Ransomware attacks pose a significant threat year-round; however, they increase significantly during the busy holiday shopping season. Cybercriminals often prepare to launch disruptive cyberattacks targeting multiple sectors, hiding in networks and waiting for...

Ransomware continues to dominate the threat landscape, posing significant risks to organizations. The NJCCIC continues to receive reports of ransomware incidents impacting New Jersey private and public sector organizations, including educational institutions and local governments.

This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These advisories include recently and historically observed activity.

Recently, a vulnerability in SonicWall SonicOS management access and SSL VPN (CVE-2024-40766) was exploited in unpatched devices, leading to at least 30 intrusions by Fog and Akira ransomware. Research indicates possible infrastructure sharing between the two groups.

The United States Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (HC3) released this Threat Actor Profile regarding a relatively new threat actor identified as Trinity Ransomware. The analysis is focused on the Healthcare Sector...

Voldemort, a recently discovered backdoor, is spreading through a malware campaign that impersonates tax agencies. Beginning on August 5, the campaign sent over 20,000 messages to over 70 organizations worldwide. The daily malicious message count continues to rise.

This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. #StopRansomware advisories include information help organizations.

The FBI, CISA, and the Department of Defense Cyber Crime Center (DC3) released a Joint Cybersecurity Advisory to warn network defenders that, as of August 2024, a group of Iran- based cyber threat actors continues to exploit US and foreign organizations.

Ransomware remains a prevalent threat as threat actors use extortion tactics to pressure victim organizations to pay the ransom. They deny access to encrypted files, steal data, and threaten a data breach by posting on public ransomware leak sites or releasing the stolen data.

Recent ransomware attacks on OneBlood, Synnovis, and Octapharma by Russian cybercrime ransomware gangs have resulted in a massive disruption to patient care. On April 15, the BlackSuit ransomware group attacked blood plasma provider Octapharma.