Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Ransomware. Show all posts
Third party breaches
Companies Data Breaches Ransomware Third party breaches

The Growing Danger of Third-Party Security Risks

 


A new study has surfaced a major cybersecurity concern for businesses: security vulnerabilities from third-party partners. According to a recent report by SecurityScorecard, more than a third of all data breaches in 2024 were linked to third-party service providers.


Underreported Threats

The research examined 1,000 cybersecurity incidents across different industries and regions. It found that 35.5% of breaches were due to third-party security weaknesses. However, experts believe the real number may be even higher due to many incidents being misclassified or not reported.


High-Risk Sectors

The report also revealed that the nature of these attacks is changing. In 2025, fewer third-party breaches involved technology services than in previous years. Only 46.75% of such breaches were linked to tech-related businesses, a decline from 75% the year before. This means cybercriminals are targeting a broader range of industries.

Among the most affected industries were retail and hospitality, which experienced the highest rate of third-party security breaches at 52.4%. The technology sector followed closely at 47.3%, while energy and utility companies saw a 46.7% breach rate. Even though the healthcare industry had a lower percentage of breaches (32.2%), it faced the highest total number of attacks, with 78 incidents recorded.


Global Hotspots for Third-Party Breaches

Certain countries saw a higher frequency of breaches. Singapore reported the most third-party cyber incidents, with 71.4% of breaches originating from external vendors. The Netherlands followed at 70.4%, while Japan recorded 60%.

The report also pointed out that ransomware groups are increasingly exploiting third-party connections to gain access to their targets. More than 41.4% of ransomware attacks now originate through a compromised third-party vendor. The notorious Cl0p ransomware gang has been particularly active in using this method.


Strengthening Security Measures

Cybercriminals favor third-party breaches because they allow access to multiple organizations at once. Security experts warn that businesses need to move away from occasional security checks of their vendors and instead implement continuous monitoring. By keeping a close watch on external partners' security measures, companies can reduce the risk of cyber threats before they escalate into major breaches.





Read more »
SaaS Ransomware
2FA Cyber crimes Operational Technology Ransomware SaaS Ransomware

Ransomware Attacks Are Increasing— How Hackers Are Adapting

 



Cybercriminals are finding new ways to launch ransomware attacks, and recent reports show a major increase in these incidents. The latest warning from security experts highlights how hackers are evolving their tactics, making these threats more dangerous than ever.  


Ransomware Attacks Have Risen Sharply  

The number of ransomware attacks has grown in early 2025, with reports showing a 132% increase compared to late 2024. At the same time, a specific type of scam known as deepfake phishing—where AI is used to trick people into giving away sensitive information—has surged by more than 1,600%. These scams often lead to ransomware infections, as hackers use them to gain access to private systems.  

Although many organizations have improved their cybersecurity measures, hackers are adapting. Cybercriminals are focusing on new methods to steal information, including bypassing two-factor authentication (2FA). In many cases, they intercept security codes or hijack login sessions, allowing them to enter accounts without needing passwords.  


Hackers Are Targeting More Systems  

A growing concern is that cybercriminals are now attacking systems that control important operations, such as industrial machines and corporate networks. These systems, known as operational technology (OT) environments, are becoming frequent targets for ransomware groups.  

Security researchers from Ontinue warn that cybercriminals are not just trying to lock files and demand payments— they are using artificial intelligence (AI) and legitimate tools to break into networks without being detected. Instead of relying solely on traditional phishing emails, hackers now interact with IT staff, tricking them into sharing confidential details that can be used for future attacks.  


Ransom Payments Are Declining— But The Threat Isn’t  

One positive trend is that fewer companies are paying ransom demands. Recent studies show that overall payments have dropped by 35%. This is partly due to stronger law enforcement efforts, international cooperation, and organizations refusing to give in to extortion.  

However, experts warn that this might not last. Cybercriminals are constantly adjusting their methods. Instead of just encrypting files, many ransomware groups now steal sensitive data and threaten to leak it unless victims pay up. Some hackers even demand multiple payments—one to prevent data from being leaked, another to unlock encrypted files, and sometimes an additional ransom for other threats.  


The Future of Ransomware Attacks  

Security professionals are seeing a shift in how ransomware works. Hackers are no longer just sending out mass phishing emails. They are carefully studying security systems, looking for vulnerabilities, and even using software-as-a-service (SaaS) platforms to deliver attacks.  

