Security Affairs

JUNE 18, 2024

Over the last few years, ransomware attacks have become one of the most prevalent and expensive forms of cybercrime. Today, this tactic has evolved, where ransomware operators in nearly every case first exfiltrate sensitive data and then threaten to publicly expose it if a ransom demand is not paid.

Ransomware 353

Ransomware Insurance Cybersecurity B2B 353

Security Affairs

APRIL 21, 2024

Government agencies revealed that Akira ransomware has breached over 250 entities worldwide and received over $42 million in ransom payments. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers. ” reads the report.

Ransomware 352

Ransomware Encryption Education Phishing 352

Security Affairs

OCTOBER 8, 2021

The Dutch government will not tolerate ransomware attacks that could threaten national security, it will use intelligence or military services to curb them. “For several years, the threat of ransomware attacks has been increasing around the world.

Ransomware 350

Ransomware Military Government Security 350

Security Affairs

JULY 15, 2022

Microsoft researchers linked the Holy Ghost ransomware (H0lyGh0st) operation to North Korea-linked threat actors. The Microsoft Threat Intelligence Center (MSTIC) researchers linked the activity of the Holy Ghost ransomware (H0lyGh0st) operation to a North Korea-linked group they tracked as DEV-0530. ” concludes Microsoft.

Ransomware 362

Ransomware Encryption Government Manufacturing 362

Security Affairs

MAY 16, 2024

Electronic prescription provider MediSecure in Australia suffered a ransomware attack likely originate from a third-party vendor. MediSecure is a company that provides digital health solutions, particularly focusing on secure electronic prescription delivery services in Australia. ” reads the statement published by the company.

Ransomware 329

Ransomware e-Delivery Data breaches Insurance 329

Security Affairs

SEPTEMBER 30, 2023

Federal Bureau of Investigation (FBI) warns of dual ransomware attacks aimed at the same victims. Federal Bureau of Investigation (FBI) is warning of dual ransomware attacks, a new worrisome trend in the threat landscape that sees threat actors targeting the same victims two times. ” continues the alert. .

Ransomware 356

Ransomware Encryption Government Access 356

Security Affairs

NOVEMBER 8, 2021

The US DoJ has charged a REvil ransomware affiliate that is suspected to have orchestrated the attack on Kaseya MSP platform in July. The US Department of Justice has charged a REvil ransomware affiliate for orchestrating the ransomware attacks on Kaseya MSP platform that took place in July 4. US DoJ also seized $6.1

Ransomware 363

Ransomware Government Security Information Security 363

Security Affairs

NOVEMBER 25, 2023

The Rhysida ransomware group claimed to have hacked the Chinese state-owned energy conglomerate China Energy Engineering Corporation. The Rhysida ransomware gang added the China Energy Engineering Corporation to the list of victims on its Tor leak site. The Rhysida ransomware operators plan to sell the stolen data to a single buyer.

Ransomware 357

Ransomware Manufacturing Education Libraries 357

Security Affairs

JULY 7, 2022

US authorities have issued a joint advisory warning of North Korea-linked APTs using Maui ransomware in attacks against the Healthcare sector. Treasury Department issued a joint advisory that warn of North-Korea-linked threat actors using Maui ransomware in attacks aimed at organizations in the Healthcare sector. Pierluigi Paganini.

Ransomware 350

Ransomware Encryption Government Cybersecurity 350

Security Affairs

JANUARY 23, 2024

The Australian government announced sanctions for a member of the REvil ransomware group for the Medibank hack that occurred in 2022. The Australian government announced sanctions for Aleksandr Gennadievich Ermakov (aka GustaveDore, aiiis_ermak, blade_runner, JimJones), a Russian national who is a member of the REvil ransomware group.

Government 343

Government Insurance Ransomware Data breaches 343

Security Affairs

JANUARY 11, 2022

AvosLocker is the latest ransomware that implemented the capability to encrypt Linux systems including VMware ESXi servers. “While we couldn’t find what targets were attacked using this AvosLocker ransomware Linux variant , BleepingComputer knows of at least one victim that got hit with a $1 million ransom demand.”

Ransomware 347

Ransomware Encryption Government Security 347

Security Affairs

DECEMBER 13, 2023

A Joint Committee on the National Security Strategy (JCNSS) warns of the high risk of a catastrophic ransomware attack on the UK government. The British government is accused of failing to mitigate the risk of ransomware attacks. said Dame Margaret Beckett, the chair of the JCNSS. Beckett added.

