Skip to main content

Customer Support Customer Support

Events
Leaderboard
Customer Support

Create topic
Login

Home
Community overview
Threat Intel Hub
Ransomware Spotlight

Ransomware Spotlight

Dedicated exclusively to all things related to ransomware

41 Topics
30 Replies

When you subscribe we will email you when there is a new topic in this category

LockBit’s Latest Taunt: A Challenge to the FBI and a Resurgence Signal

4
4

Takedown

LockBit Saga Continues: Return of the FBI

7
4

Blog

LockBit Ransomware Strikes Back: A Resilient Threat Amidst Law Enforcem...

4
7

41 Topics

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Ransomware Group Claims Attacks on Ascom, Jaguar Land Rover

The Hellcat ransomware group claims to have stolen tens of gigabytes of data from Ascom and Jaguar Land Rover. March 21, 2025 By Ionut Arghire The Hellcat ransomware group this week claimed responsibility for cyberattacks on Swiss telecommunications provider Ascom and British multinational car manufacturer Jaguar Land Rover (JLR). The attack on Ascom occurred on March 16, and the group added the company to its Tor-based leak site on the same day. The telecoms company confirmed the next day that the attack targeted its technical ticketing system. “The Ascom IT Cybersecurity Team is investigating the incident and immediately closed the ticketing system. Determining the extent of the attack is part of the ongoing investigation,” the company said. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

VSCode extensions found downloading early-stage ransomware

March 20, 2025 By Bill Toulas Two malicious VSCode Marketplace extensions were found deploying in-development ransomware, exposing critical gaps in Microsoft's review process. The extensions, named "ahban.shiba" and "ahban.cychelloworld," were downloaded seven and eight times, respectively, before they were eventually removed from the store. It is notable that the extensions were uploaded onto the VSCode Marketplace on October 27, 2024 (ahban.cychelloworld) and February 17, 2025 (ahban.shiba), bypassing safety review processes and remaining on Microsoft's store for an extensive period of time. The VSCode Marketplace is an online platform where developers can find, install, and share extensions for Visual Studio Code (VSCode). It is widely used by software and web developers, data scientists, and programmers. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

RansomHub ransomware uses new Betruger ‘multi-function’ backdoor

March 20, 2025 By Sergiu Gatlan A newly identified custom backdoor deployed in several recent ransomware attacks has been linked to at least one RansomHub ransomware-as-a-service (RaaS) operation affiliate. Symantec researchers who named this malware Betruger describe it as a "rare example of a multi-function backdoor" that was likely engineered for use in ransomware attacks. The malware's capabilities include a wide range of capabilities that overlap with features commonly found in malicious tools dropped before deploying ransomware payloads, including keylogging, network scanning, privilege escalation, credential dumping, screenshotting, and uploading files to a command and control (C2) server. "The functionality of Betruger indicates that it may have been developed in order to minimize the number of new tools dropped on a targeted network while a ransomware attack is being prepared," Symantec's Threat Hunter Team said. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

RansomHub Taps FakeUpdates to Target US Government Sector

A ransomware activity wave using the SocGholish MaaS framework for initial access also has affected banking and consulting firms in the US, Taiwan, and Japan since the beginning of the year. March 17, 2025 By Elizabeth Montalbano The RansomHub cybercriminal group has teamed with the threat actor behind the FakeUpdates malware-as-a-service (MaaS) framework to deliver its ransomware, in a wave of attacks against US government organizations. In threat activity tracked as "Water Scylla" by researchers at Trend Micro, SocGholish, the actor responsible for FakeUpdates, is delivering the ransomware in a complex, multiple-stage attack involving several threat groups, according to a recent blog post. The attack "involves compromised websites, collaboration with threat actors operating malicious Keitaro TDS instances, SocGholish payload delivery, and post-compromise activity that leads to RansomHub," Trend Micro researchers revealed in the post. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