Experts recommend that businesses and individuals take extra precautions. Strengthening cybersecurity defenses, keeping software updated, and being cautious of unexpected emails or messages can help prevent falling victim to these evolving threats.

Read more »
VanHelsing
AR CyberCrime CyberThreat ESXi Platforms Google Window malware Ransomware VanHelsing

VanHelsing Ransomware Strikes Windows ARM and ESXi Platforms

 


As part of an ongoing analysis of ransomware-as-a-service operations, a new operation known as VanHelsing has been identified. This operation demonstrates a sophisticated multi-platform capability, posing a significant cybersecurity threat. This new strain of ransomware is designed to be able to compromise a wide range of systems, including Windows, Linux, BSD, ARM and ESXi, highlighting how adaptable and powerful the malware is.

During the spring of 2025, VanHelsing became highly visible in underground cybercriminal forums, where it was actively promoted to potential affiliates. The most significant aspect of the program was the fact that experienced cybercriminals were given free access, while those with less expertise were required to pay a $5,000 deposit as a condition to participate. In this case, the targeted recruitment strategy seems to be a calculated one to attract both seasoned and aspiring threat actors to expand the scope of the ransomware's operational capabilities. 

A few weeks back, cybersecurity firm CYFIRMA first revealed the existence of VanHelsing, providing insight into its emergence and early stages. The findings of Check Point Research's extensive technical analysis, published yesterday in the journal Security Research, provide a more in-depth understanding of the ransomware's mechanics as well as its operational framework, which was published following this discovery. It has become apparent that VanHelsingRaaS is spreading rapidly, raising serious concerns among cybersecurity professionals. 

Just two weeks after the ransomware launched, three confirmed victims of the ransomware have been successfully compromised. This virus has already gone through further development and has already been redeveloped into a more advanced version. The speed at which it has developed highlights how powerful it could become within the cyber threat landscape, and it warrants security professionals around the world to be vigilant and take proactive measures to combat it. 

While the ransomware is still evolving, multiple infections have already been detected, which indicates that it has been deploying rapidly in real-world attacks. To investigate several variants, which have so far been restricted to the Windows platform, cybersecurity researchers have conducted an in-depth examination. All of these variants have been identified as being based on Windows. A notable aspect of the malware is that it has been improved incrementally with each subsequent iteration, which suggests that the malware is constantly being improved. 

It is clear from the frequent updates and rapid progress of the ransomware that the developers are committed to expanding their capabilities, and this raises concerns regarding its potential impact as the ransomware matures. According to the available evidence, VanHelsing ransomware was first found in the wild on March 16, when the ransomware was first detected in the wild. To secure the files within this malware, a 32-byte (256-bit) symmetric key and a 12-byte nonce are generated for each file by the ChaCha20 encryption algorithm. 

In addition, VanHelsing also encrypts these generated values with the use of an embedded Curve25519 public key to further enhance its encryption processes. These encrypted keys and nonces are then embedded in the affected file to make them more secure. A notable feature of VanHelsing is its extensive command-line interface (CLI) customization that enables attackers to tailor the attack to meet the specific requirements of their target users. 

Files that exceed 1GB in size are subjected to partial encryption, while smaller files are subjected to complete encryption. As part of this method, drives and folders will be selected, encryption parameters will be set, the attack will spread via SMB protocol, shadow copy deletions will be bypassed, and evasion will be performed in a dual-phase stealth mode. VanHelsing utilizes two types of encryption to provide high levels of security. 

It is a standardized encryption technique in which it systematically enumerates directories, encrypts file content, and then renames the affected files using the ".vanhelsing" extension. On the other hand, when in stealth mode, both the encryption and file renaming are performed in separate processes, thus minimizing detection risks since the encryption process mimics normal file input/output (I/O) activity to minimize detection risk.

During the renaming phase of the data, security tools might detect anomalies, but by that time the data is already encrypted in full. However, Check Point has identified several shortcomings in its code development that have been attributed to immature development despite its advanced functionality and rapid evolution. There are many reasons for this, including inconsistency in file extensions, flaws in exclusion list logic that could lead to duplicate encryption cycles, and several command-line flags that have not been implemented yet. 

Despite VanHelsing's many technical imperfections, it remains a formidable emerging cyber threat. Considering that it is a continuously evolving threat, security professionals and organizations must keep their eyes open for potential threats associated with this ransomware variant as it is developing. In recent years, van Helsing ransomware has emerged as an extremely sophisticated cyber threat that can be used against multiple platforms, including Windows, Linux, BSD, ARM, and ESXi, and is rapidly evolving. 

