Ransomware remains a prevalent threat as threat actors use extortion tactics to pressure victim organizations to pay the ransom. They deny access to encrypted files, steal data, and threaten a data breach by posting on public ransomware leak sites or releasing the stolen data.
Recent ransomware attacks on OneBlood, Synnovis, and Octapharma by Russian cybercrime ransomware gangs have resulted in a massive disruption to patient care. On April 15, the BlackSuit ransomware group attacked blood plasma provider Octapharma.
Researchers reported a global spike in Magniber ransomware attacks targeting home users. Since July 20, one website received almost 720 submissions from infected users. Magniber was first discovered in 2017 and is believed to be a successor to Cerber ransomware.
This updated Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include observed tactics and techniques.
In March, researchers discovered Eldorado, a new ransomware-as-a-service (RaaS). A Russian-speaking representative of Eldorado posted on the RAMP forums to advertise the malicious program and recruit penetration testers to join the group. Eldorado appears to be standalone.
In recent years, Clop (Cl0p) has emerged as a prominent and successful ransomware group that targets commonly used file transfer software. They used social engineering, phishing, and more in one extensive campaign before going quiet for several months.
The NJCCIC previously reported on the ransomware attack against Change Healthcare, a large healthcare technology company. This cyberattack showcases the cascading ramifications of ransomware incidents, including financial impacts and risks of paying ransom demands.
The NJCCIC is receiving reports of ransomware incidents impacting private organizations and the public sector. Threat actors primarily targeted critical infrastructure and educational institutions, likely due to budgetary restraints, limited resources, among other reasons.
A ransomware attack impacting Change Healthcare, one of the largest healthcare technology companies in the US, shows the impacts of a cyberattack. The incident, which occurred on February 21, crippled pharmacies across the nation, including military pharmacies, etc.
Of nearly 70 leaked victims, the Healthcare and Public Health sector has been the most commonly victimized, likely in response to the ALPHV/BlackCat administrator’s post encouraging its affiliates to target hospitals after operational action against the group.
