REvil Gang Members Sentenced
Read also: Global joint operation takes down RedLine and Meta malware infrastructure, a former Disney employee charged for hacking menus, and more.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Turn NIS2 into Your Cybersecurity Advantage
In this episode of CISO Conversations: EU Data Regulations, Richard Cassidy, EMEA Field CISO at Rubrik, is joined by Madeline Bennett, a Technology Journalist and Commentator, to discuss how to improve your cyber security ahead of the introduction of the European Commission's NIS2 Directive.
Bumblebee Malware, Lynx and INC Ransomware, MITRE Threat Group Scenarios, and More: Hacker's Playbook Threat Coverage Round-up: October 2024
In this version of the Hacker’s Playbook Threat Coverage round-up, we are highlighting attack coverage for several new threats. SafeBreach customers can select and run these attacks and more from the SafeBreach Hacker’s Playbook to ensure coverage against these advanced threats.
Turbocharge Cybersecurity with Detection and Response
Ransomware is on the rise, cyber insurance is hard to get, and employees are still clicking on things that they shouldn’t. Even as criminals make use of automated tools to unlock threat vectors, new AI-based detection and response solutions enable advanced techniques to find and eliminate lurking threats and turbocharge cybersecurity. Join WatchGuard experts for an eye-opening session on how AI is transforming MSP businesses, so they increase security efficacy, build trust with clients, and grow with detection and response innovation.
EMERALDWHALE: 15k Cloud Credentials Stolen in Operation Targeting Exposed Git Config Files
The Sysdig Threat Research Team (TRT) recently discovered a global operation, EMERALDWHALE, targeting exposed Git configurations resulting in more than 15,000 cloud service credentials stolen. This campaign used multiple private tools that abused multiple misconfigured web services, allowing attackers to steal credentials, clone private repositories, and extract cloud credentials from their source code. Credentials for over 10,000 private repositories were collected during the operation.
Best Tool to Prevent Ransomware from Clicked Links and IPs
Ransomware attacks are still one of the worst types of software. Ransomware usually gets into systems through malicious links or IP addresses that have been hacked, which users often click on without thinking. To stop this, businesses need the best tool to prevent ransomware from clicked links ips. These tools actively look for, find, and stop harmful links before they can send harmful payloads. This makes ransomware attacks much less likely.
Magecart Attacks: Prevention Tips and Security Best Practices
Kroll has investigated many different tactics that threat actors use to steal consumer data on e-commerce sites. These types of attacks can be especially damaging for organizations that are responsible for storing customers’ personal and financial information that is collected during transactions.
Can Generative AI Help Identify Malware and Phishing?
How Generative AI Can Help Identify Malware? Spambrella explains how AI models add value: Generative AI models can identify malware by learning the patterns and structures typical of malicious code versus benign software. Code Generation and Analysis – By generating variations of known malware, these models can simulate potential new forms of malware, helping cybersecurity teams anticipate and defend against unseen threats.
Quarantined Malware: Next Steps After Detection and Containment
Today's digital world is always at risk from malware, so it's more important than ever to have good safety habits. Most of the time, the first thing a company does when they find a disease is isolate the threat. This process comes up with the idea of "quarantined malware," which is malicious software that has been found and put somewhere else so it can't do more damage. For a company, this is a very important part of their security plan because it keeps systems safe from attacks.
The Rising Threat of Supply Chain Attacks
Richard Cassidy, EMEA Field CISO at Rubrik, is joined by Madeline Bennett, a Technology Journalist and Commentator, to discuss how supply chain attacks have become one of the top cybersecurity threats and why the NIS2 directive is crucial in addressing them.
The Need for Unwavering Security Controls
In the latest episode of CISO Conversations: EU Data Regulations, Richard Cassidy, EMEA Field CISO at Rubrik, is joined by Madeline Bennett, a Technology Journalist and Commentator, to discuss the essential security controls required to maintain cyber resilience.
Arctic Wolf Labs Observes Increased Fog and Akira Ransomware Activity Linked to SonicWall SSL VPN
In early August, Arctic Wolf Labs began observing a marked increase in Fog and Akira ransomware intrusions where initial access to victim environments involved the use of SonicWall SSL VPN accounts. Based on victimology data showing a variety of targeted industries and organization sizes, we assess that the intrusions are likely opportunistic, and the threat actors are not targeting a specific set of industries.
Need to Knows - EU NIS2 Directive
In this episode of CISO Conversations: EU Data Regulations, Richard Cassidy, EMEA Field CISO at Rubrik, is joined by Madeline Bennett, a Technology Journalist and Commentator, to discuss how to improve your cyber security ahead of the introduction of the European Commission's NIS2 Directive.