With its advanced encryption techniques, extensive CLI customization, and stealth tactics, this ransomware can be a formidable weapon in the hands of cybercriminals. There is strong evidence that the ransomware is actively spread through underground forums, as well as its recruitment strategy. Security researchers have noted that it is rapidly iterating and improving, making proactive defence measures imperative. 

Although VanHelsing may have been developed with technical flaws, it remains an incredibly dangerous threat due to its ability to spread rapidly and adapt quickly. Organizations must maintain an effective cybersecurity strategy, stay informed about emerging threats, and enhance their defences to avoid potential risks. The evolving nature of this ransomware emphasizes the need.
Read more »
Vulnerabilities
Artificial Intelligence ChatGPT cybercriminals Cybersecurity Ransomware Vulnerabilities

Cybercriminals Exploit Psychological Vulnerabilities in Ransomware Campaigns

 


During the decade of 2025, the cybersecurity landscape has drastically changed, with ransomware from a once isolated incident to a full-sized global crisis. No longer confined to isolated incidents, these attacks are now posing a tremendous threat to economies, governments, and public services across the globe. There is a wide range of organizations across all sectors that find themselves exposed to increasingly sophisticated cyber threats, ranging from multinational corporations to hospitals to schools. It is reported in Cohesity’s Global Cyber Resilience Report that 69% of organizations have paid ransom demands to their suppliers in the past year, which indicates just how much pressure businesses have to deal with when such attacks happen. 

The staggering number of cybercrime cases highlights the need for stronger cybersecurity measures, proactive threat mitigation strategies and a heightened focus on digital resilience. With cybercriminals continuously improving their tactics, organizations need to develop innovative security frameworks, increase their threat intelligence capabilities, and foster a culture of cyber vigilance to be able to combat this growing threat. The cybersecurity landscape in 2025 has changed significantly, as ransomware has evolved into a global crisis of unprecedented proportions. 

The threat of these attacks is not just limited to isolated incidents but has become a significant threat to governments, industries, and essential public services. Across the board, companies of all sizes are increasingly vulnerable to cyber threats, from multinational corporations to hospitals and schools. In the last year, Cohesity released its Global Cyber Resilience Report, which revealed that 69% of organizations paid ransom demands, indicating the immense pressure that businesses face in the wake of such threats. 

This staggering figure underscores how urgent it is that we take more aggressive cybersecurity measures, develop proactive threat mitigation strategies, and increase our emphasis on digital resilience to prevent cyberattacks from taking place. Organizations must embrace new security frameworks, strengthen threat intelligence capabilities, and cultivate a culture of cyber vigilance to combat this growing threat as cybercriminals continue to refine their tactics. A persistent cybersecurity threat for decades, ransomware remains one of the biggest threats today. 

However, the first global ransom payment exceeded $1 billion in 2023, marking a milestone that hasn't been achieved in many years. Cyber extortion increased dramatically at this time, as cyber attackers constantly refined their tactics to maximize the financial gains that they could garner from their victims. The trend of cybercriminals developing increasingly sophisticated methods and exploiting vulnerabilities, as well as forcing organizations into compliance, has been on the rise for several years. However, recent data indicates a significant shift in this direction. It is believed that in 2024, ransomware payments will decrease by a substantial 35%, mainly due to successful law enforcement operations and the improvement of cyber hygiene globally.

As a result of enhanced security measures, increased awareness, and a stronger collective resistance, victims of ransom attacks have become increasingly confident they can refuse ransom demands. However, cybercriminals are quick to adapt, altering their strategies quickly to counteract these evolving defences to stay on top of the game. A response from them has been to increase their negotiation tactics, negotiating more quickly with victims, while simultaneously developing stealthier and more evasive ransomware strains to be more stealthy and evasive. 

Organizations are striving to strengthen their resilience, but the ongoing battle between cybersecurity professionals and cybercriminals continues to shape the future of digital security. There has been a new era in ransomware attacks, characterized by cybercriminals leveraging artificial intelligence in increasingly sophisticated manners to carry out these attacks. Using freely available AI-powered chatbots, malicious code is being generated, convincing phishing emails are being sent, and even deepfake videos are being created to entice individuals to divulge sensitive information or transfer funds by manipulating them into divulging sensitive information. 

