Krebs on Security

DECEMBER 19, 2023

Federal Bureau of Investigation (FBI) disclosed today that it infiltrated the world’s second most prolific ransomware gang, a Russia-based criminal group known as ALPHV and BlackCat. The FBI said it seized the gang’s darknet website, and released a decryption tool that hundreds of victim companies can use to recover systems.

Ransomware 240

Ransomware Encryption IT Access 240

KnowBe4

JANUARY 8, 2024

Justice Department announced the existence of an FBI-developed decryption tool that has been used to save hundreds of victim organizations attacked by one of the most prolific ransomware variants in the world. For the first time ever, the U.S.

Ransomware 100

Ransomware Security 100

Krebs on Security

NOVEMBER 17, 2022

Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. There are multiple examples of ransomware groups doing just that after security researchers crowed about finding vulnerabilities in their ransomware code.

Ransomware 300

Ransomware Encryption Manufacturing Phishing 300

Security Affairs

APRIL 21, 2024

Government agencies revealed that Akira ransomware has breached over 250 entities worldwide and received over $42 million in ransom payments. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers. ” reads the report. It was this first time that the operators adopted this tactic.

Ransomware 99

Ransomware Encryption Education Phishing 99

eSecurity Planet

JUNE 30, 2023

Nearly half of EDR tools and organizations are vulnerable to Clop ransomware gang tactics, according to tests by a cybersecurity company. The continuous threat exposure management (CTEM) vendor tested to see if organizational controls would recognize the Indicators of Compromise (IoCs) of Clop ransomware attacks.

Ransomware 91

Ransomware Passwords Cybersecurity Healthcare 91

Data Breach Today

OCTOBER 28, 2020

Sophos: Cybercriminals Renting Buer Loader The operators behind the Ryuk strain of malware are increasingly relying on a malware-as-a-service tool - the Buer loader - to deliver the malware, rather than botnets such as Trickbot and Emotet, the security firm Sophos reports.

Ransomware 270

Ransomware Security 270

Data Breach Today

MARCH 13, 2024

New Campaign Evades Security Tools to Deliver Agent Tesla Keylogger and XWorm RAT Threat actors are using image files or Scalable Vector Graphics files to deliver ransomware, download banking Trojans or distribute malware.

Ransomware 312

Ransomware Security 312

Security Affairs

JULY 1, 2021

The US CISA has released the Ransomware Readiness Assessment (RRA), a new ransomware self-assessment security audit tool. “The Ransomware Readiness Assessment (RRA) will help you understand your cybersecurity posture with respect to the ever-evolving threat of ransomware.” ” CISA says.

Ransomware 126

Ransomware Cybersecurity Security IT 126

Data Breach Today

JULY 10, 2020

Malwarebytes: New Research Discloses Data Exfiltration Capability The Mac malware originally labeled as "EvilQuest," which researchers initially identified as a poorly designed ransomware variant, apparently is primarily an information stealer with ransomware-like elements designed to confuse security tools, according to the security firm Malwarebytes. (..)

Ransomware 318

Ransomware Security 318

Krebs on Security

MAY 11, 2020

Diebold Nixdorf , a major provider of automatic teller machines (ATMs) and payment technology to banks and retailers, recently suffered a ransomware attack that disrupted some operations. According to Diebold, on the evening of Saturday, April 25, the company’s security team discovered anomalous behavior on its corporate network.

Ransomware 334

Ransomware Retail Sales Data breaches 334

Security Affairs

MARCH 2, 2024

US CISA, the FBI, and MS-ISAC issued a joint CSA to warn of attacks involving Phobos ransomware variants observed as recently as February 2024 US CISA, the FBI, and MS-ISAC issued a joint cyber security advisory (CSA) to warn of attacks involving Phobos ransomware variants such as Backmydata , Devos, Eight, Elking, and Faust.

Ransomware 128

Ransomware Education Phishing Authentication 128

Krebs on Security

FEBRUARY 29, 2024

The ransomware group LockBit told officials with Fulton County, Ga. Security experts say LockBit was likely bluffing and probably lost most of the data when the gang’s servers were seized this month by U.S. they could expect to see their internal documents published online this morning unless the county paid a ransom demand.

Security 244

Security Ransomware IT Access 244

Security Affairs

DECEMBER 23, 2021

In a recent wave of attacks, AvosLocker ransomware is rebooting systems into Windows Safe Mode to disable endpoint security solutions. Sophos experts monitoring AvosLocker ransomware attacks, noticed that the malware is rebooting compromised systems into Windows Safe Mode to disable endpoint security solutions.