NotLockBit: Ransomware Discovery Serves As Wake-Up Call For Mac Users
Historically, Mac users haven't had to worry about malware as much as their Windows-using cousins. Although malware targeting Apple devices actually predates viruses written for PCs, and there have been some families of malware that have presented a significant threat for both operating systems (for instance, the Word macro viruses that hit computers hard from 1995 onwards), it is generally the case that you're simply a lot less likely to encounter malware on your Mac than you are on your Windows PC.
Defending Against Ransom DDoS Attacks
DDoS attacks have become an annoyance most companies assume they may have to deal with at some point. While frustrating, minor website disruptions from small-scale hacktivist campaigns rarely create substantial business impacts. However, a particularly insidious DDoS spinoff has emerged over the past decade – one aimed at blackmail. This evolutionary milestone stems from what's called Ransom DDoS (RDDoS), likely one of the most outrageous cybercrime weapons targeting businesses globally since 2015.
Ransomware Gang Attack Tactics Have Shifted
A recent analysis of the ransomware group Meow raises the notion that groups are evolving from using encryption as a tactic to more profitable and cost-effective methods. At the end of the day, ransomware is a business. Those behind the malware used in ransomware attacks typically seek to make money, whether that be directly from the victim organization or by way of a nation-state paying for the gang’s services.
Cloud security is more than protecting the perimeter-it's about safeguarding the data inside
#CloudSecurity #CyberSecurity #DataProtection #CloudComputing #CyberAwareness #InfoSec #Tech #IT #rubrik
Malware Article: Enhancing Incident Response and Threat Intelligence
Malware attacks have become an unfortunate reality for organizations of all sizes. Malicious software is always changing, which causes a lot of problems. This, along with the fact that hackers are getting smarter, has made it hard for security teams to keep up with threats. For organizations to successfully fight malware, they need to take a comprehensive and proactive approach. This plan should include both responding to incidents and gathering information about threats.
Brain Cipher Ransomware: A Growing Threat and How to Defend Your Business
In the always-changing world of online threats, ransomware attacks are getting trickier because bad people are always finding new ways to scam people. There is a new bug called Brain Cipher that is very dangerous. Brain Cipher ransomware is very bad. It can cost a company a lot of money, hurt its reputation, and make things not work right. Brain Cipher ransomware is cutting edge and dangerous. It has hurt companies all over the world a great deal.
GitHub Comments from Legitimate Repositories Exploited to Deliver Remcos RAT
One of the most interesting findings of our Netskope Threat Labs Report: Insurance 2024 was the discovery that GitHub is the most popular application in terms of malware downloads for this specific vertical, surpassing Microsoft OneDrive, which is usually the undisputed leader of this unwelcome chart.
Decoding Agent Tesla: The Spyware Stealing Data Silently!
Agent Tesla is an advanced piece of malware that functions as a keylogger and RAT (remote access trojan). The malware was first identified in 2014. They are crafted to infiltrate systems and seize sensitive information like usernames, passwords, and other private data mainly by logging keystrokes. This kind of spyware works secretly in the background, which is difficult to detect for the users.
Mastering Problem Solving in Engineering: Mindsets for Success
In today's rapidly evolving technological landscape, problem-solving skills are the cornerstone of success in the field of engineering. From debugging complex code to enhancing system performance and robustness, the ability to efficiently identify, analyze, and resolve issues is a hallmark of a proficient tech engineer. One company that exemplifies this ethos is Rubrik, known for its innovative cyber resilience solutions.
New Bumblebee Loader Infection Chain Signals Possible Resurgence
Bumblebee is a highly sophisticated downloader malware cybercriminals use to gain access to corporate networks and deliver other payloads such as Cobalt Strike beacons and ransomware. The Google Threat Analysis Group first discovered the malware in March 2022 and named it Bumblebee based on a User-Agent string it used. The Netskope Threat Labs team discovered what seems to be a new infection chain leading to Bumblebee malware infection, and our findings corroborate those shared by other researchers.
Ransomware Readiness: 10 Steps Every Organization Must Take
At the end of every year, the Trustwave content team asks its in-house experts what cybersecurity topics they predict will be top of mind in the coming 12 months, and inevitably the top answer is more ransomware. Instead of waiting an extra couple of months, we thought why not get ahead of the curve, pretend that ransomware will again be an issue, because it will, and proceed to the part of the story where we go through the problem and mitigation methods.
