransomware 88

Ransomware Encryption DDOS Malware 88

Krebs on Security

FEBRUARY 29, 2024

The ransomware group LockBit told officials with Fulton County, Ga. ’s National Crime Agency (NCA) took over LockBit’s online infrastructure , replacing the group’s homepage with a seizure notice and links to LockBit ransomware decryption tools. In a press briefing on Feb. ”

Ransomware 259

Ransomware Healthcare Cybercrime Hacking 259

SecureWorld News

FEBRUARY 2, 2022

DeadBolt ransomware was recently used to target customers of QNAP, a Taiwanese company that produces network attached storage (NAS) devices. However, those that did make the decision to pay the ransom have still had a difficult time decrypting their data. Emsisoft offers decryption key for DeadBolt ransomware.

Ransomware 85

Ransomware Firmware Encryption Internet 85

Heimadal Security

OCTOBER 28, 2021

Another good news in the world of ransomware attacks! Czech multinational cybersecurity software organization Avast has recently developed and published a decryptor that will help those affected by AtomSilo and LockFile ransomware attacks get back some of the encrypted files for free.

Ransomware 77

Ransomware Encryption Software Cybersecurity 77

Security Affairs

APRIL 4, 2023

A new ransomware strain named Rorschach ransomware supports the fastest file-encrypting routine observed to date. Check Point Research (CPR) and Check Point Incident Response Team (CPIRT) researchers detected a previously unknown ransomware strain, dubbed Rorschach ransomware , that was employed in attack against a US-based company.

Encryption 90

Encryption Ransomware Malware Backups 90

Malwarebytes

JUNE 13, 2022

Last week on Malwarebytes Labs: FBI warns of scammers soliciting donations for Ukraine Microsoft autopatch is here…but can you use it?

Data breaches 104

Data breaches Ransomware Phishing Passwords 104

eSecurity Planet

JANUARY 11, 2024

These devices exist outside of direct corporate management and provide a ransomware gang with unchecked platforms for encrypting data. Ransomware remains just one of many different threats and as security teams eliminate key vectors of attack, adversaries will shift tactics. How does remote encryption work?

Ransomware 112

Ransomware Encryption IoT VPN 112

Krebs on Security

JULY 8, 2021

Last week cybercriminals deployed ransomware to 1,500 organizations that provide IT security and technical support to many other companies. But Sanders said every ransomware expert Kaseya consulted so far has advised against negotiating for one ransom to unlock all victims.

Software 286

Software Ransomware System Administration Authentication 286

Security Affairs

NOVEMBER 19, 2022

Microsoft warns that a threat actor, tracked as DEV-0569, is using Google Ads to distribute the recently discovered Royal ransomware. The DEV-0569 group carries out malvertising campaigns to spread links to a signed malware downloader posing as software installers or fake updates embedded in spam messages, fake forum pages, and blog comments.

Ransomware 131

Ransomware Malware Antivirus Phishing 131

Security Affairs

SEPTEMBER 16, 2021

Researchers from Bitdefender released a free master decryptor for the REvil ransomware operation that allows past victims to recover their files for free. The group asked $70 million worth of Bitcoin for decrypting all systems impacted in the Kaseya supply-chain ransomware attack. re is still offline at the time of this writing.

Ransomware 87

Ransomware Encryption Media Hacking 87

Security Boulevard

MAY 12, 2023

The group operating the ransomware is also actively recruiting affiliates on criminal forums to conduct breaches. The CryptNet ransomware code is written in.NET and obfuscated using.NET Reactor. In this blog, we will analyze the features of CryptNet and the close relationship with Yashma ransomware.

Ransomware 69

Ransomware Encryption Backups Advertising 69

Security Affairs

APRIL 12, 2019

Good news for the victims of the CryptoPokemon ransomware , security experts at Emsisoft just released a free decrypter tool. Victims of the CryptoPokemon ransomware have a good reason to smile, security experts at Emsisoft have released a free decrypter tool. Bitcoin ransom to decrypt them.

Ransomware 88

Ransomware Encryption Advertising Malware 88

Security Affairs

JUNE 17, 2019

Good news for the victims of the latest variants of the GandCrab ransomware , NoMoreRansomware released a free decryption tool. Victims of the latest variants of the GandCrab ransomware can now decrypt their files for free using a free decryptor tool released on the the NoMoreRansom website.

Ransomware 82

Ransomware Advertising Cybercrime Marketing 82

eSecurity Planet

JULY 30, 2021

As Europol celebrated the fifth anniversary of its anti-ransomware initiative this week, menacing new ransomware threats made it clear that the fight against cyber threats is never-ending. The site also provides guidance on preventing ransomware attacks. “Ransomware enables criminals to steal all this in an instant. .

Ransomware 109

Ransomware Computers and Electronics Malware Cryptocurrency 109

Security Affairs

JULY 18, 2023

The cybercrime group FIN8 is using a revamped version of the Sardonic backdoor to deliver the BlackCat ransomware. The financially motivated group FIN8 (aka Syssphinx) was spotted using a revamped version of a backdoor tracked as Sardonic to deliver the BlackCat ransomware (aka Noberus ransomware). ” concludes the report.

