Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Ransomware. Show all posts
third-party risk
business disruption Cyber Attacks Cyber Insurance Cybersecurity Data Breach Ransomware third-party risk

Cyberattacks on Key Vendors Trigger Widespread Disruptions Across Industries

Cybercriminals are increasingly targeting a single point of failure within companies to create large-scale disruption, according to a recent report by Resilience. The analysis highlights how such attacks can have a ripple effect across entire industries.

In 2024, the global average cost of a data breach was estimated at nearly $4.9 million, based on IBM research. However, certain incidents proved to be significantly more damaging.

One of the most costly breaches occurred when UnitedHealth reported a staggering $3.1 billion expenditure in response to a cyberattack on its Change Healthcare subsidiary. This division processes billions of medical claims annually, and the ransomware attack led to prolonged disruptions in the healthcare sector.

“It was the most significant and consequential cyberattack in the history of U.S. health care,” said John Riggi, national advisor for cybersecurity and risk at the American Hospital Association, in a blog post.

Another major incident targeted CDK Global, a software provider for car dealerships across the U.S. The ransomware attack caused financial damages exceeding $1 billion collectively, as estimated by Anderson Economic Group.

The cyberattacks on Change Healthcare and CDK Global exemplify how disruptions in interconnected organizations can have widespread industry consequences, Resilience noted in its report.

According to Resilience’s analysis, third-party risks have become a leading factor in cyber insurance claims, representing 31% of claims filed by its clients in 2024. While a slightly higher percentage (37%) of third-party claims was recorded in 2023, none resulted in material financial losses.

The study also revealed that ransomware attacks targeting vendors have become a “new and significant” contributor to insurance claims, accounting for 18% of such cases.

Although ransomware remained the primary cause of cyber losses in 2024—responsible for 62% of claims—its overall occurrence may be declining. Resilience attributes this trend to cybercriminals shifting focus toward larger, high-profile organizations that offer bigger financial payouts, moving away from the traditional “spray and prey” strategy.
Read more »
Windows
Akira CyberCrime Cybersecurity Cyberthreats EDR EDR Protections Ransomware S-RM Technology Webcam Windows

Webcam Exploited by Ransomware Group to Circumvent EDR Protections

 


Researchers at S-RM have discovered an unusual attack method used by the Akira ransomware gang. The Akira ransomware gang utilized an unsecured webcam to conduct encryption attacks against victims' networks via the use of an unsecured webcam. The attackers were able to bypass the Endpoint Detection and Response (EDR) mechanisms, which had been successful in stopping the ransomware encryptor from functioning on Windows computers.

During an investigation conducted by the S-RM team as part of an incident response, the S-RM team uncovered Akira's sophisticated adaptations in response to security defences. As a first step, the threat actors tried to implement encryption tools on Windows endpoints, but these attempts were thwarted by the EDR solution provided by the victim. 

It is important to note that the attackers reacted to this by exploiting the unsecured webcam as an entry point for the malware to infiltrate the network and launch their ransomware attacks. This incident illustrates how ransomware operators are increasingly using unconventional vulnerabilities to circumvent modern cybersecurity defenses, highlighting the evolution of ransomware operations. 

Network vulnerabilities exploited by Akira ransomware operators. 


Researchers in the cybersecurity field recently discovered a sophisticated attack strategy that was employed by the Akira ransomware group. Initially, the threat actors gained access to the network via an externally exposed remote access solution through which unauthorized access was gained. The attackers then installed AnyDesk.exe, a legitimate remote desktop tool, to maintain persistent access within the compromised network, and proceeded to exfiltrate sensitive data using this tool. 

In the months following the initial breach, the attackers used Remote Desktop Protocol (RDP) to move laterally through the network, simulating legitimate system administrator activities to conceal their activity and blend into normal networking operations. They evaded detection by mimicking legitimate system administrator activities. 