Glimmer Of Good News On The Ransomware Front As Encryption Rates Plummet
No-one would be bold enough to say that the ransomware problem is receding, but a newly-published report by Microsoft does deliver a slither of encouraging news amongst the gloom. And boy do we need some good news - amid reports that 389 US-based healthcare institutions were hit by ransomware last year - more than one every single day.
Addressing Cyber Risk and the Rise of AI
In this episode of CISO Conversations: EU Data Regulations, Pierre-François Guglielmi, EMEA Field CISO at Rubrik, is joined by Trish McGill, an Executive Subject Matter Expert for Cyber Security IT/OT at De Heus Voeders and Nobian, Brian Wagner, Chief Technology Officer at Revenir, and Tim Clements, Owner of Purpose and Means. Together, they explore the impact of cyber-attacks and data regulations on business resilience, particularly concerning critical infrastructure, and how these factors ultimately affect profits.
What Is Payloadless Malware?
This malicious tactic enables cybercriminals to sneak into an organization’s email network or other systems without the payloads typically associated with harmful software. The payloadless method leverages harder-to-detect malware delivery techniques and psychological manipulation to execute attacks. It reflects the ingenuity of threat actors and emphasizes the need for organizations to never stop revamping their security strategies.
Protect Your Business from Interlock Ransomware: Prevention and Detection Tips
At Foresiet, our mission is to help businesses stay informed about emerging cybersecurity risks. One of the latest and most dangerous threats is Interlock ransomware, a variant that has made waves on the dark web. This ransomware group claims to be more than just extortionists, positioning themselves as enforcers of accountability for companies that fail to adequately protect customer data and intellectual property.
Exfiltration over Telegram Bots: Skidding Infostealer Logs
In recent years, Telegram has emerged as a popular messaging platform among cybercriminals, driven by its combination of simplicity, security, and efficiency. Telegram's encrypted messaging capabilities, real-time communication, and the ability to send large data files make it an ideal platform for cybercriminal activities, making it an attractive alternative to traditional underground forums.
Designing a Comprehensive IT Strategy for Scalability and Security
In digitized business environments, resilient IT strategies empower organizations to innovate fearlessly through sustained agility and threat countermeasures, scaling operations seamlessly. Yet fragmented foundations invite catchup turmoil reactively behind market dynamics, securing continuity and trust sub-optimally.
New WatchGuard Threat Lab Report Finds Threat Actors Attempting to Turn Blockchains into Hosts of Malicious Content
Other key findings include surge of info-stealers and botnets, an increase in evasive malware and a rise in network attacks across the Asia Pacific.
AfterDarkMode Malware: What It Is and How to Mitigate the Risk
Now that AfterDarkMode malware is out there, internet threats are even more complicated and dangerous. That person who is sneaky and hard to catch has shown that they are motivated to get into systems and use weaknesses to their advantage. For businesses to be safe from the AfterDarkMode threat, they need to understand its plans, methods, and procedures and take steps to lower the risk. AfterDarkMode malware is a very advanced and sneaky threat that can take over computers without anyone noticing.
44% of U.S. Organizations Experienced One or More Ransomware Attacks in the Last Year
As ransomware becomes more pervasive, new data provides insight into how well organizations are responding and the attack vector being used most. We hear a lot about ransomware attacks, but I’m not seeing data about how well organizations fared, so I was glad to see GetApp’s 2024 Data Security report. According to the report, nearly half of U.S.
How to Execute a Secure M365 Copilot Deployment
Microsoft Copilot is a powerful AI assistant that can leverage Microsoft 365 (M365) data from across an organization to generate accurate and relevant insights. But some of that data should be under special lock: you do not want sensitive enterprise information to be used as part of a large language model (LLM). And the reality is that common misconfigurations—such as mislabeled files and overly broad user permissions—can lead to sensitive data exposure to unauthorized users.
Australia Considers Mandatory Reporting of Ransom Payments
New legislation is on the horizon in Australia that is set to change the way businesses deal with ransomware attacks. This law, not unlike the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) in the US, aims to improve transparency when it comes to paying ransoms. There's no question that cybercrime is on the rise in the country.
DFIR Bluesky Ransomware: Strategies for Incident Response and Threat Containment
When Bluesky ransomware first appeared, it caused a lot of trouble for businesses of all kinds. This sophisticated and dangerous threat actor has shown that they are determined to stop activities and get money by any means necessary. To mitigate the Bluesky danger, businesses need to take a thorough and proactive approach to handling incidents and keeping threats inside their borders.
