Research reports
1,224 reports from 387 publishers45 added in the past week
143 reports, newest added first
Added Thu 9 Apr
Los Angeles' Housing Authority hit by LockBit - Claim
If folks in Los Angeles were upset about the ransomware incident involving the Los Angeles Unified School District, they might want to buckle up before reading this: It appears that LockBit 3.0 has managed to compromise and exfiltrate data from the Housing…
Ransomware
LAPSUS and the Terrible, Horrible, No Good, Very Bad Ransom Day 1 (UPDATED)
First they thought their victim hacked them back. Then they appeared to be trolled by a “negotiator” who wasn’t. I don’t know if the Brazilian threat actors who call themselves LAPSUS felt like moving to Australia after a bad day at the ransom office…
Ransomware
LockBit updates leak site with post about Sud-Francilien hospital
Weeks after everyone knew that LockBit was responsible for the attack, they added the hospital to their leak site and gave them nine more days to respond. Consistent with the usual rhetoric we see from threat actors in such circumstances, LockBit tries to put…
Ransomware
AlphV files an SEC complaint against MeridianLink for not disclosing a breach to the SEC (2)
The attack was last Tuesday, November 7. According to AlphV, they did not encrypt any files, but did exfiltrate files. MeridianLink was aware of it the day it happened. According to AlphV, no security upgrades were made following the discovery, but “once we…
Ransomware
AlphV claims an attack before even alerting the victim. How will that work out for them? (1)
So AlphV (aka BlackCat) is trying something different again, it seems. This time, it seems they are claiming a victim before they have even attempted to contact the victim or extort them. They post no proof of claims. They state that they are taking this…
Ransomware
Bits 'n Pieces (Trozos y Piezas)
DataBreaches recently reported a malware attack on Chile’s National Health Fund (FONASA). There is an update to report: In a chat on Tox, BlackCat confirmed to DataBreaches that they are responsible for the attack and they say that they will announce it soon…
Ransomware
Added Tue 7 Apr
CySecurity News - Latest Information Security and Hacking Incidents: Twisted Spider's Dangerous CACTUS Ransomware Attack
In a sophisticated cyber campaign, the group Twisted Spider, also recognized as Storm-0216, has joined forces with the cybercriminal faction Storm-1044. Employing a strategic method, they target specific endpoints through the deployment of an initial access…
Ransomware
Added Mon 6 Apr
OSX.EvilQuest Uncovered
Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve added the sample (‘OSX.EvilQuest’) to our malware collection (password: infect3d) …please don’t infect yourself! Background In part one…
RansomwareMalware
Google: Hackers target Salesforce accounts in data extortion attacks
Google has observed hackers claiming to be the ShinyHunters extortion group conducting social engineering attacks against multi-national companies to steal data from organizations' Salesforce platforms. According to Google's Threat Intelligence Group (GTIG),…
RansomwareMalware
A Deep Dive Into the Latest Maze Ransomware TTPs
With the recent attack on a Fortune 500 IT service provider, Maze ransomware is back in the news. Kroll incident response (IR) practitioners worked on multiple Maze ransomware cases during the first quarter of 2020 and have new insights on the tactics,…
Ransomware
LockBit's seized darknet site resurrected by police, teasing new revelations
The ransomware service LockBit’s darknet extortion site, which had been shuttered earlier this year after being infiltrated by law enforcement, reappeared on Sunday with police teasing fresh information about the criminals involved. It follows the closure of…
RansomwareTakedowns and arrests
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Defray777 Tool: Defray777 Names Defray777 Defray Defray 2018 Target777 Ransom X RansomExx Glushkov Category Malware Type Ransomware, Big Game Hunting Description (Palo Alto) Defray777 is an…
Ransomware
THREAT ANALYSIS REPORT: Ragnar Locker Ransomware Targeting the Energy Sector
The Cybereason Global Security Operations Center (GSOC) Team issues Threat Analysis Reports to inform on impacting threats. The Threat Analysis Reports investigate these threats and provide practical recommendations for protecting against them. In this Threat…
Ransomware
LockBit 3.0, Software S1202
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.[3] Enterprise T1071 .001 Application Layer…
Ransomware
Ransomware Attack Hinders Toll Group Operations
Customers took to Twitter to air their grievances after some of the transportation giant’s operations were downed. Australian transportation and logistics giant Toll Group said a ransomware attack is to blame for several key services being debilitated and…
Ransomware
Mount Locker Ransomware Steps up Counter-IR Capabilities, Hindering Efforts for Detection, Response and Investigation
Over the past six weeks, GuidePoint Security threat researchers have noted a change in the tactics used by Mount Locker ransomware seen in recent engagements. Mount Locker group first announced their ransomware-as-a-service offering in the second half of…
Ransomware
Added Sun 5 Apr
Luna Moth Ransomware: The Threat Actors Behind Recent False Subscription Scams
Sygnia’s team identified ‘Luna Moth’ ransom group. The threat actors resemble false subscription scammers, focusing on corporate data theft. Oren Biderman, Tomer Lahiyani, Noam Lifshitz, Ori Porag 1 July 2022 8 min Over the last few months, Sygnia’s Incident…
Ransomware
Ragnar Locker ransomware - what you need to know
What is this Ragnar Locker thing I’ve heard about? Ragnar Locker is a family of ransomware, which first came to prominence in early 2020 when it became notorious for hitting large organisations, attempting to extort large amounts of cryptocurrency from its…
Ransomware
LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Method
Threat actors are constantly improving their attack mechanisms to gain an advantage over cybersecurity defenses. Sometimes this involves new malware; other times this means making iterative adjustments to previously successful malware to exploit new…
RansomwareMalwareVulnerabilities
Russian hacker group Evil Corp targets US workers at home
The US presidential election is also just months away, and federal and local officials have been working to put measures in place to protect voter records as well as manage safe voting practices amid the pandemic. What do we know about the attack? Symantec…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.