By making the barriers to entry much lower for cyber-attacking, even the least experienced threat actors are more likely to be able to launch highly effective cyber-attacks. Nevertheless, artificial intelligence is not being used only by attackers to commit crimes. There have been several cases where victims have attempted to craft the perfect response to a ransom negotiation using artificial intelligence-driven tools like ChatGPT, according to Sygnia's ransomware negotiation teams. 

The limitations of AI become evident in high-stakes interactions with cybercriminals, even though they can be useful in many areas. According to Cristal, Sygnia’s CEO, artificial intelligence lacks the emotional intelligence and nuance needed to successfully navigate these sensitive conversations. It has been observed that sometimes artificial intelligence-generated responses may unintentionally escalate a dispute by violating critical negotiation principles, such as not using negative language or refusing to pay outright.

It is clear from this that human expertise is crucial when it comes to managing cyber extortion scenarios, where psychological insight and strategic communication play a vital role in reducing the potential for damage. Earlier this year, the United Kingdom proposed banning ransomware payments, a move aimed at deterring cybercriminals by making critical industries less appealing targets for cybercriminals. This proposed legislation would affect all public sector agencies, schools, local councils, and data centres, as well as critical national infrastructure. 

By reducing the financial incentive for attackers, officials hope to decrease both the frequency and severity of ransomware incidents across the country to curb the number of ransomware incidents. However, the problem extends beyond the UK. In addition to the sanctions issued by the Office of Foreign Assets Control, several ransomware groups that have links to Russia and North Korea have already been sanctioned. This has made it illegal for American businesses and individuals to pay ransoms to these organizations. 

Even though ransomware is restricted in this manner, experts warn that outright bans are not a simple or universal solution to the problem. As cybersecurity specialists Segal and Cristal point out, such bans remain uncertain in their effectiveness, since it has been shown that attacks fluctuate in response to policy changes, according to the experts. Even though some cybercriminals may be deterred by such policies, other cybercriminals may escalate their tactics, reverting to more aggressive threats or increasing their personal extortion tactics. 

The Sygnia negotiation team continues to support the notion that ransom payments should be banned within government sectors because some ransomware groups are driven by geopolitical agendas, and these goals will be unaffected by payment restrictions. Even so, the Sygnia negotiation team believes that government institutions should not be able to make ransom payments because they are better able to handle financial losses than private companies. 

Governments can afford a strong stance against paying ransoms, as Segal pointed out, however for businesses, especially small and micro-sized businesses, the consequences can be devastating if they fail to do so. It was noted in its policy proposal that the Home Office acknowledges this disparity, noting that smaller companies, often lacking ransomware insurance or access to recovery services, can have difficulty recovering from operational disruptions and reputational damage when they suffer from ransomware attacks. 

Some companies could find it more difficult to resolve ransomware demands if they experience a prolonged cyberattack. This might lead to them opting for alternative, less transparent methods of doing so. This can include covert payment of ransoms through third parties or cryptocurrencies, allowing hackers to receive money anonymously and avoid legal consequences. The risks associated with such actions, however, are considerable. If they are discovered, businesses can be subjected to government fines on top of the ransom, which can further worsen their financial situation. 

Additionally, full compliance with the ban requires reporting incidents to authorities, which can pose a significant administrative burden to small businesses, especially those that are less accustomed to dealing with technology. Businesses are facing many challenges in the wake of a ransomware ban, which is why experts believe a comprehensive approach is needed to support them in the aftermath of this ban.

Sygnia's Senior Vice President of Global Cyber Services, Amir Becker, stressed the importance of implementing strategic measures to mitigate the unintended consequences of any ransom payment ban. It has been suggested that exemptions for critical infrastructure and the healthcare industries should be granted, since refusing to pay a ransom may lead to dire consequences, such as loss of life. Further, the government should offer incentives for organizations to strengthen their cybersecurity frameworks and response strategies by creating incentives like these.

A comprehensive financial and technical assistance program would be required to assist affected businesses in recovering without resorting to ransom payments. To address the growing ransomware threat effectively without disproportionately damaging small businesses and the broader economy, governments must adopt a balanced approach that entails enforcing stricter regulations while at the same time providing businesses with the resources they need to withstand cyberattacks.
Read more »
Ransomware
Cyber Security Cybersecurity Hacking Medusa Ransomware

Authorities Warn Against Medusa Ransomware Surge

 

 
Federal agencies are urging individuals and organizations to stay vigilant against a rising ransomware threat that has affected hundreds of new victims in recent weeks. The FBI, Cybersecurity and Infrastructure Security Agency (CISA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) have jointly issued an advisory detailing the tactics used by Medusa ransomware and how to mitigate its impact.