Akira Ransomware Group: A Rising Threat in the Cybercrime Landscape 


Emergence and Rapid Expansion 


Originally identified in early 2023, the Akira ransomware group has rapidly gained popularity as one of the most active ransomware operations in the world. As of 2024, the Akira group is responsible for around 15% of all ransomware incidents that were examined by cybersecurity firm S-RM. The company specializes in targeting small to medium sized businesses (SMEs) in North America, Europe, and Australia, especially businesses that have fewer than 1,000 employees as their primary target market. 

Operational Model and Organizational Structure 


Rather than using the typical paid-for model, Akira also uses a ransomware-as-a-service model: within this model, the group's core developers provide a running platform that allows its affiliates to access its binary and leak sites in exchange for a share of the ransom payments received by the group's owners. 

Triple Extortion Strategy and Technical Adaptability 


By employing a triple approach of extortion, or a series of layers of coercion to maximize leverage over their victims, Akira achieves extreme leverage over them: 

Data Encryption – Locking files and systems to disrupt business operations. 

Data Exfiltration – Stealing sensitive information before encryption. 

Public Disclosure Threats – Threatening to release exfiltrated data unless the ransom is paid. 

Akira's technical adaptability is exemplified by its ability to adjust its attack methods based on security threats. A recent webcam attack highlighted the group's innovative tactics. In this case, the group circumvented Endpoint Detection and Response (EDR) protections by using unsecured Internet of Things devices as an alternative entry point to bypass the system's protections. 

As ransomware operations such as Akira become more sophisticated, organizations, particularly small and medium-sized enterprises, must take proactive cybersecurity measures to mitigate the threats posed by these highly adaptive threat actors. To mitigate these risks, organizations must implement robust endpoint security, network segmentation, and IoT security protocols. 

Initially, the threat actors managed to breach the corporate network through an exposed remote access solution, likely using stolen credentials or brute-force techniques to gain access to the network. Once inside, they deployed AnyDesk, an authentic remote access tool, to gain persistent access and gain access to sensitive data. The data was then used as leverage in a double extortion scheme that later resulted in a double extortion attack. 

When the attack was first initiated, the attackers took advantage of the Remote Desktop Protocol (RDP) to enable them to move laterally, systematically spreading their presence across multiple systems before launching the ransomware attack. Their attack was carried out by introducing a password-protected archive file, win.zip, with the ransomware payload, win.exe, as a payload. Although the threat was initially detected and quarantined by the victim's Endpoint Detection and Response (EDR) system, it was ultimately neutralized when the virus was identified and quarantined. 

The attackers modified their strategy after experiencing this setback by finding alternative ways to attack the device. During a thorough network scan, several potential entry points were discovered, including a webcam and a fingerprint scanner. S-RM, a cybersecurity firm, explains that threat actors eventually chose the webcam as their primary pivot point for gaining access to its data, as it is easy for remote shell access and unauthorized video feeds. Moreover, the attackers took advantage of the device's lightweight Linux-based operating system, which was compatible with Akira's Linux encryptor. 

Since the webcam was without a protection agent against EDR attacks, it was an ideal choice for the ransomware attack to take place. The threat actors were able to successfully encrypt files on network shares by leveraging their connectivity to the Internet, circumventing conventional security measures and demonstrating the evolving sophistication of ransomware tactics. Instead of abandoning their original objective, the ransomware operators chose to utilize a previous internal network scan data as the basis for their next strategy. 

An investigation of the Internet of Things (IoT) revealed that several vulnerable devices were not adequately protected, including webcams and fingerprint scanners. As the attackers recognized the potential of unprotected devices as alternative entry points to traditional security systems, they sought to bypass those mechanisms. They discovered several vulnerabilities during their assessment, including an unsecured webcam, which proved to be the most feasible vulnerability. 

Several reasons contributed to this, most notably that it lacked Endpoint Detection and Response (EDR) protection, which made it an ideal target for exploiting. Additionally, the device was capable of being accessed remotely through a remote shell, making it even easier for attackers to gain access.