GPU-powered Akira ransomware decryptor released on GitHub

March 15, 2025 By Bill Toulas Security researcher Yohanes Nugroho has released a decryptor for the Linux variant of Akira ransomware, which utilizes GPU power to retrieve the decryption key and unlock files for free. Nugroho developed the decryptor after being asked for help from a friend, deeming the encrypted system solvable within a week, based on how Akira generates encryption keys using timestamps. The project ended up taking three weeks due to unforeseen complexities, and the researcher spent $1,200 on GPU resources to crack the encryption key, but eventually, he succeeded. Using GPUs to brute force keys Nugroho's decryptor does not work like a traditional decryption tool where users supply a key to unlock their files. Instead, it brute-forces encryption keys (unique for each file) by exploiting the fact that the Akira encryptor generates its encryption keys based on the current time (in nanoseconds) as a seed. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

LockBit ransomware developer Rostislav Panev was extradited from Israel to the U.S.

March 14, 2025 By Pierluigi Paganini The US Justice Department announced that the LockBit ransomware developer Rostislav Panev was extradited from Israel to the U.S. The US Justice Department announced that one of the LockBit ransomware developer, Rostislav Panev (51), has been extradited to the United States. The dual Russian-Israeli national was arrested in Israel in 2024 and faces charges related to his role in the ransomware operation The man is accused of being a LockBit ransomware developer from 2019 through at least February 2024. The leading ransomware group attacked over 2,500 victims worldwide, including 1,800 in the United States, extracted $500M in ransoms, and caused billions in damages. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Ransomware gang creates tool to automate VPN brute-force attacks

March 14, 2025 By Bill Toulas The Black Basta ransomware operation created an automated brute-forcing framework dubbed 'BRUTED' to breach edge networking devices like firewalls and VPNs. The framework has enabled BlackBasta to streamline initial network access and scale ransomware attacks on vulnerable internet-exposed endpoints. The discovery of BRUTED comes from EclecticIQ researcher Arda Büyükkaya following an in-depth examination of the ransomware gang's leaked internal chat logs. Several reports of large-scale brute-forcing and password spray attacks against those devices throughout 2024, some of which might be linked to BRUTED or similar-origin operations. Automating brute-forcing Büyükkaya says Black Basta has been using the automated BRUTED platform since 2023 to conduct large-scale credential-stuffing and brute-force attacks on edge network devices. Analysis of the source code indicates that the framework was specifically designed to brute-force credentials on the following VP

Jasper_The_RasperModerator

posted in Ransomware Spotlight

New SuperBlack ransomware exploits Fortinet auth bypass flaws

March 13, 2025 By Bill Toulas A new ransomware operator named 'Mora_001' is exploiting two Fortinet vulnerabilities to gain unauthorized access to firewall appliances and deploy a custom ransomware strain dubbed SuperBlack. The two vulnerabilities, both authentication bypasses, are CVE-2024-55591 and CVE-2025-24472, which Fortinet disclosed in January and February, respectively. When Fortinet first disclosed CVE-2024-55591 on January 14, they confirmed it had been exploited as a zero-day, with Arctic Wolf stating it had been used in attacks since November 2024 to breach FortiGate firewalls. Confusingly, on February 11, Fortinet added CVE-2025-2447 to their January advisory, which led many to believe it was a newly exploited flaw. However, Fortinet told BleepingComputer that this bug was also fixed in January 2024 and was not exploited. "We are not aware of CVE-2025-24472 ever being exploited," Fortinet told BleepingComputer at the time. However, a new report by Forescout researchers, s

TripleHelixModerator

posted in Ransomware Spotlight

Alert CISA and Partners Release Cybersecurity Advisory on Medusa Ransomware Release Date March 12, 2025

