Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Ransomware Threat. Show all posts
server access
Black Suit hackers Cyber Data Breach Hacker group KADOKAWA cyberattack Ransomware Threat server access

Hackers Warn of Further Attacks on KADOKAWA, Claim Ongoing Access to Servers

 

KADOKAWA is on high alert for potential cyberattacks from the Russian hacker group Black Suit after failed negotiations aimed at resolving a previous major cyber incident. Black Suit, known for its ransomware operations, has warned of further attacks following KADOKAWA's refusal to pay an $8 million ransom (around 1.1 billion yen).

In a recent update to Kyodo News, the hackers disclosed that discussions with the company had broken down.

“We demanded $8 million, but KADOKAWA did not comply,” Black Suit stated, cautioning that the company “will face the same problem repeatedly” as they still have access to KADOKAWA’s systems.

Cybersecurity specialist Katsuji Okamoto from Trend Micro commented on the matter, stressing the severity of the threat.

“Even if this is a bluff, KADOKAWA must reassess its systems and prepare for the worst. Black Suit is notorious for their persistence and thorough execution of attacks, typically carrying them out from start to finish independently.”

KADOKAWA, however, has chosen not to disclose specific details about the incident, citing an active police investigation.

“This is a matter under police investigation, and we cannot comment,” a company spokesperson said.

The company initially reported the cyberattack in early June, noting disruptions across multiple websites and services. Since then, KADOKAWA has provided regular updates on its progress in system restoration and investigation efforts.

On June 27, 2024, Black Suit reportedly revealed the full scale of the breach, claiming they had stolen 1.5 terabytes of sensitive data, including business plans, user information, contracts, and financial records.

The group alleged they exploited vulnerabilities within KADOKAWA’s network infrastructure, gaining access to a “control center” that enabled them to encrypt the entire network, impacting subsidiaries like Dwango and NicoNico.

They threatened to release the stolen data if the ransom was not paid by July 1, 2024.

As of August 5, KADOKAWA confirmed a data leak affecting 254,241 individuals, following an investigation by third-party experts.
Read more »
Threatactors
Cyber Security Cyberattacks CyberCrime Cyberrisk Cyberthreats Ransomware Threat Reliance and M&A Surge Software Threatactors

Vendor Reliance and M&A Surge Contribute to Heightened Ransomware Threat

 


In 2024, threat actors are likely to evolve tactics to exploit the consolidation of businesses and technologies. The mid-year 2024 cyber risk report released by Resilience Group indicates that mergers and acquisitions (M&As) are becoming more popular as well as the trend of increased reliance on major software vendors, allowing threat actors to take advantage of new opportunities. 

A growing number of threat actors are exploiting business consolidations and technological advancements to launch widespread ransomware attacks, which means organizations need to rethink the way they address new vulnerabilities if they want to remain secure and resilient in the future. As a result of mergers and acquisitions (M&A) and an increased reliance on key software vendors, cyber security firm Resilience has found that there is a record number of potential points of failure for hackers to exploit, which has resulted in the most damaging cyber incidents of the last year, resulting in an unprecedented number of potential points of failure. 

According to the latest statistics, ransomware is the leading cause of financial losses around the world. Using the 'business and technology consolidation' as an opportunity to benefit from the consolidation of business and technology, threat actors have evolved their tactics in 2024 according to Resilience, a leading provider of cyber risk solutions which published its Midyear Cyber Risk Report 2024. 

Due to the increased integration of software vendors into the marketplace as well as the reliance on a single point of failure, threat actors have been able to unleash widespread ransomware campaigns by exploiting disparities between the many vendors. During the past year, we have witnessed some of the most disruptive cyberattacks possibly in the history of mankind, many of which involved heavily interconnected systems or recently acquired companies, which had devastating effects—even causing a range of economic sectors to undergo disruptions. 

As part of the Midyear 2024 Cyber Risk Report, released today by Resilience, Resilience has analyzed trends in hacking activity, as well as industry responses to hacking, based on data from our Threat Intelligence team and insurance claims portfolio. As noted in Resilience's report, threat actors have evolved their tactics to take advantage of the increased consolidation of businesses and technology, which has increased ransomware campaigns when compared to the previous year. 