Ransomware 129

Ransomware Access Encryption Passwords 129

Security Affairs

JANUARY 30, 2024

Energy management and industrial automation firm Schneider Electric suffered a data breach after a Cactus ransomware attack. The attack was carried out by the Cactus ransomware gang , which claims to have stolen terabytes of corporate data from the company. The Cactus ransomware relies on multiple legitimate tools (e.g.

Ransomware 129

Ransomware Data breaches Digital transformation Encryption 129

Data Breach Today

JULY 30, 2021

The latest edition of the ISMG Security Report features an analysis of the disappearance of ransomware-as-a-service groups, such as REvil and Darkside, and how that impacts the wider cybercrime ecosystem. Also featured: ransomware recovery tips; regulating cyber surveillance tools.

Ransomware 246

Ransomware Security 246

IBM Big Data Hub

JANUARY 22, 2024

It’s the news no organization wants to hear―you’ve been the victim of a ransomware attack, and now you’re wondering what to do next. Over 17 percent of all cyberattacks involve ransomware —a type of malware that keeps a victim’s data or device locked unless the victim pays the hacker a ransom.

Ransomware 113

Ransomware Encryption Analytics Data breaches 113

Security Affairs

AUGUST 5, 2021

The Conti Ransomware operators offer their services to their affiliates and maintain 20-30% of each ransom payment. Now one of its affiliates leaked the IP addresses for Cobalt Strike C2 servers and an archive of 113 MB that includes training material and tools shared by the Conti operators with its network to conduct ransomware attacks.

Ransomware 125

Ransomware Archiving IT Security 125

Krebs on Security

MAY 14, 2021

The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The DarkSide message includes passages apparently penned by a leader of the REvil ransomware-as-a-service platform.

Ransomware 364

Ransomware Education Communications Access 364

Security Affairs

JANUARY 2, 2024

A team of researchers released a suite of tools that could help victims to decrypt data encrypted with by the Black Basta ransomware. Independent security research and consulting team SRLabs discovered a vulnerability in Black Basta ransomware’s encryption algorithm and exploited it to create a free decryptor.

Ransomware 121

Ransomware Encryption Blockchain Insurance 121

Security Affairs

NOVEMBER 15, 2023

The FBI and CISA warn of attacks carried out by the Rhysida ransomware group against organizations across multiple industry sectors. FBI and CISA published a joint Cybersecurity Advisory (CSA) to warn of Rhysida ransomware attacks against organizations across multiple industry sectors. ” reads the joint advisory.

Ransomware 120

Ransomware Manufacturing Education Passwords 120

Data Breach Today

MARCH 15, 2024

In the aftermath of a ransomware attack several years ago, Hackensack Meridian Health embarked on transforming its cybersecurity program with the support of top leadership and increased funding and staff and by implementing critical security tools and best practices, said CISO Mark Johnson.

Ransomware 268

Ransomware Cybersecurity Security IT 268

Security Affairs

DECEMBER 26, 2023

Researchers at NCC Group reported that in November they observed the return of the infamous banking malware Carbanak in ransomware attacks. The cybersecurity firm NCC Group reported that in November the banking malware Carbanak was observed in ransomware attacks.

Ransomware 121

Ransomware Phishing Cybersecurity Access 121

Security Affairs

JANUARY 1, 2024

The Cactus ransomware group claims to have hacked Coop, one of the largest retail and grocery providers in Sweden. The Cactus ransomware group claims to have hacked Coop and is threatening to disclose a huge amount of personal information, over 21 thousand directories. The Cactus ransomware relies on multiple legitimate tools (e.g.

Retail 129

Retail Ransomware Encryption Access 129

Security Affairs

OCTOBER 13, 2023

FBI and CISA published a joint Cybersecurity Advisory (CSA) to disseminate IOCs, TTPs, and detection methods associated with AvosLocker ransomware. The joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort aimed at sharing technical details associated with various ransomware operations.

Ransomware 118

Ransomware Systems administration Cybersecurity Encryption 118

eSecurity Planet

JANUARY 11, 2024

These devices exist outside of direct corporate management and provide a ransomware gang with unchecked platforms for encrypting data. Ransomware remains just one of many different threats and as security teams eliminate key vectors of attack, adversaries will shift tactics. How does remote encryption work?