Ransomware 329

Ransomware Risk Government Security 329

Security Affairs

JANUARY 14, 2022

German multinational defense contractor Hensoldt confirmed to that some of its systems were infected by Lorenz ransomware. Hensoldt, a multinational defense contractor, confirmed that some of its UK subsidiary’s systems were infected with Lorenz ransomware. billion euros in 2020. Pierluigi Paganini.

Ransomware 350

Ransomware Archiving Encryption Cybersecurity 350

Security Affairs

AUGUST 18, 2024

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, newsletter)

Security 326

Security Ransomware Government IT 326

Security Affairs

NOVEMBER 20, 2023

The Canadian government discloses a data breach after threat actors hacked two of its contractors. Data belonging to current and former Government of Canada employees, members of the Canadian Armed Forces and Royal Canadian Mounted Police personnel have been also exposed. Both contractors suffered a security breach in October.

Data breaches 345

Data breaches Government IT Ransomware 345

Security Affairs

JULY 23, 2022

DoJ seized $500,000 worth of Bitcoin from North Korea-linked threat actors who are behind the Maui ransomware. Department of Justice (DoJ) has seized $500,000 worth of Bitcoin from North Korean threat actors who used the Maui ransomware to target several organizations worldwide. ” Earlier this month, the FBI, CISA, and the U.S.

Ransomware 363

Ransomware Encryption Cybersecurity Government 363

Security Affairs

JANUARY 17, 2022

The operators of the SFile ransomware (aka Escal) have developed a Linux version of their malware to expand their operations. SFile ransomware (aka Escal), has been active since 2020 , it was observed targeting only Windows systems. Recently, Rising captured the Linux platform variant of the ransomware.”

Ransomware 364

Ransomware Encryption Libraries Communications 364

Security Affairs

JUNE 6, 2021

The REvil ransomware operators said in an interview on the “Russian OSINT” Telegram channel that they accidentally targeted United States-based firms. The US government plans to forbid victims from paying the ransom, a move that according to the spokesman of the REvil gang would not be a deterrent for its operations.

Ransomware 363

Ransomware Government Security IT 363

Security Affairs

DECEMBER 4, 2021

The FBI has revealed that the Cuba ransomware gang breached the networks of at least 49 US critical infrastructure organizations. A flash alert published by the FBI has reported that the Cuba ransomware gang breached the networks of at least 49 US critical infrastructure organizations. ” states the alert.

Ransomware 363

Ransomware Encryption Communications Manufacturing 363

Security Affairs

NOVEMBER 22, 2021

US CISA and the FBI issued a joint alert to warn critical infrastructure partners and public/private organizations of ransomware attacks during holidays. The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI warn critical infrastructure partners of ransomware attacks during the holiday season.

Ransomware 349

Ransomware Phishing Passwords Authentication 349

Security Affairs

SEPTEMBER 26, 2023

This week the Rhysida ransomware group claimed the hack of the Kuwait Ministry of Finance and added it to its Tor leak site. Last week a ransomware attack hit the Government of Kuwait, the attack took place on September 18 and the government experts immediately started the incident response procedures to block the threat.

Ransomware 342

Ransomware Government Cybersecurity IT 342

Security Affairs

OCTOBER 27, 2021

Grief ransomware operators claim to have compromised computer systems at US National Rifle Association (NRA) and added it to their leak site. Grief ransomware operators announced to have hacked US National Rifle Association (NRA) and threaten to leak the stolen data. In 2019, the U.S. Pierluigi Paganini.

Ransomware 350

Ransomware Government IT Security 350

Security Affairs

JANUARY 24, 2024

A ransomware attack against the Finnish IT services provider Tietoevry disrupted the services of some Swedish government agencies and shops. The company said that the ransomware attack took place on Friday night and impacted only one data center in Sweden. The company later confirmed the news of an Akira ransomware attack.

Ransomware 346

Ransomware Government Retail Cloud 346

Security Affairs

MAY 16, 2021

Ireland Health Service Executive (HSE) refuses to pay a $20 million ransom demand after its systems were hit by the Conti ransomware gang. Ireland’s Health Service Executive that was forced to shut down its IT systems on Friday after being targeted with a significant ransomware attack. reads a statement published by the HSE.”

Ransomware 361

Ransomware IoT Cybersecurity Government 361

Security Affairs

MAY 14, 2021

Ireland’s Health Service Executive service shut down its IT systems after they were hit with a “significant ransomware attack.”. Another major ransomware attack made the headlines, this time the victim is Ireland’s Health Service Executive that was forced to shut down its IT systems on Friday. Pierluigi Paganini.

Ransomware 354

Ransomware Cybersecurity Security Government 354

Security Affairs

DECEMBER 5, 2021

German BSI warns of ransomware attacks over the Christmas and end-of-year holidays, fearing Emotet return and attacks on Microsoft Exchange servers. The German cybersecurity authority BSI warns of ransomware attacks over the Christmas holidays, fearing the return of the Emotet botnet return. ” reads the BSI’s alert.

