Found 645 bookmarks
Custom sorting
Investigating Anonymous VPS services used by Ransomware Gangs
Investigating Anonymous VPS services used by Ransomware Gangs
One of the challenges with investigating cybercrime is the infrastructure the adversaries leverage to conduct attacks. Cybercriminal infrastructure has evolved drastically over the last 25 years, which now involves hijacking web services, content distribution networks (CDNs), residential proxies, fast flux DNS, domain generation algorithms (DGAs), botnets of IoT devices, the Tor network, and all sorts of nested services. This blog shall investigate a small UK-based hosting provider known as BitLaunch as an example of how challenging it can be to tackle cybercriminal infrastructure. Research into this hosting provider revealed that they appear to have a multi-year history of cybercriminals using BitLaunch to host command-and-control (C2) servers via their Anonymous VPS service.
#bushidotoken#EN#2025#investigation#VPS#BitLaunch#C2#Ransomware
·blog.bushidotoken.net·
Investigating Anonymous VPS services used by Ransomware Gangs
Key figures behind Phobos and 8Base ransomware arrested in international cybercrime crackdown
Key figures behind Phobos and 8Base ransomware arrested in international cybercrime crackdown
This follows a series of high-impact arrests targeting Phobos ransomware:An administrator of Phobos was arrested in South Korea in June 2024 and extradited to the United States in November of the same year. He is now facing prosecution for orchestrating ransomware attacks that encrypted critical infrastructure, business systems, and personal data for ransom.A key Phobos affiliate was arrested in Italy...
#europol#EN#2025#busted#phobos#8base#ransomware#arrested#fedpol#crackdown#Switzerland
·europol.europa.eu·
Key figures behind Phobos and 8Base ransomware arrested in international cybercrime crackdown
Cisco Says Ransomware Group’s Leak Related to Old Hack
Cisco Says Ransomware Group’s Leak Related to Old Hack
A fresh post on the Kraken ransomware group’s leak website refers to data stolen in a 2022 cyberattack, Cisco says. The data, a list of credentials apparently exfiltrated from Cisco’s systems, appeared over the weekend on a new data leak site operated by the Kraken ransomware group. “Cisco is aware of certain reports regarding a security incident. The incident referenced in the reports occurred back in May 2022, and we fully addressed it at that time,” a Cisco spokesperson said, responding to a SecurityWeek inquiry.
#securityweek#EN#Cisco#Ransomware#Leak#Old
·securityweek.com·
Cisco Says Ransomware Group’s Leak Related to Old Hack
RansomHub Affiliate leverages Python-based backdoor
RansomHub Affiliate leverages Python-based backdoor
In an incident response in Q4 of 2024, GuidePoint Security identified evidence of a threat actor utilizing a Python-based backdoor to maintain access to compromised endpoints. The threat actor later leveraged this access to deploy RansomHub encryptors throughout the entire impacted network. ReliaQuest documented an earlier version of this malware on their website in February 2024.
#guidepointsecurity#EN#2025#incident-response#Python-based#backdoor#ransomware#RansomHub#SocGholish#FakeUpdate
·guidepointsecurity.com·
RansomHub Affiliate leverages Python-based backdoor
Ransomware roundup: 2024 end-of-year report - Comparitech
Ransomware roundup: 2024 end-of-year report - Comparitech
In 2024, ransomware groups claimed responsibility for 5,461 successful ransomware attacks on organizations worldwide. 1,204 of these attacks were confirmed by the targeted organizations. The rest were claimed by ransomware groups on their data leak sites, but have not been acknowledged by the targets.
#comparitech#EN#2025#2024#report#ransomware#confirmed#statistcs
·comparitech.com·
Ransomware roundup: 2024 end-of-year report - Comparitech
FunkSec – Alleged Top Ransomware Group Powered by AI
FunkSec – Alleged Top Ransomware Group Powered by AI
  • The FunkSec ransomware group emerged in late 2024 and published over 85 victims in December, surpassing every other ransomware group that month. FunkSec operators appear to use AI-assisted malware development which can enable even inexperienced actors to quickly produce and refine advanced tools. The group’s activities straddle the line between hacktivism and cybercrime, complicating efforts to understand their true motivations. Many of the group’s leaked datasets are recycled from previous hacktivism campaigns, raising doubts about the authenticity of their disclosures. Current methods of assessing ransomware group threats often rely on the actors’ own claims, highlighting the need for more objective evaluation techniques.
#checkpoint#EN#2024#FunkSec#analysis#ransomware
·research.checkpoint.com·
FunkSec – Alleged Top Ransomware Group Powered by AI
Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing
Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing
U.K. investigators tell the story of how examining a cybercrime group's extortion funds helped to unravel a money-laundering network reaching from the illegal drug trade to Moscow's elite.
#therecord.media#EN#2024#Operation-Destabilise#ransomware#Russia#UK#cybercrime#money-laundering
·therecord.media·
Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing
Ascension: Health data of 5.6 million stolen in ransomware attack
Ascension: Health data of 5.6 million stolen in ransomware attack
​Ascension, one of the largest private U.S. healthcare systems, is notifying over 5.6 million patients and employees that their personal and health data was stolen in a May cyberattack linked to the Black Basta ransomware operation.
#bleepingcomputer#EN#2024#Ascension#Data-Breach#Healthcare#Ransomware#Security#InfoSec#Computer-Security
·bleepingcomputer.com·
Ascension: Health data of 5.6 million stolen in ransomware attack
DrayTek Routers Exploited in Massive Ransomware Campaign - Forescout
DrayTek Routers Exploited in Massive Ransomware Campaign - Forescout
  • Our 2024 Dray:Break report revealed 14 new vulnerabilities in DrayTek devices See our upcoming presentation at Black Hat Europe for more details PRODAFT shared threat intelligence from 2023 on a ransomware campaign exploiting DrayTek devices This is the first time this campaign is discussed publicly Our analysis shows sophisticated attack workflows to deploy ransomware including possible: Zero-day vulnerabilities Credential harvesting and password cracking VPN and tunneling abuse
#forescout#en#2024#draytek#ALPHV#ransomware
·forescout.com·
DrayTek Routers Exploited in Massive Ransomware Campaign - Forescout