The Federal Bureau of Investigation (FBI) released this FBI Liaison Alert System (FLASH) to disseminate indicators of compromise (IOCs) and identified tactics, techniques, and procedures (TTPs) associated with the First VPN Service. The service has been active since approximately 2014.
The ransomware threat landscape has evolved greatly over the past few years. In most ransomware incidents, threat actors steal valuable data from victim networks during these operations. This data is then used to threaten victims of data exposure if ransom demands are not paid.
The NJCCIC observed an Anthem Blue Cross phishing campaign targeting New Jersey State employees. The sender’s display name includes Anthem Blue Cross, the target organization’s domain name, and “Eft Settlement.” However, the sender’s email address does not reference...
CISA is holding a Securing Systems Training Awareness webinar, Defend Against Ransomware Attacks, on Friday, March 6 at 11:00 AM ET. This webinar includes the following information and more: Common attack methods: Learn the definition of ransomware, a summary...
This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These advisories include recently and historically observed tactics, techniques, etc.
Ransomware remains a persistent and ever-evolving threat to businesses of all sizes and sectors. While the tactics, techniques, and procedures (TTPs) may vary, the end goal is often the same – a substantial payday. After months of silence, LockBit recently reemerged with an announcement.
This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed...
The Qilin ransomware group is exploiting two critical Fortinet vulnerabilities in recent attacks. The flaws, CVE-2024-55591 and CVE-2024-21762, allow threat actors to bypass authentication and remotely execute code . Despite previous exploitation of these vulnerabilities by various cyber...
This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed...
An emerging ransomware-as-a-service (RaaS) called FunkSec claimed over 80 victims in December alone, making it the most prolific threat actor that month. FunkSec uses recycled datasets from previous hacks and is likely made up of inexperienced hackers seeking recognition.
