Skip to main content
Customer Support Customer Support

Ransomware Spotlight

Dedicated exclusively to all things related to ransomware

  • 41 Topics
  • 30 Replies

LockBit’s Latest Taunt: A Challenge to the FBI and a Resurgence Signal

  • 4
  • 4
Takedown

LockBit Saga Continues: Return of the FBI

  • 7
  • 4
Blog

LockBit Ransomware Strikes Back: A Resilient Threat Amidst Law Enforcem...

  • 4
  • 7
41 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
NailaoLocker ransomware targets EU healthcare-related entities

February 20, 2025 By Pierluigi Paganini NailaoLocker ransomware is a new threat that targeted European healthcare organizations from June to October 2024. Orange Cyberdefense CERT uncovered a malware campaign, tracked as The Green Nailao campaign, that targeted European organizations, including healthcare, in late 2024, using ShadowPad, PlugX, and the previously undocumented NailaoLocker ransomware. The Orange Cyberdefense CERT investigated four attackers with a similar initial access vector consisting of the compromise of a Check Point VPN appliance. The experts believe threat actors exploited the zero-day CVE-2024-24919 in Check Point Security Gateways with Remote Access VPN or Mobile Access features. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
CISA and FBI: Ghost ransomware breached orgs in 70 countries

February 19, 2025 By Sergiu Gatlan CISA and the FBI said attackers deploying Ghost ransomware have breached victims from multiple industry sectors across over 70 countries, including critical infrastructure organizations. Other industries impacted include healthcare, government, education, technology, manufacturing, and numerous small and medium-sized businesses. "Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware," CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) said in a joint advisory released on Wednesday. "This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China." >>Full Article<<

131
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Russian CryptoBytes Hackers Exploiting Windows Machines To Deploy UxCryptor Ransomware

February 19, 2025 By Tushar Subhra Dutta The Russian cybercriminal group CryptoBytes has intensified its ransomware campaigns using a modified version of the UxCryptor malware, according to new findings from SonicWall’s Capture Labs threat research team. This financially motivated group, active since at least 2023, leverages leaked ransomware builders to target Windows systems globally. Recent attacks showcase advanced anti-analysis techniques designed to evade detection. These methods make it difficult for security researchers to track and analyze the malware. In addition to technical measures, researchers at SonicWall noted that the attackers use psychological pressure tactics to intimidate victims and pressure them into making cryptocurrency payments, increasing the effectiveness of their extortion schemes. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
BlackLock ransomware onslaught: What to expect and how to fight it

February 18, 2025 By Zeljka Zorz BlackLock is on track to become the most active ransomware-as-a-service (RaaS) outfit in 2025, according to ReliaQuest. Its success is primarily due to their unusually active presence and good reputation on the ransomware-focused Russian-language forum RAMP, and their aggressive recruiting of traffers (individuals that steer victims to harmful content/software), initial access brokers (IABs), and affiliates. What is BlackLock? BlackLock (aka El Dorado or Eldorado) cropped up in early 2024. It uses custom-built ransomware that can target Windows, VMWare ESXi, and Linux environments, but the group also exfiltrates victims’ data and threatens to publish it if the ransom isn’t paid. >>Full Article<<

40
Jasper_The_Rasper
Moderator
C
Administrator
ConnorMThreat Research Analyst
published in Ransomware Spotlight
8Base ransomware actors arrested in ThailandNews

Following an operation by the US Department of Justice, two Russian citizens with direct ties to the 8Base ransomware group have been arrested in Thailand on a series of charges. 8Base was the platform used to launch thousands of encryption attacks with the Phobos ransomware strain, which led to exfiltration of data and the eventual extortion of payment to decrypt the system and return or delete the stolen data. In addition to the arrests, Europol successfully seized 27 servers belonging to 8Base, hopefully terminating the group’s operations for good. Ransomware exposes sensitive data for 120,000 hospital patients Officials for Memorial Hospital and Manor in Georgia have recently begun contacting nearly 120,000 individuals to inform them that their sensitive health records may have been compromised during a ransomware attack that occurred in November of last year. The Embargo ransomware group has claimed this exfiltration attack and has published a data trove of 1.15TB to their leak si

363
ProTruckDriver
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
XELERA Ransomware Attacking Job Seekers With Weaponized Word Documents

February 14, 2025 By Tushar Subhra Dutta Job seekers have become the target of a sophisticated ransomware campaign in a recent cybersecurity threat, and this campaign dubbed as “XELERA.” This campaign uses fake job offers from the Food Corporation of India (FCI) to lure victims into opening malicious Word documents. These documents, once opened, initiate a complex infection chain that ultimately leads to the deployment of ransomware and other malicious activities. Security analysts at Seqrite identified that Here the initial infection chain starts with spear phishing email, and these emails are highly targeted and personalized fraudulent emails. >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Ransomware Roundup – Lynx

