Bleeping Computer
Electronic prescription provider MediSecure in Australia has shut down its website and phone lines following a ransomware attack believed to originate from a third-party vendor.
The Cyber Express
Microsoft patched a zero-day vulnerability exploited by attackers to distribute QakBot and other malware payloads on susceptible Windows systems. Identified
CSO
CISA advisory includes indicators of compromise and TTPs that can be used for threat hunting.
Bleeping Computer
Microsoft has fixed a zero-day vulnerability exploited in attacks to deliver QakBot and other malware payloads on vulnerable Windows systems.
Krebs on Security
The United States joined the United Kingdom and Australia today in sanctioning 31-year-old Russian national Dmitry Yuryevich Khoroshev as the alleged leader of the infamous ransomware group LockBit. The U.S. Department of Justice also indicted Khoroshev as the gang's leader…
Security Affairs
A new round of the weekly Security Affairs newsletter arrived! Every week the best security articles from Security Affairs are free for you.
DarkReading
Charges against the ransomware gang member included damage to computers, conspiracy to commit fraud, and conspiracy to commit money laundering.
SecurityWeek
Yaroslav Vasinskyi was sentenced to 13 years and seven months in prison for his alleged role in the REvil ransomware operation.
Security Affairs
A Ukrainian national, a member of the REvil group, has been sentenced to more than 13 years in prison for his role in extortion activities.
Bleeping Computer
Yaroslav Vasinskyi, a Ukrainian national, was sentenced to 13 years and seven months in prison and ordered to pay $16 million in restitution for his involvement in the REvil ransomware operation.
The Hacker News
A Ukrainian hacker part of the notorious REvil gang has been sentenced to over 13 years for orchestrating 2,500+ attacks demanding $700M in crypto ran
Infosecurity News
A US court has sentenced a Ukrainian national to 13 years and seven months in prison for his role in over 2500 ransomware attacks using the REvil strain
The Record
Yaroslav Vasinskyi also was ordered to pay more than $16 million in restitution for his role in the REvil operation.
The DFIR Report
Key Takeaways In August 2023, we observed an intrusion that started with a phishing campaign using PrometheusTDS to distribute IcedID. IcedID dropped and executed a Cobalt Strike beacon, which was … Read More
Trend Micro
In this blog entry, we discuss Trend Micro's contributions to an Interpol-coordinated operation to help Brazilian and Spanish law enforcement agencies analyze malware samples of the Grandoreiro banking trojan.
DarkReading
Attackers are indiscriminately targeting VPNs from Cisco and several other vendors in what may be a reconnaissance effort, company says.
The Hacker News
FIN7, a notorious cybercrime group, is targeting the U.S. automotive industry with spear-phishing attacks.
The Record
BlackBerry researchers said they “found evidence that this attack was part of a wider campaign by FIN7” — a decade old group with ties to multiple ransomware strains.
The Record
Grigory Tsaregorodtsev was convicted of taking bribes from a group of hackers who traded in stolen U.S. credit card information.
CSO
Research highlights heightened threat actor interests in SAP systems, targeting poorly patched organizations.
The Cyber Express
A dark web actor has allegedly proposed the Telecom Argentina access sale for $100 on a hacking forum. According to
Ars Technica
Part of the reset involves AI-powered documentation search and call routing.
Cyber Security News
Law enforcement disrupted LockBit ransomware operations in February, seizing infrastructure and their website. Now its back.
Security Affairs
Acer Philippines disclosed a data breach after employee data was leaked by a threat actor on a hacking forum.
Bleeping Computer
Acer Philippines confirmed that employee data was stolen in an attack on a third-party vendor who manages the company's employee attendance data after a threat actor leaked the data on a hacking forum.
Bleeping Computer
The NSA and the Cybersecurity and Infrastructure Security Agency (CISA) have released five joint cybersecurity bulletins containing on best practices for securing a cloud environment.
The Hacker News
LockBit ransomware group resurfaces after law enforcement takedown, claims FBI 'hacked' their infrastructure and leaked information.
Security Affairs
The LockBit gang is back and set up a new infrastructure after the recent attempt by law enforcement to disrupt their operation.
DataBreaches
Only five days after an international law enforcement effort seized LockBit’s leak sites, 34 servers, and 14,400 rogue email accounts used to support...
Infosecurity News
Law enforcement agencies involved in Operation Cronos have announced they have been in contact with the LockBit kingpin aka LockbitSupp
The Record
Researchers said that “attacks against both servers and client machines are currently underway” as attackers attempt to exploit the critical vulnerability.
DarkReading
The most prolific ransomware group in recent years was on the decline at the time of its takedown, security researchers say.
SecurityWeek
The US is offering big rewards for information on LockBit cybercriminals as law enforcement claims to have identified some individuals.
The Record
The arrest announcement coincides with an international operation against the ransomware gang Lockbit, suggesting the move could be an attempt at PR by the Russian government.