In addition, the Linux-based operating system presented a lightweight security footprint, which reduced the chances of detection and strengthened the appeal of the operating system as a potential entry point for cybercriminals. Execution of the Attack Through IoT Exploitation This attacker was able to create malicious SMB traffic directed towards a target Windows server by compromising a vulnerable webcam, which was able to be used by the attacker to create malicious SMB traffic. 

Due to the organization's lack of active monitoring of IoT devices, this technique enabled the ransomware payload to bypass traditional detection mechanisms. As a result of the attack, a large number of files were encrypted across the network of the victim. Even though SMB-based attacks have generally been considered to be less efficient than other intrusion techniques, this attack proved extremely effective in this case, mainly because they are frequently incompatible with conventional security monitoring tools, such as this tool. 

It is as a consequence of this incident that organizations must take proactive steps to ensure that all network-connected devices, most notably IoT endpoints, are secured via encryption so that sophisticated ransomware operators are not able to exploit them as attack vectors. 

The fact that the compromised webcam lacked an Endpoint Detection and Response (EDR) protection was a critical factor in the success of this attack, as largely due to its limited storage capacity, it could not cope with advanced security measures needed to defend itself. 

The Akira ransomware group exploited this vulnerability to deploy its Linux-based ransomware quickly from the compromised machine, encrypting files across the victim's network by using the Server Message Block protocol (SMB). As a result of this strategic approach, the attackers were able to operate covertly since malicious SMB traffic originating from the webcam was not detected by security systems, allowing them to evade detection by the organization's cybersecurity team. 

In light of these events, it is due to the growing necessity for comprehensive security protocols, in particular for securing Internet of Things (IoT) devices, that are more and more exploited as attack vectors by cyber criminals. A proactive cybersecurity approach is imperative to mitigate similar threats by ensuring that IoT devices are patched and managed, conducting regular vulnerability assessments within the organization's internal networks, and implementing robust network segmentation so that connected devices are limited in their ability to communicate. 

Further, turning off IoT devices when not in use can serve as a preventive measure against potential exploitation. To effectively defend against emerging threats, it is imperative to continuously monitor your network and implement robust security frameworks. As demonstrated by the Akira ransomware group, you must monitor your network constantly and implement robust security measures. With ransomware-as-a-service (RaaS) operations continuing to evolve at a rapid pace, organizations must remain vigilant, improving their cybersecurity strategies proactively to remain protected from increasingly sophisticated cyberattacks.
Read more »
Ransomware
ALPHV Blackcat Ransomware Black Basta Cyber Security CyberCrime CyberThreat Global Security Ransomware

Persistent Increase in Ransomware Attacks Raises Global Security Concerns

 


It was concluded that in the first five weeks of 2025, there was a significant increase in ransomware attacks targeted at the United States, marking a nearly 150% increase compared to the first five weeks of 2024. Based on a series of high-profile incidents in which certain organisations decided to pay ransoms to avoid detection, cybercriminals have inadvertently increased their interest in the U.S. and made the country a more attractive target for cybercriminals. 

Consequently, this factor is largely responsible for the increase in ransomware activity in the last few months, as successful ransom payments have likely incentivized other ransomware attacks. In the past year, despite fluctuations in the most active ransomware groups and specific timeframes, the frequency of ransomware incidents in the United States has substantially increased. There has been a significant rise in ransomware incidents since the fall of 2024, and a steady increase has continued into the new year. Security firm NCC Group reports 590 new ransomware victims in January, a 3% increase from the previous month, which already set a record for that period. 

The threat intelligence company Cyble has also identified 518 new victims in January, and this number has increased to 599 within the past 27 days. Approximately two-thirds of the attacks were conducted against organizations located in the United States. Additionally, other cybersecurity monitoring organizations have noted a rise in ransomware incidents over the past two months. The difference in victim counts between cybersecurity firms may be attributed to the difference in methodologies, in particular whether victims of previously compromised cybersecurity systems who have just been revealed should be classified as new victims. 