First identified in June 2021, Medusa is a ransomware-as-a-service (RaaS) variant that primarily targets critical infrastructure sectors, including healthcare, education, legal, insurance, technology, and manufacturing. Through the RaaS model, the ransomware's developers delegate attack execution to affiliates, who have collectively compromised over 300 victims in the past month alone.

Initially, Medusa operated as a closed ransomware variant, where the same group that developed the malware also carried out attacks. However, it has since evolved into an affiliate-driven model, with developers recruiting attackers from dark web forums and paying them between $100 to $1 million per job.

Cybercriminals behind Medusa employ two primary attack vectors:
  • Phishing campaigns – Fraudulent emails trick users into downloading malicious attachments or clicking harmful links.
  • Exploiting unpatched vulnerabilities – Attackers take advantage of outdated software to infiltrate company networks.

Once inside, they utilize various legitimate tools to expand their access:

  • Advanced IP Scanner and SoftPerfect Network Scanner – Used to detect exploitable network vulnerabilities.
  • PowerShell and Windows command prompt – Help compile lists of targeted network resources.
  • Remote access tools like AnyDesk, Atera, and Splashtop – Assist in lateral movement across the system.
  • PsExec – Enables execution of files and commands with system-level privileges.
To avoid detection, attackers often disable security tools using compromised or signed drivers. They also delete PowerShell history and leverage Certutil to conceal their activity.

Similar to other ransomware strains, Medusa follows a double-extortion strategy. Not only do attackers encrypt stolen data, but they also threaten to leak it publicly if the ransom is not paid. Victims typically have 48 hours to respond, after which they may be contacted via phone or email.

A Medusa data leak site displays ransom demands along with a countdown timer. If victims need more time, they can delay the data release by paying $10,000 in cryptocurrency per extra day. Meanwhile, attackers may attempt to sell the stolen data to third parties even before the timer expires.

Federal authorities recommend the following preventative measures to reduce the risk of Medusa attacks:
  • Patch vulnerabilities – Keep all operating systems, software, and firmware updated.
  • Network segmentation – Prevent attackers from moving across connected systems.
  • Traffic filtering – Restrict access to internal services from untrusted sources.
  • Disable unused ports – Close unnecessary entry points to minimize security risks.
  • Backup critical data – Store multiple copies of important files in an isolated location.
  • Enable multifactor authentication (MFA) – Secure all accounts, especially those used for webmail, VPNs, and critical systems.
  • Monitor network activity – Use security tools to detect unusual patterns and alert administrators to potential threats.
By implementing these strategies, organizations can significantly lower their chances of falling victim to Medusa ransomware and other evolving cyber threats.
Read more »
Ransomware
Black Basta Cyber Security Password Ransomware

Black Basta Hackers Use New Tool to Break Weak Passwords on Remote Systems

 



A cybercriminal group called Black Basta has built a new tool that helps them break into remote systems like VPNs and firewalls by guessing weak passwords. This tool allows them to easily target companies and demand ransom.

According to cybersecurity experts, the tool— named BRUTED, automatically scans the internet to find systems that might be easy to hack. It focuses on popular VPN and firewall services from companies like Cisco, Fortinet, Palo Alto, and others. It also attacks systems used for remote desktop access.

The tool gathers information like IP addresses, website subdomains, and security certificates to help guess passwords specific to each organization. It then sends fake login requests that look like they’re from a real user or device, making it harder to detect.

Since BRUTED runs automatically, it helps hackers attack many targets quickly. This increases their chances of breaking in and earning money from ransomware attacks.

Experts warn that many companies still rely on simple or repeated passwords, which makes their systems easy to hack. Sometimes, attackers use leaked or default passwords that organizations forget to change.

This poor password management exposes businesses to big risks. In fact, weak passwords might have also caused a leak in Black Basta’s own data when a hacker broke into a Russian bank and exposed the gang’s private chats.

Black Basta is known for targeting important industries like healthcare and manufacturing, where even a small disruption can cause major losses. These industries are more likely to pay ransom to avoid shutdowns.

Security experts are urging businesses to act fast—use strong and unique passwords, change default settings, run regular security checks, and train employees about password safety.

