Found 151 bookmarks
Custom sorting
Ransomware roundup: 2024 end-of-year report - Comparitech
Ransomware roundup: 2024 end-of-year report - Comparitech
In 2024, ransomware groups claimed responsibility for 5,461 successful ransomware attacks on organizations worldwide. 1,204 of these attacks were confirmed by the targeted organizations. The rest were claimed by ransomware groups on their data leak sites, but have not been acknowledged by the targets.
#comparitech#EN#2025#2024#report#ransomware#confirmed#statistcs
·comparitech.com·
Ransomware roundup: 2024 end-of-year report - Comparitech
FunkSec – Alleged Top Ransomware Group Powered by AI
FunkSec – Alleged Top Ransomware Group Powered by AI
  • The FunkSec ransomware group emerged in late 2024 and published over 85 victims in December, surpassing every other ransomware group that month. FunkSec operators appear to use AI-assisted malware development which can enable even inexperienced actors to quickly produce and refine advanced tools. The group’s activities straddle the line between hacktivism and cybercrime, complicating efforts to understand their true motivations. Many of the group’s leaked datasets are recycled from previous hacktivism campaigns, raising doubts about the authenticity of their disclosures. Current methods of assessing ransomware group threats often rely on the actors’ own claims, highlighting the need for more objective evaluation techniques.
#checkpoint#EN#2024#FunkSec#analysis#ransomware
·research.checkpoint.com·
FunkSec – Alleged Top Ransomware Group Powered by AI
Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing
Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing
U.K. investigators tell the story of how examining a cybercrime group's extortion funds helped to unravel a money-laundering network reaching from the illegal drug trade to Moscow's elite.
#therecord.media#EN#2024#Operation-Destabilise#ransomware#Russia#UK#cybercrime#money-laundering
·therecord.media·
Inside Operation Destabilise: How a ransomware investigation linked Russian money laundering and street-level drug dealing
Ascension: Health data of 5.6 million stolen in ransomware attack
Ascension: Health data of 5.6 million stolen in ransomware attack
​Ascension, one of the largest private U.S. healthcare systems, is notifying over 5.6 million patients and employees that their personal and health data was stolen in a May cyberattack linked to the Black Basta ransomware operation.
#bleepingcomputer#EN#2024#Ascension#Data-Breach#Healthcare#Ransomware#Security#InfoSec#Computer-Security
·bleepingcomputer.com·
Ascension: Health data of 5.6 million stolen in ransomware attack
DrayTek Routers Exploited in Massive Ransomware Campaign - Forescout
DrayTek Routers Exploited in Massive Ransomware Campaign - Forescout
  • Our 2024 Dray:Break report revealed 14 new vulnerabilities in DrayTek devices See our upcoming presentation at Black Hat Europe for more details PRODAFT shared threat intelligence from 2023 on a ransomware campaign exploiting DrayTek devices This is the first time this campaign is discussed publicly Our analysis shows sophisticated attack workflows to deploy ransomware including possible: Zero-day vulnerabilities Credential harvesting and password cracking VPN and tunneling abuse
#forescout#en#2024#draytek#ALPHV#ransomware
·forescout.com·
DrayTek Routers Exploited in Massive Ransomware Campaign - Forescout
Office of Public Affairs | Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charge
Office of Public Affairs | Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charge
The Justice Department unsealed criminal charges today against Evgenii Ptitsyn, 42, a Russian national, for allegedly administering the sale, distribution, and operation of Phobos ransomware.
#justice.gov#US#2024#EN#Phobos#Ransomware#Administrator#Extradited
·justice.gov·
Office of Public Affairs | Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charge
Change Healthcare says 100 million people impacted by February ransomware attack
Change Healthcare says 100 million people impacted by February ransomware attack
Change Healthcare updated filings with the federal government to warn that about 100 million people had information accessed by hackers during a ransomware attack in February. The Department of Health and Human Services’s (HHS) Office for Civil Rights said Change Healthcare notified them on October 22 that “approximately 100 million individual notices have been sent regarding this breach.”
#therecord.media#EN#2024#Change#Healthcare#Data-Breach#HHS#ransomware#health#PII
·therecord.media·
Change Healthcare says 100 million people impacted by February ransomware attack
Lynx Ransomware: A Rebranding of INC Ransomware
Lynx Ransomware: A Rebranding of INC Ransomware
Discover recent attacks using Lynx ransomware, a rebrand of INC, targeting multiple crucial sectors in the U.S. and UK with prevalent double-extortion tactics. Discover recent attacks using Lynx ransomware, a rebrand of INC, targeting multiple crucial sectors in the U.S. and UK with prevalent double-extortion tactics.
#paloaltonetworks#EN#2024#Lynx#Ransomware#INC#US#UK#analysis
·unit42.paloaltonetworks.com·
Lynx Ransomware: A Rebranding of INC Ransomware
Perfecting Ransomware on AWS — Using ‘keys to the kingdom’ to change the locks
Perfecting Ransomware on AWS — Using ‘keys to the kingdom’ to change the locks
If someone asked me what was the best way to make money from a compromised AWS Account (assume root access even) — I would have answered “dump the data and hope that no-one notices you before you finish it up.” This answer would have been valid until ~8 months ago when I stumbled upon a lesser known feature of AWS KMS which allows an attacker to do devastating ransomware attacks on a compromised AWS account. Now I know that ransomware attacks using cross-account KMS keys is already known (checkout the article below)— but even then, the CMK is managed by AWS and they can just block the attackers access to the CMK and decrypt data for the victim because the key is OWNED by AWS and attacker is just given API access to it under AWS TOS. Also there’s no way to delete the CMK but only schedule the key deletion (min 7 days) which means there’s ample time for AWS to intervene.
#@harsh8v#EN#2024#medium#AWS#Ransomware#KMS#keys
·medium.com·
Perfecting Ransomware on AWS — Using ‘keys to the kingdom’ to change the locks