However, despite these discrepancies, industry experts all agree that ransomware activity has increased in recent months. There are several notable ransomware groups responsible for driving this increase, among which RansomHub, Play, and Akira stand out as prominent threat actors. As a result of their increased activity, organizations across the globe are facing increasing cybersecurity challenges as a result of their increased activities. There is still a persistent threat of ransomware, however, individual ransomware groups emerge and dissipate frequently. 

Some of these groups, such as Black Basta, are now in decline or are nearing obsolescence, while others are suffering disruption due to law enforcement intervention, as LockBit appears to be the case. Groups that suffer from internal conflict, often driven by financial disputes, are prone to collapse. For instance, Alphv, also known as BlackCat, was notorious for conducting an exit scam 12 months ago, retaining the entire $22 million ransom paid by UnitedHealth Group following the Change Healthcare hack, rather than sharing it with the affiliate that carried out the scam. 

Although some ransomware groups have disbanded at the end of last year, the landscape of ransomware continues to be highly dynamic, with new actors continuously emerging. In many instances, these "new" actors are not merely rebranded entities, but individuals already entrenched in the cybercrime ecosystem himself. A significant percentage of these attacks are the result of affiliates, threat actors who work with several ransomware operations. Regardless of which specific group name they operate under, affiliations are responsible for a significant portion of these attacks, according to cybersecurity firm BlackFog. In 2024, 48 new ransomware groups surfaced. 

There are four victims mentioned publicly on RunSomeWare's data leak sites, whereas Linkc only has one victim posted on its data leak site, as reported by threat intelligence firm Cyble. It is unclear how long these emerging groups will survive in this business. In December 2024, Anubis, a Russian-speaking ransomware group that first became active, appears to be the work of former ransomware affiliates, as indicated by the sophistication of its tactics. 

Kela reports that Anubis maintains a presence on cybercrime forums like RAMP and XSS, which reinforces its network within the cybercriminal underground by ensuring it maintains its visibility on these forums. In addition to offering a range of illicit services, this group also operates a traditional ransomware-as-a-service model, where affiliates are rewarded with 80% of the ransom money collected from victims they infect. 

As well as targeting Windows, Linux, network-attached storage (NAS), and ESXi environments, Anubis' ransomware can also be used to spread the virus. In addition, the group maintains a data leak blog based on Tor, where so far only a few people have been listed. The Anubis ransomware operation offers two distinct services in addition to conventional ransomware. In the first case, participants receive 60% of the revenue extorted from victims using stolen data, based on the data-ransom-as-a-service model. If the stolen data are unpublished, have been obtained within the past six months, and considered valuable enough for public exposure, they are eligible for this program. By releasing a press release and notifying local data privacy regulators about the breach, Anubis claims to amplify pressure on victims. 

It is the second offering of Anubis that targets initial access brokers, who facilitate cyber intrusions by selling credentials to compromised networks to gain access to them. Under Anubis' model, the IABs become eligible for 50% of all ransoms demanded by victims whose credentials they have supplied. A specific set of eligibility criteria applies, including being a citizen of the United States, Canada, Europe, or Australia, not having been targeted by another ransomware group within the last 12 months, and not being employed by the government, the educational system, or any non-profit organization. 

Ransomware groups are long collaborating with initial access brokers and have often paid a premium for exclusive access to compromised networks, but the healthcare industry remains a viable target. Cybercrime brokers are increasingly becoming increasingly reliant on each other, and this indicates that their role is growing within the cybercrime economy. According to a recent report by CrowdStrike, access broker activity is expected to grow by almost 50% in 2024, as cybercriminals continue to look for ways of infiltrating high-value targets in an increasingly swift and stealthy manner. 

Despite the persistence of ransomware, it is important to remember that individual ransomware groups emerge and dissipate regularly. Several groups, such as Black Basta, appear to have declined over the years or are on the verge of obsolescence, whereas others, such as LockBit, seem to be facing disruptions because of law enforcement interventions. As it seems with LockBit, these groups collapse in the face of internal conflicts, often caused by financial disagreements. Alphv, also known as BlackCat, is one example that exemplifies an exit scam that was carried out 12 months ago. 