There have been increasingly more campaigns targeting interconnected systems and newly acquired companies, posing substantial risks to a variety of economic sectors due to the exposure. Moreover, the report stated that 35% of all claims made since the beginning of 2023 were due to breaches or ransom attacks caused by third parties. By 2024, there is an expectation that this percentage will rise to 40% and is expected to continue on its upward trajectory. 

A recent study by Resilience explained that technology consolidation, in which industries rely on one or a few companies for critical platform services, has proved to have catastrophic consequences downstream when a single vendor is breached, wrote Marykate Broderick for Resilience. Besides the ransomware itself, impacted organizations may also have to pay significant income losses due to business interruptions, as well as ransom payments in addition to the possibility of finding themselves liable for ransoms." 

Based on the results of the Claims Data for the year 2024, the manufacturing and construction industries have been reported to have had the highest growth in the number of claims made. The number of manufacturing damage claims surged by 41.7% in 2024, compared to 15.2% in 2023, and the number of construction damage claims also increased by 6.1% within the same time frame. 

This quarter, Resilience, revealed that the majority of claims have been filed at the company due to several ransomware attacks, as well as exploits of two zero-day vulnerabilities that were found in the PanOS operating system during the first quarter of 2024. Ransomware, a crypto-currency attack, that took place in February on Change Healthcare, greatly impacted the company's billing and care authorization systems, along with the company's overall operations as a whole. Due to the attack, the US healthcare system has been hit by wide-ranging disruptions affecting hospitals and pharmacies all over the country.

It took UnitedHealth Group, the parent company of Change Healthcare, a considerable amount of time and effort to thoroughly recover and rebuild the affected platforms from scratch to restore service to the patients. In June 2024, CDK Global, a company that provides cloud-based software for automobile dealerships, suffered from a ransomware attack, which resulted in significant disruptions to the company's operations. 

There are approximately 15,000 car dealerships across the US that have been forced to turn their IT systems off, and some have also decided to revert to manual processes to keep the business operating. As a result of the attack, which is believed to be the work of the BlackSuit ransomware group, severe economic consequences have also been brought on to the company, with estimates of around 100,000 vehicle sales being affected. Recently, the Federal Bureau of Investigation (FBI), a unit of the United States Department of Justice, confirmed that it had successfully disrupted a criminal ransomware group that was known as "Radar" or "Dispossessor." 

An operation by the FBI's Cleveland division was instrumental in dismantling the key infrastructure linked to the group, including servers in the United States, United Kingdom, and Germany, in response to the investigation. In addition to several criminal domains being taken offline as part of the crackdown, the FBI executed the operation in collaboration with international partners. These partners included the UK’s National Crime Agency and law enforcement agencies in Germany. This coordinated effort underscores the increasing severity and sophistication of ransomware attacks, which have escalated as cybercriminals continue to demand larger ransoms each year. 

Bayer emphasized the need for business leaders to be prepared for the growing ransomware threat landscape, which he described as increasingly treacherous. He advised that by conceptualizing these attacks as inevitable rather than remote possibilities, organizations can better prepare by investing in cybersecurity personnel, processes, and technology. Such proactive measures will enable businesses to recover more quickly from attacks, minimizing disruption to their operations.
Read more »
Trojan
Cyber Attacks IT Sector Malware Attack Ransomware attack Ransomware Threat Remote Access Trojan Trojan

New Ransomware Threat: Hunters International Deploys SharpRhino RAT

 

In a troubling development for cybersecurity professionals, the Hunters International ransomware group has introduced a sophisticated new remote access trojan (RAT) called SharpRhino. This C#-based malware is specifically designed to target IT workers and breach corporate networks through a multi-stage attack process. The malware’s primary functions include achieving initial infection, elevating privileges on compromised systems, executing PowerShell commands, and ultimately deploying a ransomware payload. 

