Security Affairs

NOVEMBER 28, 2023

The ransomware gang claims the theft of board meeting minutes, internal project documentation, personnel details, audit reports, and more. In October 2022, CISA, the FBI, and the Department of Health and Human Services (HHS) warned that the Daixin Team cybercrime group is actively targeting U.S.

Hacking 118

Hacking VPN Ransomware Cybercrime 118

SecureWorld News

JANUARY 20, 2022

SecureWorld News has reported on multiple success stories when it comes to law enforcement fighting back against ransomware. Each investigation we undertake informs the next, and the information gained on potential victims means we may have pre-empted several serious cyberattacks and data breaches.".

VPN 92

VPN Ransomware Cybercrime Data breaches 92

Security Affairs

JANUARY 18, 2022

Europol this week announced the shutdown of VPNLab, a VPN service that is very popular in the cybercrime ecosystem. An international operation conducted by law enforcement bodies from 10 countries took down VPNLab.net, a VPN service provider that is very popular in the cybercrime ecosystem. ” continues the EUROPOL.

VPN 81

VPN Cybercrime Ransomware Advertising 81

SecureWorld News

OCTOBER 24, 2022

Cybersecurity Infrastructure Security Agency (CISA) have issued a joint cybersecurity advisory with information about "Daixin Team," a cybercrime group actively targeting U.S. businesses with ransomware and data extortion operations. Ransomware note from Daixin Team. Department of Health and Human Services, and U.S.

Ransomware 78

Ransomware VPN Healthcare Cybercrime 78

Security Affairs

APRIL 21, 2024

Government agencies revealed that Akira ransomware has breached over 250 entities worldwide and received over $42 million in ransom payments. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers. The attackers mostly used Cisco vulnerabilities CVE-2020-3259 and CVE-2023-20269.

Ransomware 104

Ransomware Encryption Antivirus VPN 104

Security Affairs

NOVEMBER 20, 2021

Advanced Intelligence researchers argue that the restarting of the Emotet botnet was driven by Conti ransomware gang. The infamous banking trojan was also used to deliver other malicious code, such as Trickbot and QBot trojans, or ransomware such as Conti , ProLock , Ryuk , and Egregor. ” states the report published by AdvIntel.

Cybercrime 98

Cybercrime Ransomware Banking Malware 98

Security Affairs

DECEMBER 14, 2023

French police arrested a Russian national who is suspected of laundering money resulting from the criminal activity of the Hive ransomware gang. The French authorities arrested in Paris a Russian national who is suspected of laundering criminal proceeds for the Hive ransomware gang. anti-cybercrime (Ofac).”

Ransomware 111

Ransomware Cryptocurrency Cybercrime VPN 111

Security Affairs

JANUARY 13, 2024

The Finish National Cybersecurity Center (NCSC-FI) warns of increased Akira ransomware attacks targeting NAS and tape backup devices of organizations in the country. The Finish National Cybersecurity Center (NCSC-FI) reported an increase in Akira ransomware attacks, targeting organizations in the country. concludes the alert.

Ransomware 85

Ransomware Backups VPN Authentication 85

Malwarebytes

MARCH 29, 2021

In addition, we speak to Malwarebytes senior security researcher JP Taggart about the importance of trusting your VPN. But obscuring your Internet activity—including the websites you visit, the searches you make, the files you download—doesn’t mean that a VPN magically disappears those things. Source: ComputerWeekly).

VPN 78

VPN Internet Internet Manufacturing 78

Security Affairs

JANUARY 24, 2024

A ransomware attack against the Finnish IT services provider Tietoevry disrupted the services of some Swedish government agencies and shops. Tietoevry is a Finnish multinational information technology (IT) and consulting company that provides managed services and cloud hosting for the enterprise.

Ransomware 106

Ransomware VPN Government Retail 106

Security Affairs

JANUARY 13, 2024

Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

VPN 105

VPN Cybercrime Ransomware Hacking 105

Security Affairs

AUGUST 10, 2022

Cisco discloses a security breach, the Yanluowang ransomware group breached its corporate network in late May and stole internal data. Cisco disclosed a security breach, the Yanluowang ransomware group breached its corporate network in late May and stole internal data. yanluowang ransomware has posted #Cisco to its leaksite.

Ransomware 124

Ransomware Hacking VPN Phishing 124

Krebs on Security

FEBRUARY 14, 2022

In January, KrebsOnSecurity examined clues left behind by “ Wazawaka ,” the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. The other handle that appeared tied to Wazawaka was “Orange,” the founder of the RAMP ransomware forum.