Today, CISA—in partnership with the Federal Bureau of Investigation (FBI) and Multi-State Information Sharing and Analysis Center (MS-ISAC)—released joint Cybersecurity Advisory, #StopRansomware: Medusa Ransomware. This advisory provides tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and detection methods associated with known Medusa ransomware activity. Medusa is a ransomware-as-a-service variant used to conduct ransomware attacks; as of December 2024, over 300 victims from critical infrastructure sectors have been impacted. Medusa actors use common techniques like phishing campaigns and exploiting unpatched software vulnerabilities. Immediate actions organizations can take to mitigate Medusa ransomware activity: Ensure operating systems, software, and firmware are patched and up to date. Segment networks to restrict lateral movement. Filter network traffic by preventing unknown or untrusted origins from accessing remote services. CISA encourages network

Jasper_The_RasperModerator

posted in Ransomware Spotlight

CISA: Medusa ransomware hit over 300 critical infrastructure orgs

March 12, 2025 By Sergiu Gatlan CISA says the Medusa ransomware operation has impacted over 300 organizations in critical infrastructure sectors in the United States until last month. This was revealed in a joint advisory issued today in coordination with the Federal Bureau of Investigation (FBI) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). "As of February 2025, Medusa developers and affiliates have impacted over 300 victims from a variety of critical infrastructure sectors with affected industries including medical, education, legal, insurance, technology, and manufacturing," CISA, the FBI, and MS-ISAC warned on Wednesday. "FBI, CISA, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Medusa ransomware incidents." Medusa ransomware surfaced almost four years ago, in January 2021, but the gang's activity only picked up two years later, in 2023, when it launched

Jasper_The_RasperModerator

posted in Ransomware Spotlight

RansomHouse gang claims the hack of the Loretto Hospital in Chicago

March 10, 2025 By Pierluigi Paganini Another American hospital falls victim to a ransomware attack; the RansomHouse gang announced the hack of Loretto Hospital in Chicago.” The RansomHouse gang announced the hack of Loretto Hospital in Chicago, the groups claims to have stolen 1.5TB of sensitive data. The Loretto Hospital is a not-for-profit, community-focused health care provider. They provide healthcare services including: primary care, geriatric medicine, vision care, behavioral health services, pediatrics, womens health, pediatric medicine, family planning and dental services. The hospital was founded in 1939 and is headquartered in Chicago, Illinois. At the time of writing, the group has yet to publish any evidence of the alleged stolen data. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

'Spearwing' RaaS Group Ruffles Feathers in Cyber Threat Scene

The group is using the Medusa malware and taking up space once held by other notable ransomware groups like LockBot, increasing its victim list to 400 and demanding astoundingly high ransoms. March 7, 2025 By Kristina Beek Medusa ransomware attacks are increasingly becoming a core tool for a threat group known as "Spearwing," which has amassed hundreds of victims since 2023; nearly 400, in fact, have been listed on its leak site. The ransom demands when using Medusa ransomware range from $100,000 to a whopping $15 million, according to Symantec's threat hunter team. Symantec's researchers believe that Spearwing is taking advantage of the wide-open gap in the ransomware space with the decline of groups like Noberus and LockBit, eager to make a name for itself with its continuously increasingly activity. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Qilin Ransomware gang claims the hack of the Ministry of Foreign Affairs of Ukraine

March 7, 2025 By Pierluigi Paganini Qilin Ransomware group claims to have breached the Ministry of Foreign Affairs of Ukraine, marking a significant cybersecurity attack. The Russian-speaking Qilin Ransomware group claims responsibility for an attack on the Ministry of Foreign Affairs of Ukraine. The group stated that it stole sensitive data such as private correspondence, personal information, and official decrees. The ransomware group declared that they had already sold some of the alleged stolen information to third parties. “The data of the Ministry of foreign affairs of Ukraine ended up in our hands. The part of it was sold succesfully. Among the rest data: private correspondence, personal information, decrees etc.” reads the announcement published by the group on its Tor leak site. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Ransomware gang encrypted network from a webcam to bypass EDR

