The Record
The agency responsible for monitoring financial sanctions in Britain has never detected an illicit payment to an entity embargoed under the country’s counter-ransomware regime, according to information obtained by Recorded Future News.
SecurityWeek
German steelmaking conglomerate Thyssenkrupp confirms one of its automotive units was disrupted by a ransomware attack.
Infosecurity News
Law enforcement agencies involved in Operation Cronos have announced they have been in contact with the LockBit kingpin aka LockbitSupp
The Cyber Express
ThreeAM ransomware group has struck again, this time targeting Abcor in Australia and MTM Robotics in the United States. The
The Cyber Express
Garon Products Inc. finds itself ensnared in the web of cybercrime as it becomes the latest target of the ThreeAM
The Hacker News
Faust, the untargeted ransomware variant, highlights the need for comprehensive protection.
Security Affairs
The Russian national malware developer Vladimir Dunaev was sentenced to more than 5 years in prison for his role in the TrickBot operation.
Infosecurity News
Ukraine’s security services said that the hacker targeted government websites and provided intelligence to Russia to carry out missile strikes
SecurityWeek
Vladimir Dunaev sentenced to 5 years in prison after admitting to participating in the development and distribution of the TrickBot malware.
Security Affairs
The 2023 RedSense report covers long-term observations we have made regarding intel trends and interconnectivity.
Bleeping Computer
Russian national Vladimir Dunaev has been sentenced to five years and four months in prison for his role in creating and distributing the Trickbot malware used in attacks against hospitals, companies, and individuals worldwide.
Cyber Security News
Security analysts at Intrinsic recently discovered ThreeAM (aka 3 AM, ThreeAMtime) ransomware which has been actively attacking small and medium companies.
The Cyber Express
The notorious Akira ransomware group has claimed two more victims, adding them to its list of Akira ransomware attacks. The
SecurityWeek
Vladimir Dunaev pleads guilty to his involvement in the development and deployment of the notorious TrickBot malware.
Infosecurity News
40-year-old was extradited from South Korea
Bleeping Computer
On Thursday, a Russian national pleaded guilty to charges related to his involvement in developing and deploying the Trickbot malware, which was used in attacks against hospitals, companies, and individuals in the United States and worldwide.
SecurityWeek
Aviram Azari, an Israeli man who made nearly $5 million from a hacking scheme, has been sentenced to 80 months in prison in the US.
SecurityWeek
Thomas McCormick, aka fubar, an administrator of the Darkode hacking forum, has been sentenced to 18 months in prison.
DarkReading
Woman is accused of assisting Russian oligarchs and ransomware affiliates with schemes to evade sanctions.
Bleeping Computer
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned Russian national Ekaterina Zhdanova for laundering millions in cryptocurrency for various individuals, including ransomware actors.
Infosecurity News
Zhdanova reportedly utilized cash, international money laundering associates and businesses fronts
The Hacker News
U.S. Treasury imposes sanctions on Russian woman for laundering virtual currency for elites and cybercriminal groups, including Ryuk ransomware.
The Record
According to the Office of Foreign Assets Control, Ekaterina Zhdanova worked to help other Russians evade sanctions imposed on the country’s financial system after the invasion of Ukraine.
CSO
Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations
Cyber Security News
A new Ransomware-as-a-service (RaaS) provider has been discovered by researchers, which notably uses multiple ransomware families and is found to have links with several ransomware attacks since July 2022.
DarkReading
Ransomware-as-a-service affiliate ShadowSyndicate is unusual for the size of its malicious infrastructure and the fact that it's distributing seven different ransomware strains.
The Hacker News
Cyber experts uncover a new threat: ShadowSyndicate. Explore their connections to ransomware and the latest findings from cybersecurity experts.
Bleeping Computer
Security researchers have identified infrastructure belonging to a threat actor now tracked as ShadowSyndicate, who likely deployed seven different ransomware families in attacks over the past year.
SecurityWeek
Russian hacker Dariy Pankov has pleaded guilty to computer fraud and now faces a maximum penalty of five years in federal prison.