VPN 201

VPN Ransomware Cybercrime Accountability 201

Security Affairs

NOVEMBER 3, 2021

Experts warn of the availability in the cybercrime underground of offers for initial access to networks of players in global supply chains. In August 2021 , an affiliate of the Conti ransomware gang claimed access to corporate networks belonging to a U.S.-based based transportation management and trucking software supplier and a U.S.-based

Cybercrime 107

Cybercrime VPN Ransomware Hacking 107

Security Affairs

NOVEMBER 15, 2023

The FBI and CISA warn of attacks carried out by the Rhysida ransomware group against organizations across multiple industry sectors. FBI and CISA published a joint Cybersecurity Advisory (CSA) to warn of Rhysida ransomware attacks against organizations across multiple industry sectors. ” reads the joint advisory.

Ransomware 114

Ransomware Manufacturing Healthcare Education 114

Security Affairs

JULY 9, 2021

Insurance giant CNA notifies customers of a data breach after the Phoenix CryptoLocker ransomware attack suffered in March. US insurance giant CNA is notifying customers of a data breach after the ransomware attack that it suffered in March. Bloomberg was informed about the payment by two people familiar with the attack.

Data breaches 141

Data breaches Insurance Ransomware Identity Theft 141

Security Affairs

MAY 12, 2024

Ohio Lottery data breach impacted over 538,000 individuals Notorius threat actor IntelBroker claims the hack of the Europol A cyberattack hit the US healthcare giant Ascension Google fixes fifth actively exploited Chrome zero-day this year Russia-linked APT28 targets government Polish institutions Citrix warns customers to update PuTTY version installed (..)

Data breaches 78

Data breaches VPN Hacking Banking 78

Malwarebytes

OCTOBER 19, 2022

Dutch police and other law enforcement agencies have managed to trick the DeadBolt ransomware operators into releasing 150 decryption keys for free. They managed to repeat the process around 150 times before the ransomware gang pulled the plug on their system that gave out the decryption keys. QNAP and DeadBolt have history.

Ransomware 96

Ransomware Firmware VPN Cybercrime 96

Security Affairs

DECEMBER 11, 2021

Accenture researchers detailed the activity of a new sophisticated cybercrime group, called Karakurt, behind recent cyberattacks. The group focuses on data theft and extortion, but the researchers pointed out that it doesn’t use ransomware. In June 2021 the gang registered the domains hosting its leak sites, karakurt[.]group

Cybercrime 77

Cybercrime VPN Ransomware Hacking 77

Security Affairs

NOVEMBER 4, 2020

The source code for the KPot information stealer was put up for auction and the REvil ransomware operators want to acquire it. The authors of KPot information stealer have put its source code up for auction , and the REvil ransomware operators will likely be the only group to bid. KPOT source code up for sale!

Ransomware 135

Ransomware Malware Advertising Cybercrime 135

Security Affairs

JUNE 17, 2021

UNC2465 cybercrime group that is affiliated with the Darkside ransomware gang has infected with malware the website of a CCTV camera vendor. An affiliate of the Darkside ransomware gang , tracked as UNC2465, has conducted a supply chain attack against a CCTV vendor, Mandiant researchers discovered. ” concludes the report.

Cybercrime 105

Cybercrime Ransomware Antivirus Software 105

Security Affairs

OCTOBER 22, 2022

US government agencies warned that the Daixin Team cybercrime group is actively targeting the U.S. Healthcare and Public Health sector with ransomware. CISA, the FBI, and the Department of Health and Human Services (HHS) warned that the Daixin Team cybercrime group is actively targeting U.S. ” reads the alert. .”

Ransomware 68

Ransomware VPN Cybercrime Accountability 68

Malwarebytes

JUNE 30, 2021

A coordinated effort between global law enforcement agencies—led by the Dutch National Police—shut down a VPN service that was advertised on cybercrime forums. The VPN company promised users the ability to double- and triple-encrypt their web traffic to obscure their location and identity. One of those options is DoubleVPN.

VPN 132

VPN Cybercrime Encryption Advertising 132

Security Affairs

APRIL 2, 2020

Microsoft is sending notifications to dozens of hospitals about vulnerable VPN devices and gateways exposed online in their network. Microsoft is warning dozens of hospitals of the risks of ransomware attacks due to insecure VPN devices and gateways exposed online. ” reads the post published by Microsoft.

Ransomware 106

Ransomware VPN Healthcare Cyber Attacks 106

Security Affairs

JANUARY 14, 2022

Ukrainian police arrested members of a ransomware gang that targeted at least 50 companies in the U.S. Ukrainian police arrested members of a ransomware affiliate group that is responsible for attacking at least 50 companies in the U.S. The gang was distributing the LockerGoga and MegaCortex ransomware families. and Europe.

