article thumbnail

New Linux Ransomware BlackSuit is similar to Royal ransomware

Security Affairs

Experts noticed that the new Linux ransomware BlackSuit has significant similarities with the Royal ransomware family. Royal ransomware is one of the most notable ransomware families of 2022, it made the headlines in early May 2023 with the attack against the IT systems in Dallas, Texas. Extension: blacksuit.

article thumbnail

Vice Society ransomware gang is using a custom locker

Security Affairs

The Vice Society ransomware group has adopted new custom ransomware, with a strong encryption scheme, in recent intrusions. SentinelOne researchers discovered that the Vice Society ransomware gang has started using a custom ransomware that implements a robust encryption scheme, using NTRUEncrypt and ChaCha20-Poly1305 algorithms.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Shade Ransomware gang shut down operations and releases 750K decryption keys

Security Affairs

The operators behind the Shade Ransomware (Troldesh) shut down their operations and released over 750,000 decryption keys. Good news for the victims of the infamous Shade Ransomware , the operators behind the threat have shut down their operations and released over 750,000 decryption keys. SecurityAffairs – Shade Ransomware, hacking).

article thumbnail

Crooks target Healthcare facilities involved in Coronavirus containment with Ransomware

Security Affairs

Recently organizations in healthcare, research, and government facilities have been hit by Coronavirus-themed attacks that deployed multiple malware families, including ransomware and information stealers (i.e. “The emails all contained a malicious Rich Text Format (RTF) phishing lure with the file name 20200323- sitrep -63- covid -19.

article thumbnail

Medibank Defends its Security Practices as its Ransomware Woes Worsen

IT Governance

The Australian health insurance giant fell victim to ransomware in October, as a result of which the personal data of 9.7 In most cases, basic personal information – such as their name, date of birth, email address, phone number and gender – was exposed. million current and former customers was compromised. From bad to worse.

IT 107
article thumbnail

Shade Ransomware is very active outside of Russia and targets more English-speaking victims

Security Affairs

Experts at PaloAlto Networks spotted a new Shade ransomware campaigns targeting news countries, including in the U.S. Researchers observed a new wave of Shade ransomware attacks against targets in several countries, including the US and Japan. Moth of the victims belongs to high-tech, wholesale and education sectors.

article thumbnail

Iran-linked MERCURY APT behind destructive attacks on hybrid environments

Security Affairs

Iran-linked APT group MERCURY is behind destructive attacks on hybrid environments masquerading as a ransomware operation. Threat actors masqueraded the attacks as a standard ransomware operation. Once bypassed the security defenses, the attackers deployed the ransomware payload in the NETLOGON shares on several domain controllers.