March 6, 2025 By Bill Toulas The Akira ransomware gang was spotted using an unsecured webcam to launch encryption attacks on a victim's network, effectively circumventing Endpoint Detection and Response (EDR), which was blocking the encryptor in Windows. Cybersecurity firm S-RM team discovered the unusual attack method during a recent incident response at one of their clients. Notably, Akira only pivoted to the webcam after attempting to deploy encryptors on Windows, which were blocked by the victim's EDR solution. Akira's unorthodox attack chain The threat actors initially gained access to the corporate network via an exposed remote access solution at the targeted company, likely by leveraging stolen credentials or brute-forcing the password. After gaining access, they deployed AnyDesk, a legitimate remote access tool, and stole the company's data for use as part of the double extortion attack. Next, Akira used Remote Desktop Protocol (RDP) to move laterally and expand their presence

TripleHelixModerator

posted in Ransomware Spotlight

Alert FBI Warns of Data Extortion Scam Targeting Corporate Executives Release Date March 06, 2025

The Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) has released an alert warning of a scam involving criminal actors masquerading as the “BianLian Group.” The cyber criminals target corporate executives by sending extortion letters threatening to release victims’ sensitive information unless payment is received. CISA encourages organizations to review the following FBI Public Service Announcement for more information: Mail Scam Targeting Corporate Executives Claims Ties to Ransomware Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. https://www.cisa.gov/news-events/alerts/2025/03/06/fbi-warns-data-extortion-scam-targeting-corporate-executives

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Black Basta Pivots to Cactus Ransomware Group

The future of the formerly fearsome cybercriminal group remains uncertain as key members have moved to a new affiliation, in fresh attacks that use novel persistence malware BackConnect. March 5, 2025 By Elizabeth Montalbano After an attack hiatus and signs of infighting within the ranks of the Black Basta ransomware group, some of its key members appear to have shifted to new malware in a fresh attack wave, under the guise of another threat group called Cactus. Since the start of the year, Trend Micro researchers observed separate Black Basta and Cactus ransomware attacks that shared similar tactics, techniques, and procedures (TTPs) and also leveraged a new malware called BackConnect for achieving persistence in victim environments, according to a blog post published on March 3. These similarities signal a "shift in affiliations among certain threat actors associated with Black Basta," with evidence suggesting that key members have transitioned to the Cactus ransomware group. >>Full

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Hunters International gang claims the theft of 1.4 TB of data allegedly stolen from Tata Technologies

March 5, 2025 By Pierluigi Paganini Ransomware group Hunters International claims to have hacked Tata Technologies, threatening to leak 1.4 TB of stolen data. The Hunters International ransomware group claimed to have breached the Indian multinational technology company Tata Technologies, a Tata Motors subsidiary. The group claims the theft of 1.4 terabytes of data and is threatening to leak it. The ransomware attack took place in January as per a regulatory filing with the Indian National Stock Exchange. The company, which is engaged in product engineering, provides services to automotive and aerospace original equipment manufacturers as well as industrial machinery companies. As of 2023, the IT giant has over 11,000 employees across 18 delivery centers worldwide, including India, North America, Europe, and Asia-Pacific. >>Full Article<<

TylerMSr. Security Analyst & Community Manager

published in Ransomware Spotlight

LockBit’s Latest Taunt: A Challenge to the FBI and a Resurgence Signal

LockBit ransomware has resurfaced with a brazen message targeting newly appointed FBI Director Kash Patel. On February 25, 2025, the gang posted a taunting birthday message on their dark web site, offering Patel an encrypted archive supposedly containing classified FBI data. The gang framed the move as a way to "help" Patel expose corruption within the FBI, though cybersecurity analysts already suspect the archive is either publicly available data or a bluff. absolutely unhinged “Dear Kash Patel! I wish you Happy Birthday! I also congratulate you on your position as the ninth director of the Federal Bureau of investigation and wish you professional success, because it will be not easy for you.You are surrounded by liars, professional manipulators, respected Kash Patel. The so-called "agents" who are under your supervision are tricky manipulators and the whole point of their manipulation is to do nothing, but you have to do something about it, Mr. Kash Patel.I have been called "extortio

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Vulnerable Paragon Driver Exploited in Ransomware Attacks

Ransomware operators exploit a vulnerable Paragon driver in BYOVD attacks to elevate privileges to System. March 3, 2025 By Ionut Arghire Ransomware operators have been observed deploying a vulnerable Paragon Hard Disk Manager driver in attacks and exploiting it to elevate their privileges to System. The driver, Biontdrv.sys, which is part of Hard Disk Manager and other products that rely on it, such as Paragon Partition Manager and Backup and Recovery, contains five vulnerabilities that allow attackers to elevate privileges or cause a denial-of-service (DoS) condition. “Additionally, as the attack involves a Microsoft-signed driver, an attacker can leverage a Bring Your Own Vulnerable Driver (BYOVD) technique to exploit systems even if Paragon Partition Manager is not installed,” a CERT/CC advisory reads. The security defects include an arbitrary kernel memory bug (CVE-2025-0288), a null pointer dereference issue (CVE-2025-0287), an arbitrary kernel memory write flaw (CVE-2025-0286),

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Qilin ransomware claims attack at Lee Enterprises, leaks stolen data

See Also - 8Base ransomware actors arrested in Thailand February 28, 2025 By Bill Toulas The Qilin ransomware gang has claimed responsibility for the attack at Lee Enterprises that disrupted operations on February 3, leaking samples of data they claim was stolen from the company. The threat actors have now threatened to leak all the allegedly stolen data on March 5, 2025, unless a ransom demand is paid. Lee Enterprises is a US-based media company that owns and operates over 77 daily newspapers, 350 publications, digital media platforms, and marketing services. The company's primary focus is local news and advertising, with its digital audience reaches tens of millions monthly. In a filing with the U.S. Securities and Exchange Commission (SEC) earlier this month, the company disclosed that it had suffered a cyberattack on February 3, 2025, causing significant operational disruptions. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

DragonForce Ransomware group is targeting Saudi Arabia

February 27, 2025 By Pierluigi Paganini Resecurity researchers reported that DragonForce ransomware targets Saudi organizations rising cyber threats in the region. DragonForce ransomware has recently been reported to target organizations in the Kingdom of Saudi Arabia (KSA). A significant incident identified by Resecurity involved a data leak from a prominent real estate and construction company in Riyadh, which has projects with major conglomerates in the energy, oil and gas, government, and defense sectors. >>Full Article<<

Jasper_The_RasperModerator

posted in Ransomware Spotlight

FortiGuard Labs Threat Research Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan

By Pei Han Liao | February 27, 2025 Affected Platforms: Microsoft Windows Impacted Users: Microsoft Windows Impact: The stolen information can be used for future attack Severity Level: High In January 2025, FortiGuard Labs observed an attack that used Winos4.0, an advanced malware framework actively used in recent threat campaigns, to target companies in Taiwan. Figure 1 shows an example of the attack chain. Usually, there is a loader that is only used to load the malicious DLL file, and the Winos4.0 module is extracted from the shellcode downloaded from its C2 server. Figure 1: Attack flow Phishing According to a report released in November 2024, Winos4.0 was distributed through gaming-related applications, however, it spread via an email masquerading as from Taiwan's National Taxation Bureau in the campaign in January 2025. The sender claimed that the malicious file attached was a list of enterprises scheduled for tax inspection and asked the receiver to forward the information to th

Jasper_The_RasperModerator

posted in Ransomware Spotlight

EncryptHub breaches 618 orgs to deploy infostealers, ransomware

February 26, 2025 By Bill Toulas A threat actor tracked as 'EncryptHub,' aka Larva-208, has been targeting organizations worldwide with spear-phishing and social engineering attacks to gain access to corporate networks. According to a report by Prodaft, which was published internally last week and made public yesterday, since June 2024, when EncryptHub initiated operations, it has compromised at least 618 organizations. After gaining access, the threat actors install Remote Monitoring and Management (RMM) software, followed by the deployment of information stealers like Stealc and Rhadamanthys. In many observed cases, EncryptHub also deploys ransomware on compromised systems. Prodaft told BleepingComputer that the threat group is affiliated with RansomHub and BlackSuit, having deployed both ransomware encryptors in the past and possibly acting as an initial access broker for them or a direct affiliate. However, in many attacks the researchers observed, the threat actors deployed a cust

Jasper_The_RasperModerator

posted in Ransomware Spotlight

New Anubis Ransomware Could Pose Major Threat to Organizations

Threat Intelligence firm Kela warns of a new ransomware group called Anubis operating as a RaaS service with an extensive array of options for affiliates. February 26, 2025 By Kevin Townsend Threat Intelligence firm Kela warns of a new ransomware group called Anubis operating as a RaaS service with an extensive array of options for affiliates. The group emerged as recently as late 2024, although the researchers believe that its members have experience in ransomware, both malware and operations. Information on Anubis comes from an analysis of the group’s dark web footprint rather than code analysis of the ransomware. As with most ransomware groups today, Anubis uses double extortion. The researchers suggest that “Anubis appears to be an emerging threat, highlighting different business models employed by modern extortion actors.” Kela bases its blog report on two Anubis actors that it is tracking on the dark web and on X. One, known as ‘superSonic’, advertised new affiliate programs on t

Jasper_The_RasperModerator

posted in Ransomware Spotlight

Black Basta ransomware gang's internal chat logs leak online

February 20, 2025 By Sergiu Gatlan An unknown leaker has released what they claim to be an archive of internal Matrix chat logs belonging to the Black Basta ransomware operation. ExploitWhispers, the individual who uploaded the stolen messages on the MEGA file-sharing platform, has since removed it and uploaded it to a dedicated Telegram channel. It's not yet clear if ExploitWhispers is a security researcher who gained access to the gang's internal chat server or a disgruntled member. While they never shared the reason behind this move, cyber threat intelligence company PRODAFT said today that the leak could directly result from the ransomware gang's alleged attacks targeting Russian banks. >>Full Article<<

1
2

Page 1 / 2

Latest solutions

the root says...low ram avalable.....windows will not recognize the ram or the processor in system v
3 Replies
will webroot remove the pain in the ass....ask program and ask toolbar
1 Reply
I cannot install HRBlock income tax program. Could Webroot be the problem, and how do I cut it off?
1 Reply
Renewal does not carryover remaining days
2 Replies
Webroot blocking Roblox despite it being in the allow files section
1 Reply

Leaderboard

W
WWillow
12 likes
T
Tyrant
7 likes
RetiredTripleHelix
5 likes
Baldrick
4 likes
D
David dids white
4 likes

Badges

Tarnakhas earned the badge Most Wanted
Tarnakhas earned the badge Beta To The Max
Muddy7has earned the badge Most Wanted
Muddy7has earned the badge Beta To The Max
pierrequiroulehas earned the badge Beta To The Max

Show all badges

Popular Tags

Microsoft
CISA Vulnerability Bulletin
Mac
microsoft security bulletin
microsoft security updates

Join the Conversation

Tweets by Webroot

Powered by Gainsight

Terms & Conditions

Sign up

Already have an account? Login

Username *

E-mail address *

Password *

I accept the terms & conditions

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Username or Email

Password

Remember me

Forgot password?

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK

Cybersecurity Solutions OpenText Cybersecurity 2024 Threat Report Cyber Resilience Program

Privacy Policy Cookie Policy Cookies Preferences

LinkedIn Twitter YouTube

© 2024 Open Text Corporation. All rights reserved.