Good password habits can help prevent such attacks and protect important systems from hackers like Black Basta.


Read more »
VPN breach
Black Basta Cyber Attacks Cyber Network CyberCrime Cyberhackers CyberThreat Password Ransomware VPN breach

Ransomware Hackers Develop Advanced Tool for VPN Breaches

 


In the Black Basta ransomware group, an automated brute force attack tool referred to as BRUTED has been developed to target and compromise edge networking devices such as firewalls and VPNs, as well as other edge networking devices. By using this sophisticated tool, they can efficiently breach vulnerable internet-facing endpoints, making them able to scale ransomware attacks considerably better than ever before. 

A researcher at EclecticIQ identified the presence of BRUTED when she analyzed internal chat logs related to the ransomware gang, and she found that BRUTED exists. These logs were used to reveal insight into the tool's deployment and revealed that Black Basta has been employing BRUTED to conduct credential-stuffing and brute-force attacks since 2023 against a variety of remote access software programs. This cyber threat has been targeting a wide variety of systems, including SonicWall NetExtender, Palo Alto GlobalProtect, and Citrix NetScaler, highlighting the broad scope of the threat. 

It is Black Basta's intention to improve its operational efficiency by automating brute-force attacks, which in turn allows it to exploit critical infrastructure security vulnerabilities more systematically. As a result of the discovery of BRUTED, organizations relying on internet-connected security solutions are at an even higher risk of cybercrime, as the evolving tactics and sophistication of ransomware groups are becoming more complex. 

The Black Basta ransomware operation has developed an automated brute-force framework known as BRUTED, which has been designed specifically to compromise edge networking devices, such as firewalls and virtual private network access points. As a result of this advanced framework, the group can gain early access to targeted networks, which facilitates large-scale ransomware attacks on vulnerable, internet-connected endpoints, which will lead to a successful attack. 

A recently published study by Arda Büyükkaya, a cyber threat intelligence analyst at EclecticIQ, confirms that the Black Basta ransomware group is using a previously unidentified brute-force framework for stealing data. Known as BRUTED, this framework is specifically crafted to automate the process of compromising enterprise VPNs and firewalls, thus enhancing the group's ability to gain unauthorized access to corporate networks, which is significantly enhanced. 

Multiple reports have emerged throughout 2024 detailing the extensive use of brute-force attacks against these devices and password spray. It is still unclear how these incidents are linked to BRUTED or other threat actor operations, although the issue is still under investigation. This tool has been developed to highlight the increasing sophistication of ransomware tactics and the increasing risk organizations face when relying on internet-connected security infrastructure as part of their security measures. 

A thorough analysis of Büyükkaya's source code has proven that the tool's primary function consists of snooping across the internet and credential stuffing attacks, to attack edge network devices. It has been widely used within corporate environments to implement firewalls and VPN solutions. By its log-naming conventions, BRUTED is referred to as the bruised tool, and researchers at EclecticIQ have concluded that it is used by Black Basta to perform large-scale credential-stuffing attacks. This group gains an initial foothold by exploiting weak or reused credentials, which allows them to move from compromised networks to other compromised ones, and ultimately install ransomware. 

It is also BRUTED's responsibility to assist affiliates, who are responsible for performing initial access operations in ransomware campaigns, as well as to enhance the group's operational efficiency. As the framework automates and scales attacks, it can widen the victim pool and accelerate the monetization process, thus increasing the efficiency of ransomware operations. As a result of this discovery, cybercriminals have become increasingly sophisticated in their tactics, which highlights the need for robust security measures to protect against them. 

Arda Büyükkaya explained that the BRUTED framework will enable Black Basta affiliates to automate and scale their attacks to significantly increase the number of victims they can target, as well as boost their monetization efforts to continue operating ransomware. As a result of the emergence of this brute-forcing tool, edge devices are demonstrating their ongoing vulnerability, especially in light of persistent warnings from private cybersecurity firms and government agencies regarding increased threats targeting VPN services. Even though these advisories have been issued, it remains a lucrative attack vector for cybercriminals to hack passwords for firewalls and virtual private networks (VPNs). 

According to the Qualys team, a blog post a while back highlighted the fact that Black Basta has been using default VPN credentials, brute force techniques involving stolen credentials, and other forms of access to gain initial access to their systems. In this report, the manager of vulnerability research at Qualys Threat Research Unit and a co-author of the report asserted that weak passwords for VPNs and other services that are open to the public continue to pose a significant security risk to organizations. 