Ransomware 111

Ransomware DDOS Telecommunications Malware 111

Malwarebytes

MAY 11, 2021

Both the Australian Cyber Security Centre (ACSC) and the US Federal Bureau of Investigation (FBI) have issued warnings about an ongoing cybercrime campaign that is using Avaddon ransomware. In a separate advisory (pdf) , the ACSC says it is also aware of an ongoing ransomware campaign using the Avaddon Ransomware malware.

Ransomware 106

Ransomware VPN Encryption Cybercrime 106

Malwarebytes

JUNE 8, 2021

A Latvian woman has been charged for their alleged role in a transnational cybercrime organisation. Money mules and spear phishing are thrown into the mix alongside social engineering and international theft of money, personal, and confidential information. Ransomware would also be deployed, for that final splash of cash.

Cybercrime 109

Cybercrime Malware Banking Phishing 109

Security Affairs

APRIL 25, 2022

At least 60 entities worldwide have been breached by BlackCat ransomware, warns a flash report published by the U.S. Federal Bureau of Investigation (FBI) published a flash report that states that at least 60 entities worldwide have been breached by BlackCat ransomware (aka ALPHV and Noberus) since it started its operations in November.

Ransomware 104

Ransomware Antivirus Passwords Malware 104

Security Affairs

MAY 9, 2023

Researchers warn of a new ransomware family called CACTUS that exploits known vulnerabilities in VPN appliances to gain initial access to victims’ networks. The new ransomware operation has been active since March 2023, despite the threat actors use a double-extortion model, their data leak site has yet to be discovered.

Ransomware 74

Ransomware VPN Antivirus Encryption 74

Security Affairs

JULY 18, 2021

BleepingComputer became aware that the recent wave of attacks targeting vulnerable SonicWall devices was carried out by HelloKitty ransomware operators. SonicWall this week has issued an urgent security alert to warn companies of “ an imminent ransomware campaing ” targeting some of its equipment that reached end-of-life (EoL).

Ransomware 114

Ransomware Firmware Mobile InfoSec 114

Security Affairs

SEPTEMBER 12, 2022

Cisco confirmed the May attack and that the data leaked by the Yanluowang ransomware group was stolen from its systems. In August, Cisco disclosed a security breach, the Yanluowang ransomware gang breached its corporate network in late May and stole internal data. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Ransomware 99

Ransomware VPN Authentication Phishing 99

Security Affairs

APRIL 21, 2024

carmaker with phishing attacks Law enforcement operation dismantled phishing-as-a-service platform LabHost Previously unknown Kapeka backdoor linked to Russian Sandworm APT Cisco warns of a command injection escalation flaw in its IMC. Automotive Industry Chinese Organized Crime’s Latest U.S.

Data breaches 96

Data breaches Phishing Ransomware Malware 96

Security Affairs

JANUARY 26, 2023

The leak site of the Hive ransomware gang was seized due to an international operation conducted by law enforcement in ten countries. The Tor leak site used by Hive ransomware operators has been seized as part of an international operation conducted by law enforcement in 10 countries. cybersecurity and intelligence authorities.

Ransomware 91

Ransomware VPN Manufacturing Healthcare 91

Security Affairs

MAY 28, 2023

Swiss electrification and automation technology giant ABB confirmed it has suffered a data breach after a ransomware attack. BleepingComputer reported that the attack was carried out by the Black Basta ransomware group , some of the projects were delayed and the attack impacted some of the company factories.

Data breaches 87

Data breaches Ransomware VPN Hacking 87

Security Affairs

MAY 17, 2022

Justice Department accused a 55-year-old Venezuelan cardiologist of operating and selling the Thanos ransomware. Justice Department accused Moises Luis Zagala Gonzalez, a 55-year-old cardiologist from Venezuela, of operating and selling the Thanos ransomware. Thanos ransomware (a.k.a.

Ransomware 87

Ransomware Cybercrime VPN Malware 87

Security Affairs

JULY 6, 2022

Hive ransomware operators have improved their file-encrypting module by migrating to Rust language and adopting a more sophisticated encryption method. The operators of the Hive ransomware upgraded their malware by migrating the malware to the Rust language and implementing a more sophisticated encryption method, Microsoft researchers warn.

Encryption 114

Encryption Ransomware Cybercrime Malware 114

Krebs on Security

DECEMBER 3, 2021

Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. In this post we’ll look at the clues left behind by “ Babam ,” the handle chosen by a cybercriminal who has sold such access to ransomware groups on many occasions over the past few years. com and wwwpexpay[.]com.

Ransomware 296

Ransomware Passwords Accountability Cybercrime 296