Orchestrating Microsoft 365 Backup Storage with Rubrik Security Cloud
Rubrik's Integration with Microsoft 365 Backup Storage provides recovery for large volumes of OneDrive, SharePoint, and Exchange Online data at unprecedented speed and scale. Imagine delivering as low as 10 minute RPOs for your organization? This is reality with the new M365 Backup Storage Integration.
Data Security Monitoring for Azure
Get an in-depth look at how Rubrik provides both Anomaly Detection and Sensitive Data Monitoring for your Azure VMs and Managed Disks. Discover how to identify the blast radius, along with pinpointing sensitive data within your environment so you can efficiently recover from cyber threats. Learn more here: TK.
Why E-commerce Sites Need Server Antivirus Protection
Running an e-commerce business means you're handling a treasure trove of sensitive customer data, like personal details, payment information, and more. With 560,000 new instances of malware, including viruses, that are happening each day and financially costing the global economy billions each year it is worth taking into serious consideration as a business owner.
Ransomware Groups Report 2024 - Q3
Although 2024 began with a Q1 decline in the frequency of ransomware attacks, the second quarter was underscored by a return to a much more intimidating world of ransomware attacks globally, and the third quarter continues the trend of the second. In Q2 2024, the number of attacks stood at 1,277 cases, but Q3 saw a small decrease of 5.5% with 1209 cases.
Trinity Ransomware Targets the Healthcare Sector
The Trinity ransomware gang is launching double-extortion attacks against organizations in the healthcare sector, according to an advisory from the US Department of Health and Human Services (HHS). The ransomware gains initial access via phishing emails or software vulnerabilities. “Trinity ransomware was first seen around May 2024,” the advisory says.
New Capability: Safeguard Your Sensitive Cloud Data With Rubrik Data Protection Insights
According to Cybersecurity Ventures, more than half of the world’s data will be stored in the cloud by 2025. With this growth comes a new challenge: understanding where your cloud data lives, what it contains, and how to ensure it is properly protected. The mass storage capabilities of the cloud means it’s easy to drop data wherever you want. It’s also easy to forget to clean up that data or set up backups where that data is required.
The Rise and fall of Raccoon Infostealer: Inside a Global Cybercrime Operation
In the ever-evolving landscape of cybercrime, malware-as-a-service (MaaS) has emerged as a lucrative business for cybercriminals. One of the most notorious examples is Raccoon Infostealer, malware designed to harvest personal and financial information from unsuspecting victims worldwide. The mastermind behind this operation, a Ukrainian national named Mark Sokolovsky, recently pleaded guilty in a U.S. federal court to his role in the cybercrime network.
Cato CTRL Threat Research: ProKYC Selling Deepfake Tool for Account Fraud Attacks
Cato CTRL security researchers have recently discovered a threat actor, ProKYC, selling a deepfake tool in the cybercriminal underground that helps threat actors beat two-factor authentication (2FA) for conducting account fraud attacks. The tool being sold is customized to target cryptocurrency exchanges—specifically ones that authenticate new users leveraging a government-issued document and by enabling the computer’s camera to perform facial recognition.
SenseOn MDR vs. SocGholish: A Technical Analysis
In February of 2024, SenseOn was contacted to assist with investigating suspicious activity on a customer’s estate. SenseOn analysts quickly identified a malware infection and identified the variant as SocGholish. This blog will showcase SenseOn’s detection and response capabilities against the malware and a breakdown of SocGholish’s techniques and that of the threat actor observed.
Perspectives on New EU Data Regulations' Impact and Consequences for IT Leaders
If you look at your home already, you use so much that is connected to the Internet, you couldn't imagine being without it. The same applies to our critical infrastructure. A physical attack is no longer the only attack on critical infrastructure. But how can we defend it? Trish McGill, Brian Wagner, and Tim Clements have the answer.
Analyzing Latrodectus: The New Face of Malware Loaders
This report is the latest in a series that will delve into the deep research the Trustwave SpiderLabs Threat Intelligence team conducts daily on the major threat actor groups currently operating globally. The information gathered is part of a data repository that helps Trustwave SpiderLabs identify possible intrusions as it conducts threat hunts, vulnerability scans, and other offensive and defensive security tasks.
Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader
Trustwave's Threat Intelligence team has discovered a new malware dubbed Pronsis Loader, with its earliest known variant dating back to November 2023. This loader shares similarities with the D3F@ck Loader , which surfaced in January 2024. Pronsis Loader has been observed delivering different malware variants, including Lumma Stealer and Latrodectus as its primary payloads. Additionally, the team identified infrastructure linked to Lumma Stealer during the investigation.
What is Ransomware? #cybersecurityawarenessmonth
Payton the Forescout Intern gives a description of ransomware and its effects on today's organizations.