According to reports, Alphv kept the entire $22 million ransom paid by UnitedHealth Group to resolve the Change Healthcare breach, instead of sharing it with the affiliate that perpetrated the attack. It is important to note that while some groups have disbanded, the ransomware landscape still remains a highly dynamic place, with new actors constantly emerging on the scene. The so-called "new" groups are usually nothing more than rebranded entities that already have a place in the cybercrime ecosystem. 

These so-called "new" groups include individuals already well versed in the criminality ecosystem. Affiliates - threats actors who collaborate with multiple ransomware operations - are responsible for a significant portion of these attacks, regardless of who they use as their operating name. In 2024, 48 new ransomware groups were discovered, according to cybersecurity firm BlackFog. RunSomeWares claims to have identified four victims on their data leak site which has been compiled by Linkc, while only one victim has been identified by RunSomeWares, according to threat intelligence firm Cyble. However, the long term viability of these emerging groups is uncertain. 

As indicated by the sophistication of the attacks of Anubis, a Russian-speaking ransomware group that became active by December 2024, its tactics were likely developed by former ransomware affiliates. Anubis maintained a visible presence, according to threat intelligence firm Kela, on cybercrime forums such as RAMP and XSS, thereby enhancing its connections within the black market for cybercrime. The group offers a range of illicit services to its customers. There are two main models of ransomware-as-a-service (RaaS) that the organization uses, in which affiliates receive 80% of any ransom payments that are collected from victims that are infected by the group. 

The ransomware of Anubis is capable of attacking Windows, Linux, network-attached storage (NAS), and ESXi environments, as well. Furthermore, the group maintains a Tor-based blog that leaks data, but so far, it has only listed a few victims that have been affected. It advertises two distinctive services in addition to conventional ransomware. The first is a model called data-ransom-as-a-service (DraaS), in which participants receive 60% of all the revenue extorted from victims by using stolen data. 

To qualify, the stolen data must not have been published, must have been obtained within the last six months, and should be considered valuable enough to be published. In its second offering, Anubis claims that publicizing the data breach and notifying local data privacy regulators will increase pressure on victims. The offering targets initial access brokers (IABs) who facilitate cyber intrusions by selling access credentials to compromised networks. Under Anubis' model, it will award half of the ransom obtained from victims who provide their access credentials to the IAB, which will be used to secure a ransom. 

It is important to note, however, that there are some eligibility requirements for this program. The victim must reside in the United States, Canada, Europe, or Australia, and not have been targeted by another ransomware group in the past 12 months. The victim must also not be a government or educational employee. It is, however, still very possible to target the healthcare industry. 

A long history of ransomware groups collaborating with initial access brokers has shown that these brokers often pay a premium for exclusive access to compromised networks. Their increasing dependence on these brokers indicates that their role within the cybercrime economy is growing. According to a recent report published by CrowdStrike, access broker activity increased by nearly 50% in 2024 compared to the previous year, as cybercriminals continued to search for faster and stealthier methods of infiltrating high-value targets as they continued to grow.
Read more »
Ransomware
Cyber Attacks Hackers Microsoft Paragon Software Ransomware

Hackers Exploit Flaw in Microsoft-Signed Driver to Launch Ransomware Attacks

 



Cybercriminals are exploiting a vulnerability in a Microsoft-signed driver developed by Paragon Software, known as BioNTdrv.sys, to carry out ransomware attacks. This driver, part of Paragon Partition Manager, is typically used to manage hard drive space, but hackers have found a way to misuse it for malicious purposes.  


How the Attack Works  

The vulnerability, identified as CVE-2025-0289, allows attackers to use a technique called "bring your own vulnerable driver" (BYOVD). This means they introduce the legitimate but flawed driver into a system and exploit it to gain high-level access. Once they obtain SYSTEM-level privileges, they can execute ransomware, steal data, or disable security software without being detected.  

The alarming part is that the vulnerability can be exploited even on devices that do not have Paragon Partition Manager installed, as long as the driver exists on the system.  


Other Vulnerabilities  

Researchers also found four additional flaws in the driver:  

1. CVE-2025-0288: Allows access to kernel memory, helping attackers gain control.  

2. CVE-2025-0287: Can crash the system using a null pointer error.  

3. CVE-2025-0286: Enables attackers to execute malicious code in kernel memory.  

4. CVE-2025-0285: Allows manipulation of kernel memory, escalating control. 


Response from Microsoft and Paragon  

Microsoft confirmed that hackers are already using this flaw to spread ransomware and has responded by blocking the vulnerable driver through its Vulnerable Driver Blocklist. Meanwhile, Paragon Software has released a security patch and advised users to update their drivers immediately to avoid potential risks.  


How to Stay Safe  

To protect your system from these attacks:  

1. Update your drivers from Paragon Software to the latest version.  

2. Install Windows security updates regularly.  

3. Use reliable antivirus software to detect suspicious activities.  

4. Monitor your system for unexpected crashes or slow performance.    

While Microsoft and Paragon Software have taken steps to contain the damage, users must stay proactive in securing their systems through regular updates and vigilant monitoring.

Read more »
Threat Detection
Compliance Cyber Security Cybersecurity Data Breach Network Security OT security Ransomware Threat Detection

Cybersecurity Threats Are Evolving: Seven Key OT Security Challenges

 

Cyberattacks are advancing rapidly, threatening businesses with QR code scams, deepfake fraud, malware, and evolving ransomware. However, strengthening cybersecurity measures can mitigate risks. Addressing these seven key OT security challenges is essential.

Insurance broker Howden reports that U.K. businesses lost $55 billion to cyberattacks in five years. Basic security measures could save $4.4 million over a decade, delivering a 25% ROI.

Experts at IDS-INDATA warn that outdated OT systems are prime hacker entry points, with 60% of breaches stemming from unpatched systems. Research across industries identifies seven major OT security challenges.

Seven Critical OT Security Challenges

1. Ransomware & AI-Driven Attacks
Ransomware-as-a-Service and AI-powered malware are escalating threats. “The speed at which attack methods evolve makes waiting to update your defences risky,” says Ryan Cooke, CISO at IDS-INDATA. Regular updates and advanced threat detection systems are vital.

2. Outdated Systems & Patch Gaps
Many industrial networks rely on legacy systems. “We know OT is a different environment from IT,” Cooke explains. Where patches aren’t feasible, alternative mitigation is necessary. Regular audits help address vulnerabilities.

3. Lack of OT Device Visibility
Limited visibility makes networks vulnerable. “Without visibility over your connected OT devices, it’s impossible to secure them,” says Cooke. Asset discovery tools help monitor unauthorized access.

4. Growing IoT Complexity
IoT expansion increases security risks. “As more IoT and smart devices are integrated into industrial networks, the complexity of securing them grows exponentially,” Cooke warns. Prioritizing high-risk devices is essential.

5. Financial & Operational Risks
Breaches can cause financial losses, production shutdowns, and life-threatening risks. “A breach in OT environments can cause financial loss, shut down entire production lines, or, in extreme cases, endanger lives,” Cooke states. A strong incident response plan is crucial.

6. Compliance with Evolving Regulations
Non-compliance with OT security regulations leads to financial penalties. Regular audits ensure adherence and minimize risks.

7. Human Error & Awareness Gaps
Misconfigured security settings remain a major vulnerability. “Investing in cybersecurity awareness training for your OT teams is critical,” Cooke advises. Security training and monitoring help prevent insider threats.

“Proactively addressing these points will help significantly reduce the risk of compromise, protect critical infrastructure, ensure compliance, and safeguard against potentially severe disruptions,” Cooke concluded. 