Recent findings from Quorum Cyber researchers reveal that SharpRhino is distributed via a malicious site masquerading as Angry IP Scanner, a legitimate networking tool widely used by IT professionals. The deceptive website uses typosquatting techniques to lure unsuspecting users into downloading the malware. This approach highlights a new tactic by Hunters International, aiming to exploit the trust IT workers place in well-known tools. The SharpRhino RAT operates through a digitally signed 32-bit installer named ‘ipscan-3.9.1-setup.exe.’ 

This installer contains a self-extracting, password-protected 7z archive filled with additional files necessary for the malware’s execution. Upon installation, SharpRhino modifies the Windows registry to ensure persistence on the compromised system and creates a shortcut to Microsoft.AnyKey.exe, which is normally a Microsoft Visual Studio binary but is abused here for malicious purposes. Additionally, the installer drops a file named ‘LogUpdate.bat,’ which executes PowerShell scripts to run the malware stealthily. To facilitate command and control (C2) operations, SharpRhino creates two directories: ‘C:\ProgramData\Microsoft: WindowsUpdater24’ and ‘LogUpdateWindows.’ 

These directories are used to manage communication between the malware and its operators. SharpRhino also includes hardcoded commands such as ‘delay’ to set the timer for the next POST request and ‘exit’ to terminate communication. This enables the malware to execute various dangerous actions, including launching PowerShell commands. For instance, Quorum Cyber researchers demonstrated the malware’s capability by launching the Windows calculator. Hunters International, which began operations in late 2023, has been associated with several high-profile ransomware attacks. Notable victims include U.S. Navy contractor Austal USA, Japanese optics giant Hoya, Integris Health, and the Fred Hutch Cancer Center. 

In 2024 alone, the group has claimed responsibility for 134 ransomware attacks, ranking it among the top ten most active ransomware operators globally. The deployment of SharpRhino through a fake website underscores Hunters International’s strategic focus on IT professionals, leveraging their reliance on familiar software to infiltrate corporate networks. To protect against such threats, users should exercise caution with search results and sponsored links, use ad blockers, and verify the authenticity of download sources. Implementing robust backup plans, network segmentation, and keeping software up-to-date are essential measures to mitigate the risk of ransomware attacks.
Read more »
Software
Cyber Attacks Cyber Victim CyberCrime Cybersecurity CyberThreat Ransomware Threat Software

California's Major Trial Court Falls Victim to Ransomware Attack

 


It has been reported that the computer system at the largest trial court in this country has been infected by ransomware, causing the system to crash. Superior Court officials said they were investigating the incident. As soon as the court learned that the computer network systems had been hacked, the systems were disabled, and they are expected to remain down until the weekend at the very least. 

Following the statement, a preliminary investigation revealed no evidence that the user's data had been compromised in any way. According to officials with the Superior Court of Los Angeles County, the nation's largest trial court was closed Monday as a ransomware attack shut down its computer system late last week, resulting in a shutdown of its library and many other departments. 

As soon as the court became aware of the cyberattack early Friday morning, its computer network was disabled, and the system remained offline throughout the weekend due to the attack. There will be no courthouse operations on Monday, despite reports that the county's 36 courthouses will all remain open to the public on Friday. According to a statement released by the FBI on Friday morning, officials do not believe the cyberattack related to the faulty CrowdStrike software update that has disrupted airlines, hospitals, and governments worldwide is related to the security breach. 

Once the court was made aware of the attack, all computer systems connected to its computer network were disabled. An initial investigation has revealed no evidence that the data of users has been compromised, according to the statement released by the company. KCAL, the CNN affiliate based in Los Angeles, reported Monday that the judicial system continues to be closed as it tries to recover. 

As the largest court system in the United States that serves a broad range of services to more than 10 million residents in 36 courthouses, the Superior Court of Los Angeles County is the largest unified court system in the country. The number of cases filed in 2022 is expected to reach nearly 1.2 million, and there will be almost 2,200 jury trials. According to the Presiding Judge Samantha P. Jessner, "The Court has been experiencing a cyber-attack which has resulted in almost all of our network systems being shut down. 