Ransomware 93

Ransomware Cybercrime Malware Hacking 93

Security Affairs

MAY 12, 2023

CISA and FBI warned of attacks conducted by the Bl00dy Ransomware Gang against the education sector in the country. The FBI and CISA issued a joint advisory warning that the Bl00dy Ransomware group is actively targeting the education sector by exploiting the PaperCut remote-code execution vulnerability CVE-2023-27350.

Education 82

Education Ransomware Encryption Malware 82

Security Affairs

DECEMBER 19, 2023

The Federal Bureau of Investigation (FBI) announced the seizure of the Tor leak site of the AlphV/Blackcat ransomware group. The FBI seized the Tor leak site of the AlphV/Blackcat ransomware group and replaced the home page with the announcement of the seizure. the fashion giant Moncler , the Swissport , NCR , and Western Digital. .

Ransomware 106

Ransomware Advertising Hacking Manufacturing 106

Security Affairs

MAY 7, 2021

The Cuba Ransomware gang has partnered with the crooks behind the Hancitor malware in attacks aimed at corporate networks. Group-IB Threat Intelligence & Attribution team found that Hancitor is being actively used by the threat actors to deploy Cuba ransomware. Cuba ransomware has been active since at least January 2020.

Ransomware 116

Ransomware Education Manufacturing Malware 116

CSO Magazine

MARCH 2, 2022

Vectra AI: Threat detection and response vendor Vectra AI is offering a slate of free cybersecurity tools and services to organizations who believe they may be targeted by cyberattacks in the Ukraine-Russia conflict. The firm stated that the ransomware contains implementation errors, making its encryption breakable and slow.

Threat Detection 134

Threat Detection Surveillance Technology Cybersecurity 134

BH Consulting

JANUARY 16, 2024

The year may have changed but ransomware shows no signs of slowing. Symantec discovered a new ransomware strain in the wild, called TISAK. Meanwhile Wired named two ransomware gangs, Alphv and CIOp, among its ‘most dangerous people 2023’ list. Although the blog focuses on the U.S., Here’s what the data tells us.

Ransomware 69

Ransomware Penetration Testing InfoSec Cybersecurity 69

Krebs on Security

FEBRUARY 23, 2019

Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company’s customers for nearly three days. The company declined to specify how much was paid or what strain of ransomware was responsible for the attack. Roswell, Ga.

Backups 228

Backups Ransomware Encryption Internet 228

SecureWorld News

FEBRUARY 29, 2024

Change Healthcare, a major provider of IT services to hospitals, continues to battle the BlackCat ransomware syndicate. The FBI and CISA have labeled BlackCat one of the most prolific and damaging ransomware groups currently active. BlackCat had established itself as a formidable player in the ransomware landscape. authorities.

Healthcare 99

Healthcare Ransomware Cyber threats Encryption 99

CyberSecurity Insiders

JUNE 24, 2021

As #RansomwareWeek draws to a close here on the (ISC)² blog, we turn our attention to how organizations can defend themselves. The days of ransomware attackers demanding a few hundred dollars for a decryption key are long gone. In March, CNA Financial reportedly paid ransomware attackers $40 million. Initial Assessments.

Ransomware 103

Ransomware Backups Penetration Testing Education 103

Security Affairs

DECEMBER 19, 2023

The Federal Bureau of Investigation (FBI) announced the seizure of the Tor leak site of the AlphV/Blackcat ransomware group. The FBI seized the Tor leak site of the AlphV/Blackcat ransomware group and replaced the home page with the announcement of the seizure. the fashion giant Moncler , the Swissport , NCR , and Western Digital. .

Ransomware 80

Ransomware Advertising Hacking Manufacturing 80

SecureWorld News

JUNE 14, 2021

Some big time ransomware operators have recently declared they will retire from their malicious ways and stop launching ransomware attacks against the world. Or are they just trying to fade into the background until the current fervor around ransomware attacks subside? Avaddon ransomware gang announces shutdown.

Ransomware 85

Ransomware Cybercrime Passwords Encryption 85

Digital Shadows

JULY 5, 2021

Researchers initially attributed this attack to ransomware gang “REvil” (aka Sodinokibi), whose members claimed responsibility in a press release on their dark-web data-leak site, Happy Blog. At the time of writing, the number of companies affected by this ransomware supply-chain attack is still unclear.

Ransomware 52

Ransomware Encryption Cryptocurrency System Administration 52

Security Affairs

MAY 14, 2021

Federal Bureau of Investigation confirmed that the Colonial Pipeline was shut down due to a cyber attack carried out by the Darkside ransomware gang. Colonial Pipeline has recovered quickly from the ransomware attack, all its infrastructure has been restarted today. Please vote Security Affairs as Best Personal Blog [link].

Backups 88

Backups Ransomware Media Encryption 88

Malwarebytes

MAY 28, 2021

On the 14th of May, the Health Service Executive (HSE) , Ireland’s publicly funded healthcare system, fell victim to a Conti ransomware attack, forcing the organization to shut down more than 80,000 affected endpoints and plunging them back to the age of pen and paper. Threat profile: Conti ransomware.

Healthcare 110

Healthcare Ransomware Encryption Passwords 110

Security Affairs

MAY 13, 2023

The CheckMate ransomware operators have been targeting the Server Message Block (SMB) communication protocol used for file sharing to compromise their victims’ networks. That’s quite unusual for a ransomware campaign since many prominent gangs brag about big targets and post them as victims on their data leak sites.

Ransomware 91

Ransomware Encryption Passwords Internet 91