This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These advisories include recently and historically observed activity.

Recently, a vulnerability in SonicWall SonicOS management access and SSL VPN (CVE-2024-40766) was exploited in unpatched devices, leading to at least 30 intrusions by Fog and Akira ransomware. Research indicates possible infrastructure sharing between the two groups.

The United States Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (HC3) released this Threat Actor Profile regarding a relatively new threat actor identified as Trinity Ransomware. The analysis is focused on the Healthcare Sector...

Voldemort, a recently discovered backdoor, is spreading through a malware campaign that impersonates tax agencies. Beginning on August 5, the campaign sent over 20,000 messages to over 70 organizations worldwide. The daily malicious message count continues to rise.

This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. #StopRansomware advisories include information help organizations.

The FBI, CISA, and the Department of Defense Cyber Crime Center (DC3) released a Joint Cybersecurity Advisory to warn network defenders that, as of August 2024, a group of Iran- based cyber threat actors continues to exploit US and foreign organizations.

Ransomware remains a prevalent threat as threat actors use extortion tactics to pressure victim organizations to pay the ransom. They deny access to encrypted files, steal data, and threaten a data breach by posting on public ransomware leak sites or releasing the stolen data.

Recent ransomware attacks on OneBlood, Synnovis, and Octapharma by Russian cybercrime ransomware gangs have resulted in a massive disruption to patient care. On April 15, the BlackSuit ransomware group attacked blood plasma provider Octapharma.

Researchers reported a global spike in Magniber ransomware attacks targeting home users. Since July 20, one website received almost 720 submissions from infected users. Magniber was first discovered in 2017 and is believed to be a successor to Cerber ransomware.

This updated Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include observed tactics and techniques.