Furthermore, Abbasi emphasized that several leaked Black Basta chat logs contained simple or predictable credentials, demonstrating the persistent vulnerabilities that threat actors exploit to infiltrate corporate networks. By implementing the BRUTED framework, threat actors can streamline their ransomware operations, as it enables them to infiltrate multiple networks at the same time with as little effort as possible.

As a result of this automation, cybercriminals have access to greater monetization opportunities, which allows them to scale their attacks more efficiently. The risks posed by such tools must be mitigated by the adoption of strong cybersecurity practices. To protect against these risks, organizations must enforce unique passwords for all edge devices and VPNs. Further, multi-factor authentication (MFA) is an essential component of any security system because it adds another layer of protection that prevents unauthorized access, even when credentials are compromised. To identify potential threats, continuous network monitoring is also crucial. 

Security teams should keep an eye on authentication attempts coming from unfamiliar locations and flag high volumes of failures to log in as an indicator of brute force attacks. Several measures can be implemented to reduce the effectiveness of credential-stuffing techniques, such as rate-limiting measures and account-locking policies. As a result of the growing threat of BRUTED, EclecticIQ has provided a list of IP addresses and domains associated with the framework to the public in response. 

Indicators such as these can be used to update firewall rules so that requests from known malicious infrastructure will be blocked effectively while limiting the tool's reach. BRUTED does not exploit software vulnerabilities to gain access to network edge devices, but maintaining up-to-date security patches remains an important part of cybersecurity. Regularly applying the latest patches ensures that potential vulnerabilities in the network security systems are addressed, thus strengthening the overall resilience of the network security systems.
Read more »
Software
Cyber Security LockBit Ransomware Software

New Ransomware 'SuperBlack' Abuses Fortinet Firewall Flaws to Launch Attacks

 


A newly discovered ransomware group known as Mora_001 is carrying out cyberattacks by exploiting security weaknesses found in Fortinet's firewall systems. The group is using a custom ransomware strain named SuperBlack to target organizations and lock their data for ransom.

The attackers are taking advantage of two security loopholes that allow them to bypass login protections on Fortinet devices. These issues, listed as CVE-2024-55591 and CVE-2025-24472, were made public by Fortinet earlier this year. Reports indicate that one of these vulnerabilities had been secretly exploited by attackers even before the company officially disclosed it.

Initially, Fortinet clarified that only one of the two bugs had been misused. However, a recent investigation suggests that the second vulnerability was also being exploited during the same period. Researchers from cybersecurity firm Forescout uncovered this while examining attacks that occurred in January and February 2025.


Step-by-Step Breakdown of the Attack

The cybercriminals begin their attack by finding exposed Fortinet firewall devices that haven’t been updated. They then use these security flaws to gain full control over the system.

Once inside, the attackers grant themselves the highest level of access, commonly known as 'super admin' rights. They either use web-based tools or direct network requests to make these changes.

After securing control, they create new administrator profiles with names like forticloud-tech, fortigate-firewall, or adnimistrator. These fake accounts are set up in a way that even if someone deletes them, automated tasks will recreate them instantly.

The hackers then scan the network to understand its layout and start moving from one system to another. They use stolen login details, create new VPN accounts, and rely on common tools like WMIC and SSH to spread across connected machines. They also try to break into systems that use security checks like TACACS+ or RADIUS.

Before locking files, the group copies important data using their own tools. Their main targets include file storage systems, database servers, and computers that control user access across networks. Once the data is stolen, the ransomware is triggered, encrypting files and leaving ransom messages behind.

To make it harder for experts to investigate the attack later, the hackers run a program called ‘WipeBlack’. This tool removes all traces of the ransomware from the system, leaving very little evidence.


Possible Links to a Bigger Ransomware Group

During their investigation, Forescout found that SuperBlack ransomware shares several similarities with the well-known LockBit ransomware group. The coding style and methods used appear to have been copied from LockBit’s earlier leaked tools.

However, it looks like SuperBlack is being operated separately and is not officially part of the LockBit group.

This incident is a reminder of the risks that come with outdated software. Organizations using Fortinet firewalls should install security updates immediately to avoid falling victim to such attacks. Staying updated is crucial in protecting sensitive information from advanced ransomware threats.



Read more »
Subscribe to: Posts (Atom)