Found 15 bookmarks
Custom sorting
Investigating Anonymous VPS services used by Ransomware Gangs
Investigating Anonymous VPS services used by Ransomware Gangs
One of the challenges with investigating cybercrime is the infrastructure the adversaries leverage to conduct attacks. Cybercriminal infrastructure has evolved drastically over the last 25 years, which now involves hijacking web services, content distribution networks (CDNs), residential proxies, fast flux DNS, domain generation algorithms (DGAs), botnets of IoT devices, the Tor network, and all sorts of nested services. This blog shall investigate a small UK-based hosting provider known as BitLaunch as an example of how challenging it can be to tackle cybercriminal infrastructure. Research into this hosting provider revealed that they appear to have a multi-year history of cybercriminals using BitLaunch to host command-and-control (C2) servers via their Anonymous VPS service.
#bushidotoken#EN#2025#investigation#VPS#BitLaunch#C2#Ransomware
·blog.bushidotoken.net·
Investigating Anonymous VPS services used by Ransomware Gangs
Key figures behind Phobos and 8Base ransomware arrested in international cybercrime crackdown
Key figures behind Phobos and 8Base ransomware arrested in international cybercrime crackdown
This follows a series of high-impact arrests targeting Phobos ransomware:An administrator of Phobos was arrested in South Korea in June 2024 and extradited to the United States in November of the same year. He is now facing prosecution for orchestrating ransomware attacks that encrypted critical infrastructure, business systems, and personal data for ransom.A key Phobos affiliate was arrested in Italy...
#europol#EN#2025#busted#phobos#8base#ransomware#arrested#fedpol#crackdown#Switzerland
·europol.europa.eu·
Key figures behind Phobos and 8Base ransomware arrested in international cybercrime crackdown
RansomHub Affiliate leverages Python-based backdoor
RansomHub Affiliate leverages Python-based backdoor
In an incident response in Q4 of 2024, GuidePoint Security identified evidence of a threat actor utilizing a Python-based backdoor to maintain access to compromised endpoints. The threat actor later leveraged this access to deploy RansomHub encryptors throughout the entire impacted network. ReliaQuest documented an earlier version of this malware on their website in February 2024.
#guidepointsecurity#EN#2025#incident-response#Python-based#backdoor#ransomware#RansomHub#SocGholish#FakeUpdate
·guidepointsecurity.com·
RansomHub Affiliate leverages Python-based backdoor
Ransomware roundup: 2024 end-of-year report - Comparitech
Ransomware roundup: 2024 end-of-year report - Comparitech
In 2024, ransomware groups claimed responsibility for 5,461 successful ransomware attacks on organizations worldwide. 1,204 of these attacks were confirmed by the targeted organizations. The rest were claimed by ransomware groups on their data leak sites, but have not been acknowledged by the targets.
#comparitech#EN#2025#2024#report#ransomware#confirmed#statistcs
·comparitech.com·
Ransomware roundup: 2024 end-of-year report - Comparitech