Found 486 bookmarks
Custom sorting
Ransomware gang’s new extortion trick? Calling the front desk
Ransomware gang’s new extortion trick? Calling the front desk
When a hacker called the company that his gang claimed to breach, he felt the same way that most of us feel when calling the front desk: frustrated. The phone call between the hacker, who claims to represent the ransomware gang DragonForce, and the victim company employee was posted by the ransomware gang on its dark web site in an apparent attempt to put pressure on the company to pay a ransom demand. In reality, the call recording just shows a somewhat hilarious and failed attempt to extort and intimidate a company’s rank-and-file employees.
#techcrunch#EN#2024#ransomware#target#frontdesk
·techcrunch.com·
Ransomware gang’s new extortion trick? Calling the front desk
Researchers discover new ransomware gang ‘Muliaka’ attacking Russian businesses
Researchers discover new ransomware gang ‘Muliaka’ attacking Russian businesses
A previously unknown ransomware gang has been attacking Russian businesses with malware based on the leaked source code from the Conti hacking group. The gang, which researchers at the Moscow-based cybersecurity company F.A.C.C.T. have dubbed “Muliaka," or Muddy Water in English, has left minimal traces from its attacks but has likely been active since at least December 2023.
#therecord#EN#2024#Muliaka#ransomware#gang#Russia
·therecord.media·
Researchers discover new ransomware gang ‘Muliaka’ attacking Russian businesses
From OneNote to RansomNote: An Ice Cold Intrusion - The DFIR Report
From OneNote to RansomNote: An Ice Cold Intrusion - The DFIR Report
  • In late February 2023, threat actors rode a wave of initial access using Microsoft OneNote files. In this case, we observed a threat actor deliver IcedID using this method. After loading IcedID and establishing persistence, there was no further actions, other than beaconing for over 30 days. The threat actor used Cobalt Strike and AnyDesk to target a file server and a backup server. * The threat actor used FileZilla to exfiltrate data from the network before deploying Nokoyawa ransomware.
#thedfirreport#EN#2024#2023#incident#incident-analysis#IcedID#OneNote#FileZilla#Nokoyawa#ransomware
·thedfirreport.com·
From OneNote to RansomNote: An Ice Cold Intrusion - The DFIR Report
Ransomware Diaries: Volume 1
Ransomware Diaries: Volume 1
The LockBit ransomware gang is one of the most notorious organized cybercrime syndicates that exists today. The gang is behind attacks targeting private-sector corporations and other high-profile industries worldwide. News and media outlets have documented many LockBit attacks, while security vendors offer technical assessments explaining how each occurred. Although these provide insight into the attacks, I wanted to know more about the human side of the operation to learn about the insights, motivations, and behaviors of the individuals on the other side of the keyboard. To prepare for this project, I spent months developing several online personas and established their credibility over time to gain access to the gang’s operation.
#analyst1#EN#2023#LockBit#ransomware#Insights
·analyst1.com·
Ransomware Diaries: Volume 1
SEKOIA.IO Mid-2022 Ransomware Threat Landscape
SEKOIA.IO Mid-2022 Ransomware Threat Landscape
SEKOIA.IO presents its Ransomware threat landscape for the first semester of 2022, with the following key points: Ransomware victimology – recent evolutions A busy first half of the year – several newcomers in the ransomware neighborhood Cross-platform ransomware features trend New extortion techniques State-nexus groups carrying out ransomware campaigns Ransomware threat groups’ Dark Web activities * A shift towards extortion without encryption?
#sekoia#EN#2022#ransomware#threat#landscape#statistcs
·blog.sekoia.io·
SEKOIA.IO Mid-2022 Ransomware Threat Landscape
US links Thanos and Jigsaw ransomware to 55-year-old doctor
US links Thanos and Jigsaw ransomware to 55-year-old doctor
The US Department of Justice today said that Moises Luis Zagala Gonzalez (Zagala), a 55-year-old cardiologist with French and Venezuelan citizenship residing in Ciudad Bolivar, Venezuela, created and rented Jigsaw and Thanos ransomware to cybercriminals.
