Research reports
1,224 reports from 387 publishers45 added in the past week
17 reports, newest added first
Added Thu 23 Apr
Negotiations with the Akira ransomware group: an ill-advised approach
@Chum1ng0 took a look at four victims of Akira and what happened in terms of negotiations or not. In translation: After a detailed analysis, we identified four chats from different companies that attempted to communicate with Akira after being attacked. Some…
Ransomware
Added Sat 11 Apr
Henry Schein re-encrypted by BlackCat again
On Saturday, October 14, Henry Schein, Inc. (Nasdaq: HSIC) determined that a portion of its manufacturing and distribution businesses experienced a cybersecurity incident. Henry Schein promptly took precautionary action, including taking certain systems…
Ransomware
"Almost everything you have posted in your news article about this incident is a total crap" -- BlackCat to Bangladeshi news outlets
On June 23, using the greeting that Hive ransomware always used in emailing victims, AlphV wrote to the Bangladesh Krishi Bank (BKB). Typos, grammar, and spelling as in the original: Hello,Ladies and Gentlemen! This is ALPHV Ransomware Team. We are here to…
Ransomware
REvil ransomware threat actors reveal their gaming company victim
In a recent interview with Yelisey Boguslavskiy, “UNKN” of the threat actors known as REvil (Sodinokibi) indicated that they were planning a major attack on a gaming network. Today, the threat actors added GPI (Gaming Partners International) to their…
Ransomware
Breaking: LockBit 3.0 gives Sick Kids free decryptor, claims to ban partner who attacked them
#LockBit has formally apologized for the attack on the Hospital for Sick Kids in Canada that took place on December 18. The hospital is still trying to recover from it. “We formally apologize for the attack on sikkids.ca and give back the decryptor for free,…
Ransomware
East Tennessee Children's Hospital updates information on ransomware incident
On March 15, this site noted that the East Tennessee Children’s Hospital had posted a notice about an IT security incident. At the time, they did not identify the incident as a ransomware incident. DataBreaches.net subsequently found some explanation for that…
Ransomware
Added Thu 9 Apr
ShinyHunters sent Google an extortion demand; Shiny comments on current activities
Even the NSA can’t stop or identify us anymore. The FBI and everyone else is irrelevant and incompetent as far as we’re concerned :). When DataBreaches asked ShinyHunters if anything in particular had inspired that statement, “Shiny1” responded: I heard the…
Ransomware
If at first you don't succeed, screw it up again?
Unfortunately for AlphV, they did not seem to know that the law wasn’t in effect yet. Today, BlackCat tried again. Their leak site now lists Viking Therapeutics as a victim. Instead of providing any proof of claims, however, they posted that they got…
Ransomware
Still think you can negotiate with REvil and get your files back? Read this first.
The government and professionals involved in ransomware incident response have often advised victims not to pay the ransom because even if you pay, you may not get your data back, and you may not get your data deleted by criminals who pinky swear that they…
Ransomware
"BlackCat" attempts to up the pressure on Suffolk County; starts to leak data?
Since September 8, Suffolk County has been trying to recover from a cyberattack by a ransomware group known as “ALPHV” or “BlackCat.” The attack disabled the county’s 911 system as well as other services. The county reverted to older methods for handling…
Ransomware
AlphV responds to MGM incident and sloppy reporting
AlphV has posted a statement about their attack on MGM Resorts. They also post some scathing criticisms of journalists and news outlets for reporting inaccurately and not verifying sources. Of note, their statement also asserts, “The ALPHV ransomware group…
Ransomware
Los Angeles' Housing Authority hit by LockBit - Claim
If folks in Los Angeles were upset about the ransomware incident involving the Los Angeles Unified School District, they might want to buckle up before reading this: It appears that LockBit 3.0 has managed to compromise and exfiltrate data from the Housing…
Ransomware
LAPSUS and the Terrible, Horrible, No Good, Very Bad Ransom Day 1 (UPDATED)
First they thought their victim hacked them back. Then they appeared to be trolled by a “negotiator” who wasn’t. I don’t know if the Brazilian threat actors who call themselves LAPSUS felt like moving to Australia after a bad day at the ransom office…
Ransomware
LockBit updates leak site with post about Sud-Francilien hospital
Weeks after everyone knew that LockBit was responsible for the attack, they added the hospital to their leak site and gave them nine more days to respond. Consistent with the usual rhetoric we see from threat actors in such circumstances, LockBit tries to put…
Ransomware
AlphV files an SEC complaint against MeridianLink for not disclosing a breach to the SEC (2)
The attack was last Tuesday, November 7. According to AlphV, they did not encrypt any files, but did exfiltrate files. MeridianLink was aware of it the day it happened. According to AlphV, no security upgrades were made following the discovery, but “once we…
Ransomware
AlphV claims an attack before even alerting the victim. How will that work out for them? (1)
So AlphV (aka BlackCat) is trying something different again, it seems. This time, it seems they are claiming a victim before they have even attempted to contact the victim or extort them. They post no proof of claims. They state that they are taking this…
Ransomware
Bits 'n Pieces (Trozos y Piezas)
DataBreaches recently reported a malware attack on Chile’s National Health Fund (FONASA). There is an update to report: In a chat on Tox, BlackCat confirmed to DataBreaches that they are responsible for the attack and they say that they will announce it soon…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.