Companies have contained the damage to their network, ensured data integrity and confidentiality, and ensured future network stability and security" during an unprecedented cyber-attack on Friday. The court has reopened all 36 courthouses tomorrow, July 23, following the tireless dedication of the staff and security experts required to assist in restoring the court to full operation," according to a statement published on the court's website. Court users need to be aware that there will be delays and potential impacts due to limitations in functionality.
Read more »
Ransomware Threat
Cyber Security Data Hacking data security Healthcare system Network Security Ransomware attack Ransomware Threat

Understanding Qilin Ransomware: Threats, Origins, and Impacts on Healthcare

 

Qilin, also known as Agenda, is a ransomware-as-a-service operation that collaborates with affiliates to encrypt and exfiltrate data from hacked organizations, demanding a ransom in return. 

Despite its name deriving from a mythical Chinese creature that combines features of a dragon and a horned beast, the Qilin ransomware group is linked to Russia. Qilin has been active since October 2022, when it first posted about a victim on its darknet leak site. Since then, its activities have increased, affecting notable organizations such as the street newspaper The Big Issue, automotive parts giant Yanfeng, and the Australian court service. 

Recently, Qilin made headlines following a ransomware attack against Synnovis, a firm involved in blood testing and transfusions. This attack led to an emergency "critical incident" being declared at several London hospitals, with Qilin threatening to release stolen data unless a ransom is paid. Reports suggest that Qilin is demanding a substantial ransom of $50 million from Synnovis for the decryption tools and a promise not to publish the data. 

However, in media interviews, the group claimed that the attack was not financially motivated but a protest against the British government's involvement in an unspecified war. This claim is dubious given Qilin's history of targeting various businesses and healthcare organizations without prior political motivations. The high ransom demand likely reflects the significant disruption caused to the hospitals and their patients, rather than any genuine political agenda. 

Healthcare organizations and hospitals are frequent targets of ransomware attacks due to their complex IT systems and limited budgets. The consequences of such attacks are severe, as they can disrupt critical medical services. Ransomware groups view these entities as "soft targets," hoping to extract payments due to the urgent need to restore services. To protect against Qilin and similar ransomware threats, organizations should implement several key measures.

These include making secure offsite backups, using up-to-date security solutions, and applying the latest security patches to guard against vulnerabilities. Network segmentation can restrict an attacker's ability to move laterally within an organization. Using strong, unique passwords and enabling multi-factor authentication can protect sensitive data and accounts. Encrypting sensitive data and disabling unnecessary functionalities can further reduce the attack surface. 

Educating staff about cyber risks and attack methods is also crucial in maintaining organizational security. By taking these precautions, organizations can reduce the risk of falling victim to ransomware groups like Qilin, ensuring they are better prepared to defend against such malicious activities.
Read more »
Ransomware Threat
Change Ransomware Data Leak Healthcare Privacy Ransomware Threat

The High Cost of Ransomware: Change Healthcare’s $22 Million Payout and Its Aftermath

Change Healthcare’s $22 Million Payout and Its Aftermath

A Costly Decision: The $22 Million Ransom

When Change Healthcare paid $22 million in March to a ransomware gang that had devastated the company as well as hundreds of hospitals, medical practices, and pharmacies throughout the US, the cybersecurity industry warned that Change's extortion payment would only fuel a vicious cycle. 

It appeared that rewarding hackers who had carried out a merciless act of sabotage against the US health-care system with one of the largest ransomware payments in history would stimulate a new wave of attacks on similarly vulnerable victims. The wave has arrived.

This decision came after a crippling cyberattack that not only brought the company to its knees but also impacted hundreds of hospitals, medical practices, and pharmacies nationwide.

The ransomware attack on Change Healthcare was not just another statistic; it was a ruthless act of sabotage against the US healthcare system. The payment made by Change Healthcare is one of the largest ransomware payouts in history and has raised serious concerns about the implications of such actions.

Cybersecurity Warnings Ignored: The Ripple Effect

Cybersecurity experts have long warned against paying ransoms to cybercriminals. The rationale is straightforward: meeting hackers’ demands fuels a vicious cycle, encouraging them to continue their nefarious activities with the knowledge that their tactics are effective. In the case of Change Healthcare, this warning was not heeded, and the consequences were immediate and alarming.