#bleepingcomputer#EN#2022#Department-of-Justice#DOJ#Thanos#Jigsaw#Ransomware#USA#Venezuela
·bleepingcomputer.com·
US links Thanos and Jigsaw ransomware to 55-year-old doctor
Costa Rica declares national emergency after Conti ransomware attacks
Costa Rica declares national emergency after Conti ransomware attacks
The Costa Rican President Rodrigo Chaves has declared a national emergency following cyber attacks from Conti ransomware group on multiple government bodies. BleepingComputer also observed Conti published most of the 672 GB dump that appears to contain data belonging to the Costa Rican government agencies. The declaration was signed into law by Chaves on Sunday, May 8th, same day as the economist and former Minister of Finance effectively became the country's 49th and current president.
#bleepingcomputer#EN#2022#Conti#ransomware#leak#Costarica#emergency
·bleepingcomputer.com·
Costa Rica declares national emergency after Conti ransomware attacks
Change Healthcare ransomware attack disrupting industry nationwide
Change Healthcare ransomware attack disrupting industry nationwide
The reports keep coming in from across the country on how the Change Healthcare ransomware attack that first came to light on Feb. 21 has been impacting the healthcare sector. The case has been called the most severe cyberattack on the healthcare sector in history and has had a great impact since Change Healthcare, owned by UnitedHealth Group, processes 15 billion healthcare transactions annually, affecting 1 in 3 patient records.
#scmagazine#EN#2024#ransomware#healthcare#Change-Healthcare#US
·scmagazine.com·
Change Healthcare ransomware attack disrupting industry nationwide
Ransomware Recruitment Efforts Following Law Enforcement Disruption
Ransomware Recruitment Efforts Following Law Enforcement Disruption
In late 2023 and early 2024, the ransomware ecosystem experienced repeated disruption of its most prolific Ransomware-as-a-Service (RaaS) groups at the hands of international Law Enforcement (LE). Alphv’s dark web data leak site was seized, then unseized, then re-seized in a December 2023 law enforcement operation that seemingly failed to deter the group – until AlphV ultimately claimed to disband via an apparent exit scam, immediately following a high-profile attack against Change Healthcare in March 2024. LockBit experienced a far more dramatic and well-marketed disruption, “Operation Cronos,” in February 2024, leading to the compromise of its infrastructure, internal operational details, and data. While LockBit has ostensibly continued operations, its highly publicized disruption raises the question of whether the group will be able to continue operating and attracting affiliates at the level they once enjoyed.
#guidepointsecurity#EN#2024#Ransomware#Recruitment#Disruption#Operation-Cronos
·guidepointsecurity.com·
Ransomware Recruitment Efforts Following Law Enforcement Disruption
Interesting Multi-Stage StopCrypt Ransomware Variant Propagating in the Wild
Interesting Multi-Stage StopCrypt Ransomware Variant Propagating in the Wild
Overview The SonicWall Capture Labs threat research team recently observed an interesting variant of StopCrypt ransomware. The ransomware executes its malicious activities by utilizing multi-stage shellcodes before launching a final payload that contains the file […]
#SonicWall#EN#2024#StopCrypt#ransomware#analysis
·blog.sonicwall.com·
Interesting Multi-Stage StopCrypt Ransomware Variant Propagating in the Wild
Exclusive: After LockBit’s takedown, its purported leader vows to hack on
Exclusive: After LockBit’s takedown, its purported leader vows to hack on
This week, the Click Here podcast landed a rare interview with the purported leader of the LockBit ransomware group – he goes by the name LockBitSupp. He’s under pressure because last month an international police operation infiltrated the group and seized not just their platform, but their hacking tools, cryptocurrency accounts and source code ending a four year ransomware rampage.
#therecord.media#EN#2024#LockBit#LockBitSupp#ransomware
·therecord.media·
Exclusive: After LockBit’s takedown, its purported leader vows to hack on