The Hacker News
U.S. and U.K. governments have jointly imposed sanctions on 11 individuals connected to the Russia-based TrickBot cybercrime group.
Bleeping Computer
The USA and the United Kingdom have sanctioned eleven Russian nationals associated with the TrickBot and Conti ransomware cybercrime operations.
The Record
Eleven Russian nationals alleged to have been part of the criminal group operating the Trickbot malware and Conti ransomware schemes were sanctioned by authorities in the United States and United Kingdom.
The Hacker News
Russian threat actors suspected in cyber attack on South African power company using a new variant of the SystemBC malware called DroxiDat
The Record
An Iranian technology company is providing infrastructure services to ransomware gangs and an array of nation-state hackers, researchers have found.
SecurityWeek
Amir Golshan, of Los Angeles, pleaded guilty to perpetrating multiple cybercrime schemes using SIM swapping.
SecurityWeek
Olalekan Jacob Ponle, a Nigerian national living in the UAE, was sentenced to 8 years in a US prison for his role in an $8 million BEC scheme
Infosecurity News
VMware explained that 8Base employs a combination of encryption and “name-and-shame” tactics
Cyber Security News
Implementing a ransomware attack prevention plan can provide businesses with the necessary tools to protect your organisation.
The Hacker News
The infamous cybercrime syndicate FIN7 is back in business, launching their first ransomware campaign in years.
The Hacker News
U.S. authorities have seized 13 internet domains that offered DDoS-for-hire services to other criminal actors.
DarkReading
The ransomware gang has also started using the BatLoader dropper and SEO poisoning for initial access.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Abandoned Eval PHP WordPress plugin abused to backdoor websites CISA adds MinIO, PaperCut, and Chrome bugs […]
Security Affairs
Russian national Denis Mihaqlovic Dubnikov has been sentenced to time served for committing money laundering for the Ryuk ransomware operation. Russian national Denis Dubnikov (30) has been sentenced to time served for committing money laundering for the Ryuk ransomware group. The man was also ordered to pay $2,000 in restitution. On February 7, 2023, Dubnikov pleaded […]
Bleeping Computer
Ex-Conti ransomware members have teamed up with the FIN7 threat actors to distribute a new malware family named 'Domino' in attacks on corporate networks.
The Hacker News
Cybercriminal syndicates FIN7 and ex-Conti members have teamed up to launch Domino malware attacks.
Trend Micro
We examine three differently sized criminal groups to know how they compare to similarly sized legitimate businesses in terms of how they are organized. We also discuss how threat researchers can use their knowledge of the size and structure of a target criminal organization to aid their investigation.
Security Affairs
The infamous Emotet malware is back after a short hiatus, threat actors are spreading it via Microsoft OneNote email attachments. The Emotet malware returns after a three-month hiatus and threat actors are distributing it via Microsoft OneNote email attachments to avoid detection. The Emotet banking trojan has been active at least since 2014, the botnet is operated by a threat actor tracked […]
Bleeping Computer
A decryption tool for a modified version of the Conti ransomware could help hundreds of victims recover their files for free.
CSO
Akamai report highlights how widespread malware threats remain, noting the dangers of threats specific to DNS infrastructure.
Ars Technica
Quoting Herman Melville is only one of Emotet's latest innovations.
DarkReading
More than two years after a major takedown by law enforcement, the threat group is once again proving just how impervious it is against disruption attempts.
CSO
Study and prepare for these five threats and you will be well on your way to protecting your network, assets, and employees.
CSO
Study and prepare for these five threats and you will be well on your way to protecting your network, assets, and employees.
DarkReading
New research shows that 57 vulnerabilities that threat actors are currently using in ransomware attacks enable everything from initial access to data theft.
The Record
Deputy Attorney General Lisa Monaco said the feds will continue to use sanctions and hacking operations as tools against ransomware groups.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here. Clop ransomware claims the hack of 130 orgs using GoAnywhere MFT flaw CISA adds Fortra […]
Bleeping Computer
From ongoing attacks targeting ESXi servers to sanctions on Conti/TrickBot members, it has been quite a busy week regarding ransomware.