By Shunichi Imano and Fred Gutierrez | February 14, 2025 FortiGuard Labs gathers data on ransomware variants of interest that have been gaining traction within our datasets and the OSINT community. The Ransomware Roundup report aims to provide readers with brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those variants. This edition of the Ransomware Roundup covers the Lynx ransomware. Affected platforms: Microsoft Windows Impacted parties: Microsoft Windows Impact: Encrypts victims' files and demands ransom for file decryption Severity level: High Lynx Ransomware Overview The first sample of the Lynx ransomware was made available on a publicly available file-scanning site in early July 2024, which coincides with other reports of its first availability. Our research found that the Lynx and INC ransomware, which first appeared in July 2023, look very similar. However, INC offers fewer options at the execution phase. We believe that IN

10
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Chinese Cyberspy Possibly Launching Ransomware Attacks as Side Job

A toolset associated with China-linked espionage intrusions was employed in a ransomware attack, likely by a single individual. February 13, 2025 By Ionut Arghire Tools typically employed by Chinese cyberespionage groups have been used in a recent ransomware attack, likely by an individual hacker, Symantec notes in a fresh report. The toolset includes a legitimate Toshiba executable deployed on the victims’ systems to sideload a malicious DLL that deploys a heavily obfuscated payload containing the PlugX (aka Korplug) backdoor. According to Symantec, the custom backdoor was previously linked to Mustang Panda (aka Earth Preta), a Chinese espionage group, and has never been used by threat actors in other countries. >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Chinese espionage tools deployed in RA World ransomware attack

February 13, 2025 By Bill Toulas A China-based threat actor, tracked as Emperor Dragonfly and commonly associated with cybercriminal endeavors, has been observed using in a ransomware attack a toolset previously attributed to espionage actors. The hackers deployed the RA World ransomware against an Asian software and services company and demanded an initial ransom payment of $2 million. Researchers from Symantec’s Threat Hunter Team observed the activity in late 2024 and highlight a potential overlap between state-backed cyber espionage actors and financially motivated cybercrime groups. “During the attack in late 2024, the attacker deployed a distinct toolset that had previously been used by a China-linked actor in classic espionage attacks,” the researchers say, adding that "tools associated with China-based espionage groups are often shared resources" but "many aren’t publicly available and aren’t usually associated with cybercrime activity.” >>Full Article<<

20
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Ransomware Spotlight
Sarcoma ransomware claims breach at giant PCB maker Unimicron

February 12, 2025 By Bill Toulas A relatively new ransomware operation named ‘Sarcoma’ has claimed responsibility for an attack against the Unimicron printed circuit boards (PCB) maker in Taiwan. The cybercriminals have published samples of files allegedly stolen from the company’s systems during the attack and threaten to leak everything next week if a ransom is not paid. In a new listing added to Sarcoma’s leak site yesterday, the threat actors claim to be holding 377 GB of SQL files and documents exfiltrated from the Taiwanese company. Unimicron added on Sarcoma's list of victims Source: BleepingComputer Unimicron is a public company manufacturing rigid and flexible PCBs, high-density interconnection (HDI) boards, and integrated circuit (IC) carriers. The company is one of the largest PCB manufacturers in the world, with plants and service centers in Taiwan, China, Germany, and Japan. Its products are extensively used in LDC monitors, computers, peripherals, and smartphones. >>Full

30
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Ransomware Spotlight
United States, Australia, and the United Kingdom Jointly Sanction Key Infrastructure that Enables Ransomware Attacks

February 11, 2025 WASHINGTON — Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC), Australia’s Department of Foreign Affairs and Trade, and the United Kingdom’s Foreign Commonwealth and Development Office are jointly designating Zservers, a Russia-based bulletproof hosting (BPH) services provider, for its role in supporting LockBit ransomware attacks. LockBit, a Russia-based ransomware group best known for its ransomware variant of the same name, is one of the most deployed ransomware variants and was responsible for the November 2023 attack against the Industrial Commercial Bank of China U.S. broker-dealer. BPH service providers sell access to specialized servers and other computer infrastructure designed to evade detection and defy law enforcement attempts to disrupt these malicious activities. OFAC is also designating two Russian nationals who are key administrators of Zservers and have enabled ransomware attacks and other criminal activity. “Ransomware

50
TripleHelix
Moderator
C
Administrator
ConnorMThreat Research Analyst
published in Ransomware Spotlight
Cyber News Rundown: Black Basta ransomware claims breach of Ascension Healthcare

