In March, researchers discovered Eldorado, a new ransomware-as-a-service (RaaS). A Russian-speaking representative of Eldorado posted on the RAMP forums to advertise the malicious program and recruit penetration testers to join the group. Eldorado appears to be standalone.

In recent years, Clop (Cl0p) has emerged as a prominent and successful ransomware group that targets commonly used file transfer software. They used social engineering, phishing, and more in one extensive campaign before going quiet for several months.

The NJCCIC is receiving reports of ransomware incidents impacting private organizations and the public sector. Threat actors primarily targeted critical infrastructure and educational institutions, likely due to budgetary restraints, limited resources, among other reasons.

A ransomware attack impacting Change Healthcare, one of the largest healthcare technology companies in the US, shows the impacts of a cyberattack. The incident, which occurred on February 21, crippled pharmacies across the nation, including military pharmacies, etc.

Of nearly 70 leaked victims, the Healthcare and Public Health sector has been the most commonly victimized, likely in response to the ALPHV/BlackCat administrator’s post encouraging its affiliates to target hospitals after operational action against the group.

According to the Department of Homeland Security’s (DHS) 2024 Homeland Threat Assessment, ransomware remains a prominent threat to businesses, schools, and hospitals in the United States. More specifically, the public sector is a prime target.

Stealing data from victim networks prior to the encryption process provides cyber threat actors the means to apply additional pressure on victims to pay ransom demands in hopes of preventing their data from being publicly exposed, and is very effective.