Record-breaking Surge in Healthcare Cyberattacks

According to cybersecurity firm Recorded Future, there was a record-breaking spike in medical-targeted ransomware incidents following Change Healthcare’s payout. A total of 44 health-care-related cyberattacks were reported in just one month after the incident came to light—the most ever recorded in such a short span. This surge serves as a grim reminder of the potential fallout from capitulating to cybercriminals’ demands.

Why Healthcare is a Prime Target for Ransomware

The healthcare sector has become an increasingly attractive target for ransomware gangs. The reason is twofold: healthcare organizations often possess sensitive patient data, and they operate under the pressure of needing to maintain uninterrupted services. This combination makes them more likely to pay ransoms quickly to restore operations and protect patient privacy.

The aftermath of Change Healthcare’s payment is a testament to the broader implications of ransomware attacks on critical infrastructure. It’s not just about the immediate financial loss; it’s about the long-term impact on trust and security in an industry that is integral to public well-being.

Read more »
Ransomware Threat
2024 cyber crimes Chainalysis Coveware CVE CVE vulnerability Cyber Security Ransomware attack Ransomware Threat

Drop in ransomware payment, 2024 Q1 sees a record low of 28%

 

Ransomware actors have encountered a rocky start in 2024, as indicated by statistics from cybersecurity firm Coveware. Companies are increasingly refusing to acquiesce to extortion demands, resulting in a record low of only 28% of companies paying ransom in the first quarter of the year. This figure marks a notable decrease from the 29% reported in the previous quarter of 2023. Coveware's data underscores a consistent trend since early 2019, showing a diminishing rate of ransom payments. 

The decline in ransom payments can be attributed to several factors. Organizations are implementing more sophisticated protective measures to fortify their defenses against ransomware attacks. Additionally, mounting legal pressure discourages companies from capitulating to cybercriminals' financial demands. Moreover, ransomware operators frequently breach promises not to disclose or sell stolen data even after receiving payment, further eroding trust in the extortion process. 

Despite the decrease in the payment rate, the overall amount paid to ransomware actors has surged to unprecedented levels. According to a report by Chainalysis, ransomware payments reached a staggering $1.1 billion in the previous year. This surge in payments is fueled by ransomware gangs targeting a larger number of organizations and demanding higher ransom amounts to prevent the exposure of stolen data and provide victims with decryption keys. 

In the first quarter of 2024, Coveware reports a significant 32% quarter-over-quarter drop in the average ransom payment, which now stands at $381,980. Conversely, the median ransom payment has seen a 25% quarter-over-quarter increase, reaching $250,000. This simultaneous decrease in the average and rise in the median ransom payments suggest a shift towards more moderate ransom demands, with fewer high-value targets succumbing to extortion. Examining the initial infiltration methods used by ransomware operators reveals a rising number of cases where the method is unknown, accounting for nearly half of all reported cases in the first quarter of 2024. 

Among the identified methods, remote access and vulnerability exploitation play a significant role, with certain CVE flaws being widely exploited by ransomware operators. The recent disruption of the LockBit operation by the FBI has had a profound impact on the ransomware landscape, reflected in Coveware's attack statistics. This law enforcement action has not only disrupted major ransomware gangs but has also led to payment disputes and exit scams, such as those witnessed with BlackCat/ALPHV. 

 Furthermore, these law enforcement operations have eroded the confidence of ransomware affiliates in ransomware-as-a-service (RaaS) operators, prompting many affiliates to operate independently. Some affiliates have even opted to exit cybercrime altogether, fearing the increased risk of legal consequences and the potential loss of income. Amidst these developments, one ransomware strain stands out as particularly active: Akira. 