Recently, the threat actors behind the Black Basta ransomware group claimed responsibility for the data breach of Ascension healthcare, which exposed sensitive records for over 5.6 million individuals, including patients and employees. The initial attack occurred back in May, when an employee fell victim to a phishing attack and downloaded a malicious file on the internal Ascension network. Clop ransomware adds 66 victim companies to their leak site Following the breach of the Cleo data transfer program, the Clop ransomware group has added 66 victim companies to their dark web leak site, with a 48-hour deadline to respond for negotiations before being fully outed. The breach of Cleo allowed the threat actors to gain network access to the victim companies and compromise a significant amount of data from each one. This is the second major data-transfer attack performed by the Clop ransomware group and is still unclear if it surpasses the magnitude of the MOVEit vulnerability attack from

493
ProTruckDriver
Moderator
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Ransomware Spotlight
FBI's Major Initiative Against LockBit Ransomware: Giving out Decryption KeysNews

The cyber threat landscape continues to evolve, with ransomware attacks becoming more sophisticated and frequent. In response, the FBI has intensified its efforts to combat these threats, especially focusing on the notorious LockBit ransomware. Contacting the IC3: A Critical Step for Victims The FBI strongly urges potential victims of LockBit ransomware to reach out to the Internet Crime Complaint Center (IC3). This step is crucial as it enables the FBI to gather vital information, aiding in the broader fight against cybercriminals. By reporting incidents, victims can help the FBI track and disrupt ransomware operations more effectively. This proactive measure not only assists individual victims but also contributes to the larger goal of dismantling ransomware networks​ (Federal Bureau of Investigation)​​ Free Ransomware Decryption Keys In a significant development, the FBI, in collaboration with cybersecurity firms, is offering free decryption keys to ransomware victims - most of whic

2975
A
New Member
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Ransomware Spotlight
LockBit Saga Continues: Return of the FBITakedown

In the latest chapter of the ongoing LockBit saga, international law enforcement agencies have struck back once again, seizing the group's infrastructure and identifying the key figure behind the infamous ransomware operation. This second takedown, building on previous efforts, further demonstrates the determination of global partners to disrupt the cybercriminal network's activities. Newly seized leaksite on the darkweb See the previous events on this epic feud between LockBit and Law Enfocement The New Takedown: Exposing the Leader Identity Revealed: Dmitry Yuryevich Khoroshev Unmasked Following a thorough investigation, authorities have unsealed an indictment revealing the mastermind behind LockBit: Dmitry Yuryevich Khoroshev, known by aliases like "LockBitSupp" and "putinkrab." This Russian national has been charged with multiple counts of fraud, extortion, and intentional damage to protected computers. Renewed Sanctions and Rewards The U.S. Department of the Treasury has imposed s

2594
russell.harris
Popular Voice
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Ransomware Spotlight
LockBit Ransomware Strikes Back: A Resilient Threat Amidst Law Enforcement EffortsBlog

Stream the Webinar on demand HERE In a dramatic sequence of events, the LockBit ransomware group, known for its #1 spot in ransomware, has showcased a remarkable capacity for resilience and adaptability, despite significant law enforcement actions aimed at dismantling its operations. Recent developments reveal LockBit's prowess, the challenges of combating cybercrime, and the evolving landscape of cybersecurity threats. See our previous post on the takedown of LockBit​​​ The FBI's takedown of LockBit came at a critical moment as the group was preparing to release sensitive data stolen from Fulton County, Georgia's government computer systems. This data, allegedly including documents tied to high-profile legal matters, including president Donald Trump and potentially jeopardizing numerous trials. This action underscores the grave risks associated with ransomware attacks and their impact to politics. Despite LockBit's initial setback, the group's vow to regroup and its threats to release

4577
TripleHelix
Moderator
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Ransomware Spotlight
LockBit Takedown: A Landmark Cybersecurity TriumphTakedown

In a groundbreaking operation that marks a pivotal moment in the fight against cybercrime, U.S. and U.K. law enforcement agencies, alongside international partners, have delivered a significant blow to the LockBit ransomware group. This collaborative effort not only disrupted one of the most notorious ransomware operations globally but also highlighted the resilience and determination of global cybersecurity communities against cyber threats. To see the updated countermeasures that LockBit took in retaliation see this post​​​​​​ A Global Threat Neutralized LockBit, known for its widespread impact, has victimized over 2,000 entities worldwide, amassing over $120 million in ransom payments through demands that reached into the hundreds of millions and damages that caused billions. Its attacks spanned across various sectors, including manufacturing, logistics, insurance, and more, showcasing its indiscriminate approach to cyber extortion. Lockbit were the most successful ransomware the pa

1922
ProTruckDriver
Moderator

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions