Ransomware remains a persistent and ever-evolving threat to businesses of all sizes and sectors. While the tactics, techniques, and procedures (TTPs) may vary, the end goal is often the same – a substantial payday. After months of silence, LockBit recently reemerged with an announcement.
This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed...
The Qilin ransomware group is exploiting two critical Fortinet vulnerabilities in recent attacks. The flaws, CVE-2024-55591 and CVE-2024-21762, allow threat actors to bypass authentication and remotely execute code . Despite previous exploitation of these vulnerabilities by various cyber...
This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed...
An emerging ransomware-as-a-service (RaaS) called FunkSec claimed over 80 victims in December alone, making it the most prolific threat actor that month. FunkSec uses recycled datasets from previous hacks and is likely made up of inexperienced hackers seeking recognition.
Ransomware attacks pose a significant threat year-round; however, they increase significantly during the busy holiday shopping season. Cybercriminals often prepare to launch disruptive cyberattacks targeting multiple sectors, hiding in networks and waiting for...
Ransomware continues to dominate the threat landscape, posing significant risks to organizations. The NJCCIC continues to receive reports of ransomware incidents impacting New Jersey private and public sector organizations, including educational institutions and local governments.
This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These advisories include recently and historically observed activity.
Recently, a vulnerability in SonicWall SonicOS management access and SSL VPN (CVE-2024-40766) was exploited in unpatched devices, leading to at least 30 intrusions by Fog and Akira ransomware. Research indicates possible infrastructure sharing between the two groups.
The United States Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (HC3) released this Threat Actor Profile regarding a relatively new threat actor identified as Trinity Ransomware. The analysis is focused on the Healthcare Sector...
