ransomware – Page 3 – Computer Security Articles

Low-Drama ‘Dark Angels’ Reap Record Ransoms

August 5, 2024 admin A Little Sunshine, amerisourcebergen corporation, Bleeping Computer, brett stone-gross, cencora, dark angels, data breaches, dunghill leak, ransomware, SABRE, Sophos, sysco, threatlabz, zscaler

Credit to Author: BrianKrebs| Date: Mon, 05 Aug 2024 19:52:35 +0000

A ransomware group called Dark Angels made headlines this past week when it was revealed the crime group recently received a record $75 million data ransom payment from a Fortune 50 company. Security experts say the Dark Angels have been around since 2021, but the group doesn’t get much press because they work alone and maintain a low profile, picking one target at a time and favoring mass data theft over disrupting the victim’s operations.

Independent Krebs

U.S. Trades Cybercriminals to Russia in Prisoner Swap

August 1, 2024 admin alexander vinnik, alsu kurmasheva, btc-e, evan gershkovich, german moyzhes, ivan ermakov, maxim marchenko, Mt Gox, Ne'er-Do-Well News, paul whelan, ransomware, Roman Seleznev, russia's war on ukraine, trickbot, vadim krasikov, Vladimir Putin, vladislav klyushin

Credit to Author: BrianKrebs| Date: Fri, 02 Aug 2024 00:15:44 +0000

Twenty-four prisoners were freed today in an international prisoner swap between Russia and Western countries. Among the eight Russians repatriated were five convicted cybercriminals. In return, Russia has reportedly released 16 prisoners, including Wall Street Journal reporter Evan Gershkovich and ex-U.S. Marine Paul Whelan.

Microsoft Security

Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption

July 30, 2024 admin ransomware, storm

Credit to Author: Microsoft Threat Intelligence| Date: Mon, 29 Jul 2024 16:00:00 +0000

Microsoft Security researchers have observed a vulnerability used by various ransomware operators to get full administrative access to domain-joined ESXi hypervisors and encrypt the virtual machines running on them. The vulnerability involves creating a group called “ESX Admins” in Active Directory and adding an attacker-controlled user account to this group. This manipulation of the Active Directory group takes advantage of a privilege escalation vulnerability (CVE-2024-37085) in ESXi hypervisors that grants the added user full administrative access to the ESXi hypervisor. The vulnerability was fixed by VMware in their June release and ESXi administrators should install this security update.

The post Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption appeared first on Microsoft Security Blog.

Security Sophos

The State of Ransomware in Healthcare 2024

July 30, 2024 admin healthcare, products & services, ransomware, research

Credit to Author: Sally Adam| Date: Tue, 30 Jul 2024 13:52:07 +0000

402 healthcare IT/cybersecurity leaders share their latest ransomware experiences, revealing fresh insights into the realities facing the healthcare sector today.

Security Sophos

Unlocking cyber insurance savings to fund MDR

July 24, 2024 admin cyber insurance, mdr, products & services, ransomware, security operations

Credit to Author: Sally Adam| Date: Wed, 24 Jul 2024 09:20:51 +0000

Redirecting risk reduction spend from cyber insurance to MDR services is a win-win, resulting in better protection and lower cost coverage.

Security Sophos

The State of Ransomware in Critical Infrastructure 2024

July 17, 2024 admin products & services, ransomware, solutions, the state of ransomware

Credit to Author: Doug Aamoth| Date: Wed, 17 Jul 2024 19:22:16 +0000

275 IT/cybersecurity leaders from the energy, oil/gas and utilities sector share their ransomware experiences, providing new insights into the business impact of ransomware.

MalwareBytes Security

Rite Aid says 2.2 million people affected in data breach

July 17, 2024 admin news, privacy, ransomhub, ransomware, rite aid

Rite Aid has started notifying 2.2 million people that were affected by data breach that was part of a June ransomware attack.

Independent Krebs

The Stark Truth Behind the Resurgence of Russia’s Fin7

July 10, 2024 admin 7-zip, advanced ip scanner, aimp, anydesk, AutoDesk, bastion secure, bitwarden, Blackberry, combi security, esentire, FIN7, Malwarebytes, microsoft, Ne'er-Do-Well News, node.js, notepad++, pgadmin, prodaft, protectedpdfviewer, putty, python, ransomware, rest proxy, russia's war on ukraine, silent push, spearphishing, stark industries solutions, sublime text, typosquatting, Web Fraud 2.0, zach edwards

Credit to Author: BrianKrebs| Date: Wed, 10 Jul 2024 16:22:59 +0000

The Russia-based cybercrime group dubbed “Fin7,” known for phishing and malware attacks that have cost victim organizations an estimated $3 billion in losses since 2013, was declared dead last year by U.S. authorities. But experts say Fin7 has roared back to life in 2024 — setting up thousands of websites mimicking a range of media and technology companies — with the help of Stark Industries Solutions, a sprawling hosting provider is a persistent source of cyberattacks against enemies of Russia.