Ransomware 354

Ransomware Cybersecurity Phishing Passwords 354

Security Affairs

MAY 16, 2021

Avaddon ransomware gang has breached the France-based financial consultancy firm Acer Finance. Avaddon ransomware gang made the headlines again, the cybercrime gang has breached the France-based financial consultancy firm Acer Finance. Acer Finance operates as an investment management company. Pierluigi Paganini. Pierluigi Paganini.

Ransomware 361

Ransomware Manufacturing Communications Risk 361

Security Affairs

OCTOBER 14, 2023

The Lockbit ransomware gang claims to have hacked the technology services giant CDW and threatens to leak the stolen data. The technology services giant CDW announced it has launched an investigation into claims made by the Lockbit ransomware gang that added the company to the list of victims on its leak site. subsidiary of CDW-G.”

Ransomware 357

Ransomware Archiving Cybersecurity Education 357

Security Affairs

AUGUST 9, 2022

Cybersecurity researchers from Kaspersky linked the Maui ransomware to the North Korea-backed Andariel APT group. Kaspersky linked with medium confidence the Maui ransomware operation to the North Korea-backed APT group Andariel , which is considered a division of the Lazarus APT Group, . SecurityAffairs – hacking, Maui ransomware).

Ransomware 360

Ransomware Computer and Electronics Encryption Government 360

Krebs on Security

AUGUST 19, 2021

Criminal hackers will try almost anything to get inside a profitable enterprise and secure a million-dollar payday from a ransomware infection. Image: Abnormal Security. Image: Abnormal Security. “Please don’t harm Sociogram’s reputation,” Medayedupin pleaded. DON’T QUIT YOUR DAY JOB.

Ransomware 363

Ransomware Access Phishing Encryption 363

Security Affairs

MAY 10, 2021

FBI confirmed that the attack against the Colonial Pipeline over the weekend was launched by the Darkside ransomware gang. Federal Bureau of Investigation confirmed that the Colonial Pipeline was shut down due to a cyber attack carried out by the Darkside ransomware gang. ” reads the statement published by the FBI. Source WSJ.

Ransomware 362

Ransomware Energy and Utilities Encryption Marketing 362

Security Affairs

JUNE 24, 2021

A new Trojan written in the Go programming language, tracked as ChaChi, was involved in ransomware attacks against government agencies and US schools. “This is a notable change in operation from earlier notable ransomware campaigns such as NotPetya or WannaCry,” continues the researchers. ” . ” . .

Ransomware 362

Ransomware Education Cybersecurity Government 362

Security Affairs

DECEMBER 30, 2021

The AvosLocker ransomware operators released a free decryptor after they accidentally encrypted the system of US Government entity. The AvosLocker ransomware operation provided a free decryptor after they encrypted the systems of a US government agency. SecurityAffairs – hacking, AvosLocker ransomware).

Ransomware 327

Ransomware Encryption Government IT 327

Security Affairs

MARCH 26, 2021

The Federal Bureau of Investigation (FBI) issued an alert to warn that the Mamba ransomware is abusing the DiskCryptor open source tool to encrypt entire drives. Mamba ransomware is one of the first malware that encrypted hard drives rather than files that was detected in public attacks. ” reads the alert published by the FBI.

Ransomware 363

Ransomware Encryption File names Passwords 363

Security Affairs

AUGUST 8, 2024

FBI and CISA published a joint advisory on the BlackSuit Ransomware group, the document provides TTPs and IOCs as recently as July 2024. CISA, in collaboration with the FBI, has published a joint advisory on the BlackSuit Ransomware group. The update includes new TTPs, IOCs, and detection methods related to BlackSuit ransomware.

Ransomware 329

Ransomware Communications Manufacturing Phishing 329

Security Affairs

NOVEMBER 14, 2023

Experts warn of an alarming rise in ransomware operations targeting the energy sector, including nuclear facilities and related research entities. Over the last year, ransomware attackers have targeted energy installations in North America, Asia, and the European Union. Resecurity, Inc.

Ransomware 352

Ransomware Government Security Access 352

Security Affairs

FEBRUARY 13, 2024

Authorities in Romania reported that at least 100 hospitals went offline after a ransomware attack hit the Hipocrate platform. Authorities in Romania confirmed that a ransomware attack that targeted the Hipocrate Information System (HIS) has disrupted operations for at least 100 hospitals. The threat actors demand the payment of 3.5

Ransomware 350

Ransomware Cleanup Encryption Cybersecurity 350