Moreover, cyberattacks will persist regardless, but proactively addressing these challenges significantly improves the chances of defending against them.
Read more »
Ransomware
cyberattacks trending news Cybersecurity Attack malware News Ransomware

Cisco Talos Uncovers Lotus Blossom’s Multi-Campaign Cyber Espionage Operations

Cisco Talos has uncovered a series of cyber espionage campaigns attributed to the advanced persistent threat (APT) group Lotus Blossom, also known as Spring Dragon, Billbug, and Thrip. 

The group has been active since at least 2012, targeting government, manufacturing, telecommunications, and media sectors in regions such as the Philippines, Vietnam, Hong Kong, and Taiwan. Talos identified Sagerunex, a backdoor tool used exclusively by Lotus Blossom, as the core malware in these campaigns. 

The investigation revealed multiple variants of Sagerunex, evolving from its original form to leverage third-party cloud services such as Dropbox, Twitter, and Zimbra webmail as command-and-control (C2) tunnels, instead of traditional Virtual Private Servers (VPS). This shift helps the group evade detection while maintaining control over infected endpoints. 

The group has been observed gaining persistence on compromised systems by embedding Sagerunex into the system registry and configuring it to run as a service. The malware operates as a dynamic link library (DLL), executed directly in memory to avoid detection. The campaigns also showcase long-term persistence strategies, allowing attackers to remain undetected for months. 

Beyond Sagerunex, Lotus Blossom employs an arsenal of hacking tools to facilitate credential theft, privilege escalation, and data exfiltration. These include a Chrome cookie stealer from GitHub, a customized Venom proxy tool, a privilege adjustment tool, and an archiving tool for encrypting and stealing data. 

Additionally, the group utilizes mtrain V1.01, a modified HTran proxy relay tool, to route connections between compromised machines and external networks. The attack chain follows a structured multi-stage approach, starting with reconnaissance commands such as “net,” “tasklist,” “ipconfig,” and “netstat” to gather system details. 

If an infected machine lacks direct internet access, the attackers leverage proxy settings or the Venom tool to establish connectivity. A notable tactic involves storing malicious tools in the “public\pictures” subfolder, a non-restricted directory, to avoid detection.

Talos’ research underscores the growing sophistication of Lotus Blossom, which continues to refine its techniques and expand its capabilities. With high confidence, Cisco attributes these campaigns to Lotus Blossom, highlighting its sustained cyber espionage operations against high-value targets.
Read more »
Software
Cyber Security FBI Ghost Ransomware Software

FBI Warns: ‘Ghost’ Ransomware Is Spreading— Here’s How to Stay Safe

 


The Federal Bureau of Investigation (FBI) has released an urgent alert about a growing cyber threat known as Ghost ransomware. This group has been attacking various organizations across more than 70 countries, locking victims out of their own systems and demanding payment to restore access. In response, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have advised businesses and individuals to back up their data and strengthen their cybersecurity measures to prevent potential attacks.  


Who Is Behind the Ghost Ransomware?  

The Ghost ransomware group is a team of cybercriminals that use ransomware to encrypt data, making it unusable unless a ransom is paid. Unlike other hacking groups that trick people into clicking on harmful links or sharing personal information (phishing attacks), Ghost takes a different approach. They exploit security flaws in outdated software and hardware to break into systems without needing victims to take any action.  

Cybersecurity experts believe that Ghost operates from China and has used multiple names over time, including Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture. These different names suggest the group has been active for a long time and may have carried out various attacks under different identities.  


How Does Ghost Ransomware Work?  

Since early 2021, Ghost ransomware has been targeting systems with outdated software and firmware. The hackers search for weaknesses in these systems and use publicly available hacking tools to gain access and install ransomware. Once inside, they encrypt important files and demand payment to unlock them.  

The FBI has identified several ransomware files linked to Ghost, including Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe. These files have been used to lock data in critical industries such as healthcare, education, government services, manufacturing, technology, and small businesses. The impact has been severe, affecting essential services and causing financial losses.  