Trend Micro
This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations.
Trend Micro
Trend and other private entities recently contributed to INTERPOL’s Operation Synergia, a global operation that successfully took down over 1,000 C&C servers and identified suspects related to phishing, banking malware, and ransomware activity.
The Record
Russian nationals Artur Sungatov and Ivan Kondratiev — an infamous hacker also known as Bassterlord — “are alleged to have joined in the global LockBit conspiracy," according to the Department of Justice.
Krebs on Security
U.S. and U.K. authorities have seized the darknet websites run by LockBit, a prolific and destructive ransomware group that has claimed more than 2,000 victims worldwide and extorted over $120 million in payments. Instead of listing data stolen from ransomware…
Bleeping Computer
The U.S. State Department is offering rewards of up to $10 million for information that could lead to the identification or location of ALPHV/Blackcat ransomware gang leaders.
The Hacker News
U.S. Department of State is offering up to $10 million for information on Hive ransomware operators.
Bleeping Computer
The U.S. State Department offers rewards of up to $10 million for information that could help locate, identify, or arrest members of the Hive ransomware gang.
Bleeping Computer
Governments struck back this week against members of ransomware operations, imposing sanctions on one threat actor and sentencing another to prison.
The Hacker News
Russian national Vladimir Dunaev sentenced to 5 years and 4 months for TrickBot malware involvement.
Krebs on Security
Authorities in Australia, the United Kingdom and the United States this week levied financial sanctions against a Russian man accused of stealing data on nearly 10 million customers of the Australian health insurance giant Medibank. 33-year-old Aleksandr Ermakov allegedly stole…
SC Magazine
Fortra recommends security teams patch critical CVE immediately. Security pros say hackers with even moderate skills can exploit bug.
Infosecurity News
As a critical infrastructure service for cybercriminals, bulletproof hosting should be tracked and blocked by defenders, Intel471 argued in a new blog post
SecurityWeek
US, UK and Australia announce sanctions against Alexander Ermakov for his role in the 2022 ransomware attack on healthcare insurer Medibank.
The Hacker News
Governments from Australia, the U.K., and the U.S. have imposed financial sanctions on a Russian hacker tied to Medibank attack, data of 9.7M exposed.
DarkReading
Aleksandr Ermakov, alongside other members of the REvil ransomware gang, are responsible for one of the biggest cyberattacks in Australia's history.
Security Affairs
The Australian government announced sanctions for a member of REvil ransomware group for the Medibank hack that occurred in 2022.
Bleeping Computer
The Australian government has announced sanctions for Aleksandr Gennadievich Ermakov, a Russian national considered responsible for the 2022 Medibank hack and a member of the REvil ransomware group.
Bleeping Computer
The Australian government has announced sanctions for Aleksandr Gennadievich Ermakov, a Russian national considered responsible for the 2022 Medibank hack and a member of the REvil ransomware group.
The Cyber Express
Australia has taken a historic step by publicly revealing and imposing cyber sanctions on a Russian hacker implicated in the
The Record
Aleksandr Ermakov allegedly participated in one of the largest ransomware attacks in Australian history, resulting in the compromise of nearly 10 million customer records from the health insurer.
DataBreaches
Heloise Vyas reports: The Australian government have cracked down on a Russian cybercriminal believed to behind a Medibank Private breach in 2022 which marked...
Security Affairs
Researchers and the Dutch Police released a decryptor for the Tortilla variant of the Babuk ransomware after the arrest of its operator.
Bleeping Computer
In 2023, we saw numerous law enforcement operations targeting cybercrime operations, including cryptocurrency scams, phishing attacks, credential theft, malware development, and ransomware attacks.
Security Affairs
The Cactus ransomware group claims to have hacked Coop, one of the largest retail and grocery providers in Sweden.
The Cyber Express
Microsoft has once again turned off the MSIX MS-app installer. This decision from Microsoft has come lately when multiple threat
Bleeping Computer
Microsoft has again disabled the MSIX ms-appinstaller protocol handler after multiple financially motivated threat groups abused it to infect Windows users with malware.
The Cyber Express
Tyson Foods, a prominent meat producer in the United States, has reportedly fallen prey to the Snatch Ransomware Group, signaling
The Cyber Express
As the year nears its end, the cybersecurity sector offers profound lessons through incidents like data breaches, leaks, and cyberattacks,
DarkReading
Microsoft and several others have reported seeing the noxious malware surfacing again in a campaign targeting the hospitality industry.
CyberScoop
Law enforcement seized the websites of the notorious Russian-speaking group before the criminals say they seized it back.
Bleeping Computer
An unsealed FBI search warrant revealed how law enforcement hijacked the ALPHV/BlackCat ransomware operations websites and seized the associated URLs.
