Ransomware payments dropped 35% in 2024
Chainalysis says a combination of law enforcement actions and better defenses led to less money going out to ransomware actors.
Ransomware roundup: 2024 end-of-year report - Comparitech
In 2024, ransomware groups claimed responsibility for 5,461 successful ransomware attacks on organizations worldwide. 1,204 of these attacks were confirmed by the targeted organizations. The rest were claimed by ransomware groups on their data leak sites, but have not been acknowledged by the targets.
Ministers consider ban on all UK public bodies making ransomware payments | Cybercrime | The Guardian
Prohibition would bring the NHS, schools and local councils into line with government departments
FunkSec – Alleged Top Ransomware Group Powered by AI
- The FunkSec ransomware group emerged in late 2024 and published over 85 victims in December, surpassing every other ransomware group that month. FunkSec operators appear to use AI-assisted malware development which can enable even inexperienced actors to quickly produce and refine advanced tools. The group’s activities straddle the line between hacktivism and cybercrime, complicating efforts to understand their true motivations. Many of the group’s leaked datasets are recycled from previous hacktivism campaigns, raising doubts about the authenticity of their disclosures. Current methods of assessing ransomware group threats often rely on the actors’ own claims, highlighting the need for more objective evaluation techniques.
Clop ransomware is now extorting 66 Cleo data-theft victims
The Clop ransomware gang started to extort victims of its Cleo data theft attacks and announced on its dark web portal that 66 companies have 48 hours to respond to the demands.
LockBit Ransomware Group Plots Comeback With 4.0 Release
The LockBit ransomware group will soon launch a comeback with the planned release of LockBit 4.0 in February 2025, Cyble
Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing
U.K. investigators tell the story of how examining a cybercrime group's extortion funds helped to unravel a money-laundering network reaching from the illegal drug trade to Moscow's elite.
Medion hack? BlackBasta ransomware has allegedly copied 1.5 TB of data | heise online
Cyber criminals claim to have successfully attacked Medion, a distributor of electronic products.
Ascension: Health data of 5.6 million stolen in ransomware attack
Ascension, one of the largest private U.S. healthcare systems, is notifying over 5.6 million patients and employees that their personal and health data was stolen in a May cyberattack linked to the Black Basta ransomware operation.
NotLockBit: A Deep Dive Into the New Ransomware Threat | Qualys Security Blog
NotLockBit is a new and emerging ransomware family that actively mimics the behavior and tactics of the well-known LockBit ransomware.
DrayTek Routers Exploited in Massive Ransomware Campaign - Forescout
- Our 2024 Dray:Break report revealed 14 new vulnerabilities in DrayTek devices See our upcoming presentation at Black Hat Europe for more details PRODAFT shared threat intelligence from 2023 on a ransomware campaign exploiting DrayTek devices This is the first time this campaign is discussed publicly Our analysis shows sophisticated attack workflows to deploy ransomware including possible: Zero-day vulnerabilities Credential harvesting and password cracking VPN and tunneling abuse
Ransomware hackers target NHS hospitals with new cyberattacks
Two NHS trusts in England have been hacked in recent weeks, the latest attacks to hit the national health service.
Black Basta ransomware gang hit BT Group
BT Group (formerly British Telecom)'s Conferencing division shut down some of its servers following a Black Basta ransomware attack.
Energy industry contractor says ransomware attack has limited access to IT systems | The Record from Recorded Future News
The company, ENGlobal Corporation, has restricted employee access to its IT system, limiting it to only essential business operations.
Starbucks, grocery stores impacted by Blue Yonder ransomware attack - Help Net Security
Supply chain management SaaS vendor Blue Yonder experienced a ransomware attack that impacted big companies like Starbucks.
Attacco ransomware al Bologna FC, rubati migliaia di documenti (anche sui calciatori) | Wired Italia
I pirati del gruppo RansomHub pubblicano su Dark Web alcuni dei documenti sottratti e chiedono al club di Serie A di pagare un riscatto
Office of Public Affairs | Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charge
The Justice Department unsealed criminal charges today against Evgenii Ptitsyn, 42, a Russian national, for allegedly administering the sale, distribution, and operation of Phobos ransomware.
The State of Cloud Ransomware in 2024
In this new report, learn how threat actors are leveraging cloud services to target web services with ransomware attackers.
VEEAM exploit seen used again with a new ransomware: “Frag
Last month, Sophos X-Ops reported several MDR cases where threat actors exploited a vulnerability in Veeam backup servers. We continue to track the activities of this threat cluster, which recently…
Meet Interlock — The new ransomware targeting FreeBSD servers
A relatively new ransomware operation named Interlock attacks organizations worldwide, taking the unusual approach of creating an encryptor to target FreeBSD servers.
Microchip Technology Reports $21.4 Million Cost From Ransomware Attack
Microchip Technology (NASDAQ: MCHP) revealed in its latest financial report on Tuesday that expenses related to the recent cybersecurity incident reached $21.4 million.
Cyber attack on pharmaceutical distributor AEP
AEP GmbH was the victim of a targeted cyber attack on October 28, which led to the partial encryption of the company's IT systems. The company's own security systems detected the attack. The company provides information about this on its website.
Change Healthcare says 100 million people impacted by February ransomware attack
Change Healthcare updated filings with the federal government to warn that about 100 million people had information accessed by hackers during a ransomware attack in February. The Department of Health and Human Services’s (HHS) Office for Civil Rights said Change Healthcare notified them on October 22 that “approximately 100 million individual notices have been sent regarding this breach.”
.jpg%3Fheight%3D635%26t%3D1729186960%26width%3D1200?width=92&height=&ar=&mode=&format=avif&dpr=2)
31 new ransomware groups were discovered in 2024
A report by Secureworks revealed a 30% year-over-year rise in active ransomware groups, which demonstrates fragmentation of an established criminal ecosystem.
Akira ransomware continues to evolve
As the Akira ransomware group continues to evolve its operations, Talos has the latest research on the group's attack chain, targeted verticals, and potential future TTPs.
Embargo ransomware: Rock’n’Rust
ESET researchers uncover new Rust-based tools that we named MDeployer and MS4Killer and that are actively utilized by a new ransomware group called Embargo.
macOS NotLockBit | Evolving Ransomware Samples Suggest a Threat Actor Sharpening Its Tools
An unknown threat actor is developing ransomware to lock files and steal data on macOS, and it's not LockBit.
Ransomware Gangs Use LockBit's Fame to Intimidate Victims in Latest Attacks
Threat actors exploit Amazon S3 in ransomware attacks, using AWS credentials for data theft.
Decrypted: Mallox ransomware
Researchers uncover flaw in Mallox ransomware, offering free file recovery for early victims
Lynx Ransomware: A Rebranding of INC Ransomware
Discover recent attacks using Lynx ransomware, a rebrand of INC, targeting multiple crucial sectors in the U.S. and UK with prevalent double-extortion tactics. Discover recent attacks using Lynx ransomware, a rebrand of INC, targeting multiple crucial sectors in the U.S. and UK with prevalent double-extortion tactics.