Researchers reported a global spike in Magniber ransomware attacks targeting home users. Since July 20, one website received almost 720 submissions from infected users. Magniber was first discovered in 2017 and is believed to be a successor to Cerber ransomware.
This updated Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include observed tactics and techniques.
In March, researchers discovered Eldorado, a new ransomware-as-a-service (RaaS). A Russian-speaking representative of Eldorado posted on the RAMP forums to advertise the malicious program and recruit penetration testers to join the group. Eldorado appears to be standalone.
In recent years, Clop (Cl0p) has emerged as a prominent and successful ransomware group that targets commonly used file transfer software. They used social engineering, phishing, and more in one extensive campaign before going quiet for several months.
The NJCCIC previously reported on the ransomware attack against Change Healthcare, a large healthcare technology company. This cyberattack showcases the cascading ramifications of ransomware incidents, including financial impacts and risks of paying ransom demands.
The NJCCIC is receiving reports of ransomware incidents impacting private organizations and the public sector. Threat actors primarily targeted critical infrastructure and educational institutions, likely due to budgetary restraints, limited resources, among other reasons.
A ransomware attack impacting Change Healthcare, one of the largest healthcare technology companies in the US, shows the impacts of a cyberattack. The incident, which occurred on February 21, crippled pharmacies across the nation, including military pharmacies, etc.
Of nearly 70 leaked victims, the Healthcare and Public Health sector has been the most commonly victimized, likely in response to the ALPHV/BlackCat administrator’s post encouraging its affiliates to target hospitals after operational action against the group.
According to the Department of Homeland Security’s (DHS) 2024 Homeland Threat Assessment, ransomware remains a prominent threat to businesses, schools, and hospitals in the United States. More specifically, the public sector is a prime target.
Stealing data from victim networks prior to the encryption process provides cyber threat actors the means to apply additional pressure on victims to pay ransom demands in hopes of preventing their data from being publicly exposed, and is very effective.