Krebs on Security
The U.S. Federal Bureau of Investigation (FBI) disclosed today that it infiltrated the world's second most prolific ransomware gang, a Russia-based criminal group known as ALPHV and BlackCat. The FBI said it seized the gang's darknet website, and released a…
Bleeping Computer
The QakBot malware is once again being distributed in phishing campaigns after the botnet was disrupted by law enforcement over the summer.
The Cyber Express
The year 2023 stands as a pivotal moment in the ongoing evolution of cyber threats. Witnessing the emergence of new
CyberNews
Roblox's accounting firm Tipalti said it's investigating ransomware claims.
CyberNews
Tipalti breach allegedly expose Roblox and Twitch.
The Record
Research from blockchain security company Elliptic and Corvus Insurance tracks payments made to the Black Basta group since its apparent inception in early 2022.
Infosecurity News
Nitrogen serves as initial-access malware, using obfuscated Python libraries for stealth
CyberNews
Tyson Foods claimed by ransomware gang in a supposed cyberattack.
Bleeping Computer
The Lockbit ransomware attacks use publicly available exploits for the Citrix Bleed vulnerability (CVE-2023-4966) to breach the systems of large organizations, steal data, and encrypt files.
CyberNews
McLaren Health Care breach exposed millions of individuals' sensitive medical data.
Bleeping Computer
Veeam released hotfixes today to address four vulnerabilities in the company's Veeam ONE IT infrastructure monitoring and analytics platform, two of them critical.
The Record
Doctors’ Management Services — which provides medical billing and payer credentialing services — was attacked by the now-defunct GandCrab ransomware gang in April 2017. The settlement with HHS is the first for the agency over a ransomware attack.
ZDNet
The ransomware business is booming, and really anyone can be the next victim. Here's how to protect yourself and your organization from an attack. Too late for prevention? We'll show you what to do next.
The Record
The leak site of the prolific ransomware gang Ragnar Locker was replaced with a takedown notice from the FBI, Europol and several law enforcement agencies in Europe on Thursday.
The Record
Hackers are using a leaked toolkit used to create do-it-yourself versions of the popular LockBit ransomware, making it easy for even amateur cybercriminals to target common vulnerabilities.
The Record
The multibillion-dollar technology services firm CDW said it is investigating claims made by a ransomware gang that data was stolen during a cyberattack.
Infosecurity News
Cisco Talos found new evidence that Qakbot-affiliated actors were still distributing ransomware despite the August FBI takedown of the threat group
CSO
Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations
The Record
A new FBI white paper warns the gangs are increasingly using multiple ransomware strains in the same attacks and using destructive tools beyond encryption or theft.
DarkReading
Ransomware-as-a-service affiliate ShadowSyndicate is unusual for the size of its malicious infrastructure and the fact that it's distributing seven different ransomware strains.
Infosecurity News
The malware researchers' collective Vx-underground claimed that ALPHV/BlackCat was behind the attack against the casino giant
Bleeping Computer
Microsoft says an initial access broker known for working with ransomware groups has recently switched to Microsoft Teams phishing attacks to breach corporate networks.
Bleeping Computer
The USA and the United Kingdom have sanctioned eleven Russian nationals associated with the TrickBot and Conti ransomware cybercrime operations.
SecurityWeek
Industry professionals comment on the law enforcement operation targeting the Qakbot botnet and its implications.
Cyber Security News
More than 700,000 victim computers were infected by the Qakbot malware, which contributed to ransomware deployments and caused damage worth hundreds of millions of dollars.
Infosecurity News
With Operation Duck Hunt, the FBI took control of the botnet, allowed victims to uninstall the malware loader and seized $8.6m in cryptocurrency
CyberSecurity Dive
The botnet and malware had infected more than 700,000 computers worldwide and was linked to the abuse of OneNote files.
The Hacker News
Operation Duck Hunt takes down QakBot, a powerful Windows malware! Over 700,000 computers globally compromised. $8.6 Million in crypto seized.
Bleeping Computer
The FBI announced today the disruption of the Qakbot botnet in an international law enforcement operation that not only seized infrastructure but also uninstalled the malware from infected devices.
Bleeping Computer
Qakbot, one of the largest and longest-running botnets to date, was taken down following a multinational law enforcement operation spearheaded by the FBI and known as Operation 'Duck Hunt.'
The Record
FBI officials said the international action involved seizure of Qakbot's infrastructure as well as the remote removal of the related malware from victim computers.
DarkReading
Hive tells us a lot about ransomware-as-a-service trends and the best ways to defend against attacks.
DarkReading
Attackers use remote monitoring and management tools at MSPs to gain unfettered access to target networks.
The Record
The Monti hacker gang has resumed its operations after a two-month break, this time claiming to target legal and government entities with a fresh Linux-based ransomware variant.
Bleeping Computer
Ransomware gangs continue to prioritize targeting VMware ESXi servers, with almost every active ransomware gang creating custom Linux encryptors for this purpose.
Loading more articles....