Security Affairs
North Korea-linked APT groups conduct ransomware attacks against healthcare and critical infrastructure facilities to fund its activities. Ransomware attacks on critical infrastructure conducted by North Korea-linked hacker groups are used by the government of Pyongyang to fund its malicious cyber operations, U.S. and South Korean agencies warn. US CISA published a Cybersecurity Advisory (CSA) to […]
Bleeping Computer
A new cybersecurity advisory from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) describes recently observed tactics, techniques, and procedures (TTPs) observed with North Korean ransomware operations against public health and other critical infrastructure sectors.
The Hacker News
Seven Russian nationals have been sanctioned by the governments of the United Kingdom and the United States for their involvement in the TrickBot.
The Record
When North Korea collects ransoms from healthcare facilities, the money could be funding operations against bigger targets, an advisory said.
Security Affairs
The US and the UK have sanctioned seven Russian individuals for their involvement in the TrickBot operations. The US and the UK authorities have sanctioned seven Russian individuals for their involvement in the TrickBot operations. The US Treasury has frozen the assets belonging to the individuals and imposed travel bans against them. The US Treasury […]
DataBreaches
Lawrence Abrams reports: The United States and the United Kingdom have sanctioned seven Russian individuals for their involvement in the TrickBot cybercrime...
Bleeping Computer
The United States and the United Kingdom have sanctioned seven Russian individuals for their involvement in the TrickBot cybercrime group, whose malware was used to support attacks by the Conti and Ryuk ransomware operation.
Infosecurity News
The seven Russian nationals are members of the notorious Trickbot malware gang
The Record
The sanctions documents formally link the Conti and Ryuk ransomware gangs and the Trickbot banking trojan to a single criminal organization.
CSO
Seven cybercriminals linked to the Trickbot ransomware group have been sanctioned to travel bans, asset freezes, and are severely restricted in their use of the global financial system.
Security Affairs
A Russian national pleaded guilty in the U.S. to money laundering charges linked to the Ryuk ransomware operation. On February 7, 2023, Russian national Denis Mihaqlovic Dubnikov (30) pleaded guilty in the U.S. to one count of conspiracy to commit money laundering for the Ryuk ransomware operation. Denis Mihaqlovic Dubnikov, 30, was arrested in Amsterdam in November […]
The Hacker News
A Russian national pleaded guilty to money laundering and attempting to conceal funds obtained from Ryuk ransomware attacks.
Bleeping Computer
Russian citizen Denis Mihaqlovic Dubnikov pleaded guilty on Tuesday to laundering money for the notorious Ryuk ransomware group for over three years.
Trend Micro
In this blog entry, we’d like to highlight our findings on Vice Society, which includes an end-to-end infection diagram that we were able to create using Trend Micro internal telemetry.
The Record
Revenues brought in from ransomware attacks fell from $765.6 million in 2021 to $456.8 million in 2022, according to Chainalysis.
CSO
Abusing variants of legitimate penetration testing tools has become a standard tactic for many attackers seeking to fool security teams. Cobalt Strike is among the attack frameworks used by red teams and cyber specialists should be on the lookout for cybercriminals seeking to exploit it.
Trend Micro
This blog entry looks at the characteristics of a new WannaRen ransomware variant, which we named Life ransomware after its encryption extension.
Security Affairs
The Emotet malware is back and experts warn of a high-volume malspam campaign delivering payloads like IcedID and Bumblebee. Proofpoint researchers warn of the return of the Emotet malware, in early November the experts observed a high-volume malspam campaign delivering payloads like IcedID and Bumblebee. The Emotet banking trojan has been active at least since 2014, the botnet is […]
SecurityWeek
A 33-year-old Russian national has been arrested in Canada over his role in LockBit ransomware attacks against critical infrastructure and major industrial groups worldwide.
DarkReading
Several artifacts from recent attacks strongly suggest a connection between the two operations, researchers say.
SecurityWeek
A new report from the P20 group has published recommendations on how to tackle the money mule aspect of illicit money laundering by using AI-based detection systems
Security Affairs
Threat actors behind the Emotet bot are continually improving their tactics, techniques, and procedures to avoid detection. VMware researchers have analyzed the supply chain behind the Emotet malware reporting that its operators are continually shifting their tactics, techniques, and procedures to avoid detection. The Emotet banking trojan has been active at least since 2014, the botnet is operated by […]
Bleeping Computer
The BazarCall malicious operation has evolved its social engineering methods, keeping the old fake charges lure for the first phase of the attack but then switching to pretending to help the victim deal with an infection or hack.
DarkReading
The previously identified ransomware builder has veered in an entirely new direction, targeting consumers and business of all sizes by exploiting known CVEs through brute-forced and/or stolen SSH keys.
Bleeping Computer
Romanian cybersecurity firm Bitdefender has released a free decryptor to help LockerGoga ransomware victims recover their files without paying a ransom.
DarkReading
The initial access broker (IAB) for ransomware gangs known as UAC-0098 has targeted Ukrainian organizations in five separate phishing campaigns spanning April to August.
CyberScoop
More than half of the respondents to a health care cybersecurity survey say their organizations suffered a ransomware attack in the past year.
Bleeping Computer
Google says some former Conti cybercrime gang members, now part of a threat group tracked as UAC-0098, are targeting Ukrainian organizations and European non-governmental organizations (NGOs).
Bleeping Computer
Google says some former Conti ransomware gang members, now part of a threat group tracked as UAC-0098, are targeting Ukrainian organizations and European non-governmental organizations (NGOs).
DarkReading
Microsoft and others say they have observed nation-state actors, ransomware purveyors, and assorted cybercriminals pivoting to an open source attack-emulation tool in recent campaigns.
The Hacker News
Nation-state threat actors are increasingly adopting and integrating the Sliver command-and-control (C2) framework into their intrusion campaigns.
Bleeping Computer
Threat actors are dumping the Cobalt Strike penetration testing suite in favor of similar frameworks that are less known. After Brute Ratel, the open-source, cross-platform kit called Sliver is becoming an attractive alternative.
Bleeping Computer
Threat actors are dumping the Cobalt Strike penetration testing suite in favor of similar frameworks that are less known. After Brute Ratel, the open-source, cross-platform kit called Sliver is becoming an attractive alternative.
Bleeping Computer
Bringing you the latest ransomware news, including new research, tactics, and cyberattacks. We also saw the return of the BlackByte ransomware operation, who has started to use new extortion tactics.
DarkReading
Version 2.0 of the ransomware group's operation borrows extortion tactics from the LockBit 3.0 group.
SecurityWeek
A 29-year-old Russian man has been extradited from the Netherlands to the US for allegedly laundering cryptocurrency obtained as a result of Ryuk ransomware attacks.
Infosecurity News
Man allegedly handled over $400,000 in Ryuk proceeds
CyberNews
Man accused of cleaning $400,000 in cryptocurrency for Ryuk ransomware gang, now known as Conti.
The Hacker News
U.S. State Department on Thursday announced a $10 million reward for information related to five individuals associated with the Conti ransomware.
Infosecurity News
State Department offers $10m reward for info on notorious group
Security Affairs
The Conti ransomware gang is using BazarCall phishing attacks as an initial attack vector to access targeted networks. BazarCall attack, aka call back phishing, is an attack vector that utilizes targeted phishing methodology and was first used by the Ryuk ransomware gang in 2020/2021. The BazarCall attack chain is composed of the following stages: Stage […]
Bleeping Computer
The U.S. State Department announced a $10 million reward today for information on five high-ranking Conti ransomware members, including showing the face of one of the members for the first time.
The Hacker News
A trio of offshoots of Conti cybercrime gang have resorted to "BazarCall" phishing attacks as an initial entry point.
Loading more articles....