This strain has remained the most active ransomware in terms of attacks launched in the first quarter of the year, maintaining its position for nine consecutive months. According to the FBI, Akira is responsible for breaches in at least 250 organizations and has amassed $42 million in ransom payments. Implementing robust protective measures, staying informed about emerging threats, and fostering collaboration with law enforcement agencies are essential strategies for mitigating the risks posed by ransomware attacks and safeguarding sensitive data from malicious actors.
Read more »
Ransomware Threat
Cyber Security cyber threat Cyberattacks data security INC NHS Ransomware Threat

Data Breach Alert: 3TB of NHS Scotland Data Held Ransom by Cyber Threat

 


A ransomware group targeting a small group of patients has published clinical data related to a small number of those patients on the internet that the Dumfries and Galloway Health Board is aware of. In the meantime, three terabytes of data are also alleged to have been stolen thanks to a security breach that occurred at the National Health Service (NHS) in Scotland, by the INC Ransom extortion gang. 

 As a result of a ransomware attack in a regional branch, NHS Scotland says it has been able to contain the malware, preventing the infection from spreading to other branches and the entire organisation. A group of cybercriminals called INC Ransom claimed responsibility for the attack on NHS Scotland this week, claiming they stole three terabytes (TB) of data and leaked a limited number of sensitive documents as part of the attack. 

Earlier this month, NHS Dumfries and Galloway announced a serious cyberattack that resulted in their hospital being shut down. INC Ransom was offering samples of files that contained medical evaluations, psychological reports, and other sensitive information regarding patients and doctors in accompanying its warning posted on its extortion website. 

Despite the rumours that such a compromise had already been reached, the Scottish government made sure to emphasize that only the NHS Dumfries and Galloway regional health board was affected by this new agreement. Several days later, NHS Dumfries and Galloway officials revealed that during a breach of security two weeks ago, large quantities of personally identifiable information had been accessed, stolen, and exfiltrated, resulting in a large number of people's details being misused. 

As of July 2023, the INC Ransom operation has gained a lot of attention, targeting both government organizations as well as private businesses to extort their data for ransom. Education, healthcare and government institutions, as well as industrial entities like Yamaha Motor Corporation, are among those that suffer losses from this attack. As the attack was likely to have occurred around March 15, reports emerged that a cybersecurity incident was affecting NHS Scotland services. 

There were several sample documents published yesterday by the threat actor in a blog post, including medical assessments, analysis results, and psychological reports on doctors and patients with sensitive details. Throughout its history, INC has shown no restraint in its process of choosing the types of victims it is willing to target, either. 

There have been several incidents of ransomware spreading across the healthcare industry, education, as well as charities. This is something that has happened in its short time on the ransomware scene. The fact remains, though, that very few cybercriminals exercise that level of restraint in the current day and age. Due to the critical nature of healthcare and the fact that it provides several essential services, cybercriminals and ransomware baddies continue to target it. 

There is a chance that there will be a ransom paid if disruptions can be caused, allowing for patients to be cared for with full capability if a ransom is paid. ALPHV/BlackCat was credited by the media with blaming Change Healthcare for a potentially devastating attack spread across a period of weeks across February and March of this year, which knocked out services for weeks on end.

In February, Romania experienced a significant ransomware incident affecting over 100 facilities, highlighting the persistent targeting of healthcare by cybercriminals. This incident is one of numerous examples underscoring the sector's vulnerability to such threats. The United States has responded to this challenge by introducing initiatives like the Advanced Research Projects Agency for Health (ARPA-H) within DARPA. 

This addition to a two-year cash-for-ideas competition aims to discover methods for securing code in critical infrastructure, including healthcare systems. Last summer, the announcement of the Artificial Intelligence Cyber Challenge (AICC) further demonstrated efforts to combat cyber threats. Teams participating in this challenge are tasked with developing autonomous tools to detect code issues in software used by vital organizations like hospitals and water treatment facilities—both prime targets for cybercrime.

ARPA-H has allocated $20 million towards the AIxCC, emphasizing its commitment to safeguarding healthcare from devastating attacks. Such attacks, exemplified by incidents like the one on Change Healthcare, underscore the urgent need for enhanced cybersecurity measures to prevent disruptions that could jeopardize patient care.
Read more »
Subscribe to: Posts (Atom)