How to Stay Protected from Ghost Ransomware

The FBI has recommended several security steps to reduce the risk of being attacked:  

1. Create Secure Backups: Keep offline backups of important data so that even if ransomware encrypts your files, you can restore them without paying a ransom. Many organizations that had proper backups were able to recover quickly.  

2. Update Software and Firmware: Hackers often target outdated programs with security flaws. Ensure that your operating system, applications, and firmware are regularly updated with the latest security patches.  

3. Recognize Cyber Threats: While Ghost does not typically use phishing, it is still essential to train employees and individuals to identify suspicious activity and avoid downloading unknown files or clicking on unverified links.  

4. Monitor Network Activity: Keep an eye on unusual behavior in your network, such as unexpected logins, file modifications, or unauthorized access. Detecting an attack early can help prevent major damage.  


Cyber threats like Ghost ransomware continue to evolve, but staying informed and taking these preventive measures can help reduce the risk of falling victim to an attack. The FBI urges everyone to act now and secure their data before it’s too late.


Read more »
Windows
BlackLock Cyber Attacks Linux Ransomware Windows

BlackLock Ransomware: The Fastest-Growing Cyber Threat and How to Stay Safe

 



Ransomware remains a major problem for businesses, and a new cybercriminal group is expanding at an alarming rate. Security researchers at ReliaQuest have identified BlackLock as the fastest-growing ransomware operation today, with its activity increasing by 1,425% since late 2024. Although it is currently the seventh most active ransomware group, experts predict it could become the biggest threat in 2025.  

Despite law enforcement cracking down on major ransomware gangs like LockBit in 2024, the number of cyberattacks continues to grow. A report from January 31 suggested ransomware incidents had risen by 15% compared to the previous year. However, a February 20 study by Symantec showed a slower increase of just 3%. No matter the rate, the takeaway is the same, ransomware remains a serious risk.  


How BlackLock Ransomware Operates  

BlackLock ransomware is designed to infect Windows, Linux, and VMware ESXi systems, making it a versatile and dangerous threat. Cybercriminals behind this operation have developed unique methods to pressure victims into paying ransom quickly.  


1. Blocking access to stolen data  

  • Ransomware groups often leak stolen information on dark web sites to force victims to pay.  
  • BlackLock makes it harder for victims and cybersecurity teams to access leaked data by blocking repeated download attempts.  
  • If someone tries to retrieve files too often, they either receive no response or only see empty files with contact details instead of real data.  
  • This tactic prevents companies from fully understanding what was stolen, increasing the likelihood of paying the ransom.  


2. Recruiting criminals to assist with attacks  

  • BlackLock actively hires "traffers," cybercriminals who help spread ransomware by tricking people into downloading malware.  
  • These traffers guide victims toward fake websites or malicious links that install ransomware.  
  • The group openly recruits low-level hackers on underground forums, while more skilled cybercriminals are privately contacted for higher-level roles.  


Steps to Protect Your Systems  

Security experts recommend taking immediate action to strengthen defenses, especially for companies using VMware ESXi servers. Here are some key steps:  

1. Turn off unnecessary services  

  • Disable unused features like vMotion and SNMP to reduce possible entry points for attackers.  

2. Strengthen security restrictions  

  •  Configure VMware ESXi hosts to only allow management through vCenter, making it harder for hackers to exploit weaknesses.  

3. Limit network access  

  •  Use firewalls and strict access controls to prevent unauthorized users from reaching sensitive systems.  

Additional recommendations include:  

1. Activating multi-factor authentication (MFA) to prevent unauthorized logins.  

2. Disabling Remote Desktop Protocol (RDP) on systems that do not need remote access.  

The rapid rise of BlackLock ransomware shows that cybercriminals ar constantly developing new strategies to pressure victims and avoid detection. Organizations must take proactive steps to secure their networks and stay informed about emerging threats. Implementing strong security controls today can prevent costly cyberattacks in the future.

Read more »
Subscribe to: Posts (Atom)