Ransomware 106

Ransomware Encryption IoT Risk 106

Security Affairs

APRIL 24, 2023

Ransomware operators use the AuKill tool to disable EDR software through Bring Your Own Vulnerable Driver (BYOVD) attack. Sophos researchers reported that threat actors are using a previously undocumented defense evasion tool, dubbed AuKill, to disable endpoint detection and response (EDR) software.

Ransomware 98

Ransomware Education Security Cybersecurity 98

Security Affairs

JANUARY 19, 2024

Ransomware groups claimed that they successfully targeted 4191 victims in 2023, Cybernews researchers report. According to the Ransomlooker tool, the number of ransomware attack victims increased by 128.17% compared to the previous year (2022), with 1837 additional incidents. Winter was the least active time (14.6%

Ransomware 127

Ransomware Manufacturing Retail Insurance 127

Security Affairs

SEPTEMBER 1, 2023

Researchers released a free decryptor for the Key Group ransomware that allows victims to recover their data without paying a ransom. Threat intelligence firm EclecticIQ released a free decryption tool for the Key Group ransomware (aka keygroup777) that allows victims to recover their data without paying a ransom.

Ransomware 116

Ransomware Encryption Access Security 116

eSecurity Planet

MAY 19, 2023

Application security tools and software solutions are designed to identify and mitigate vulnerabilities and threats in software applications. These tools play a vital role in ensuring the security, integrity, and confidentiality of sensitive information, such as personal data and financial records.

Security 90

Security Cloud Compliance Risk 90

Security Affairs

FEBRUARY 19, 2024

The Cactus ransomware gang claims the theft of 1.5TB of data from the Energy management and industrial automation firm Schneider Electric. The Cactus ransomware group claims responsibility for pilfering 1.5TB of data from the Energy management and industrial automation giant Schneider Electric.

Ransomware 111

Ransomware Digital transformation Encryption Retail 111

Security Affairs

NOVEMBER 14, 2023

Experts warn of an alarming rise in ransomware operations targeting the energy sector, including nuclear facilities and related research entities. Over the last year, ransomware attackers have targeted energy installations in North America, Asia, and the European Union. Resecurity, Inc.

Ransomware 118

Ransomware Government Security Access 118

Security Affairs

OCTOBER 8, 2022

The BlackByte ransomware operators are leveraging a flaw in a legitimate Windows driver to bypass security solutions. Researchers from Sophos warn that BlackByte ransomware operators are using a bring your own vulnerable driver (BYOVD) attack to bypass security products. CVE-2018-19320 ) in the gdrv.sys and asWarPot.sys.

Ransomware 95

Ransomware Security Authentication Access 95

Security Affairs

FEBRUARY 27, 2024

New threat actors have started exploiting ConnectWise ScreenConnect vulnerabilities, including the Black Basta and Bl00dy ransomware gangs. Trend Micro confirmed that Black Basta and Bl00dy ransomware groups are actively exploiting both flaws and shared details about their attack chains. ” Trend Micro concludes.

Ransomware 122

Ransomware Authentication Access Risk 122

Security Affairs

JUNE 3, 2023

Experts noticed that the new Linux ransomware BlackSuit has significant similarities with the Royal ransomware family. Royal ransomware is one of the most notable ransomware families of 2022, it made the headlines in early May 2023 with the attack against the IT systems in Dallas, Texas. Extension: blacksuit.

Ransomware 98

Ransomware Encryption File names Cybersecurity 98

Security Affairs

MARCH 8, 2024

The ransomware attack on Xplain impacted tens of thousands Federal government files, said the National Cyber Security Centre (NCSC) of Switzerland. The National Cyber Security Centre (NCSC) published a data analysis report on the data breach resulting from the ransomware attack on the IT services provider Xplain.

Ransomware 123

Ransomware Data breaches Unstructured data Personal data 123

Security Affairs

DECEMBER 16, 2023

The Hunters International ransomware gang claims to have hacked the Fred Hutchinson Cancer Center (Fred Hutch). Another healthcare organization suffered a ransomware attack, the Hunters International ransomware gang claims to have hacked the Fred Hutchinson Cancer Center (Fred Hutch). ” reported the Seattle Times. “If

Ransomware 118

Ransomware Insurance Education Marketing 118

eSecurity Planet

OCTOBER 18, 2022

For any organization struck by ransomware , business leaders always ask “how do we decrypt the data ASAP, so we can get back in business?”. The good news is that ransomware files can be decrypted. The bad news is it doesn’t work most of the time: Paid ransom decryption tools and keys don’t always work. Eliminate attacker access.

Ransomware 129

Ransomware Encryption Insurance Access 129