Stay Ahead of Ransomware: Comprehensive Solutions against DragonForce Attacks
In the ever-evolving landscape of cybersecurity threats, the DragonForce ransomware group has quickly become a serious menace to organizations worldwide. First discovered in August 2023, DragonForce has made headlines by leveraging two powerful ransomware variants—a fork of the infamous LockBit3.0 and a modified version of ContiV3.
Ransomware Defense Essentials: Why EDR and NDR Are Key
Increasingly targeted ransomware attacks, has cyber professionals on high alert securing their networks and understandably with a single attack being potentially such a massive loss (both in terms of finance, operational disruption as well as brand damage). A company that relies on its data to operate or grow should make setting in place a defense against ransomware a top priority. But we cannot take any protection measure without knowing what ransomware is all about.
The Results from Dreamforce are In: Salesforce Users Love Rubrik
Dreamforce 2024 once again proved to be a monumental event, with major AI advancements, product announcements, and keynotes that inspired the entire tech community. Among the highlights, Salesforce's introduction of Agentforce took center stage, offering businesses the ability to deploy autonomous AI agents that optimize customer interactions and streamline operations.
What Are Hardware and Software Keyloggers? How Can You Spot and Prevent Them?
In this video, learn what hardware and software keyloggers are, signs you may have one, how to prevent them, and more. Learn more about: Resources and social media: Transcript: Do you remember every key you pressed on your laptop today? Every word you typed in an email? Every password you punched in? Every digit you entered for your credit card? For you and me, recalling all that information is next to impossible. But not for a Keylogger.
Use these simple rules to detect common attacker tools
One of the most powerful weapons at an attacker’s disposal is the use of specialized tools designed to compromise network security. Mimikatz, BloodHound, and winPEAS are just a few examples of tools that can wreak havoc in your environment if left undetected. In this article, we’ll explore how malicious actors can exploit specialized tools to launch sophisticated attacks.
Embargo Ransomware Expands Attacks to Cloud Environments
Ransomware continues to evolve, and the latest escalation in tactics comes from the Embargo ransomware group. Threat actor Storm-0501, known for its previous ties to various ransomware groups, has now shifted its focus towards hybrid cloud environments, targeting both on-premise and cloud-based systems. This strategic shift poses significant risks for organizations relying on cloud infrastructure, particularly those in critical sectors such as healthcare, government, transportation, and law enforcement.
Infostealer Threat Group "Marko Polo" Evolving Into an "Empire"
New research by Recorded Future provides insight into how advanced and sophisticated the threat group Marko Polo has become since launching in 2022. Marko Polo is of particular interest due to their rapid progress in advancing their operations.
Understanding and Detecting Lateral Movement
A ransomware attack is underway. The threat actor has gained initial access to an endpoint and executed malicious code on it. As far as the threat actor is concerned, things are going well. However, the next stage is critical to a ransomware attack’s success. Without the ability to spread throughout the entire environment, encrypting or locking up all systems, threat actors are unlikely to be able to extort payment from an organization.
Global Police Effort Leads to Arrests Of LockBit, EvilCorp Affiliates
Read also: the US charges money launderers linked to Rescator and Joker’s Stash, a police op dismantles a cybercrime ring in West Africa, and more.
Tick Tock.. Operation Cronos Arrests More LockBit Ransomware Gang Suspects
International law enforcement agencies have scored another victory against the LockBit gang, with a series of arrests and the seizure of servers used within the notorious ransomware group's infrastructure. As Europol has detailed in a press release, international authorities have continued to work on "Operation Cronos", and now arrested four people, seized servers, and implemented sanctions against an affiliate of the ransomware group.
Must-Know Strategies for DORA Compliance
In this episode of CISO Conversations: EU Data Regulations, Richard Cassidy, EMEA Field CISO at Rubrik, is joined by Anna Delaney, Director of Productions at Information Security Media Group (ISMG), to explore why the Digital Operational Resilience Act (DORA) makes operational resilience a priority for financial services organizations. They discuss how DORA will impact your financial institution, how to best prepare for DORA and improve operational resilience, and how to increase oversight and accountability of third parties in the supply chain.
Is MEOW Ransomware Getting Its Claws Out?
MEOW ransomware is a significant cyber threat known for its disruptive activities. Unlike the infamous Conti ransomware, MEOW is a modified version that retains many of Conti’s core functionalities and encryption techniques.
Ransomware as a Business with Ken Westin from LimaCharlie
Ken Westin, Senior Solutions Engineer at LimaCharlie, joined us for Defender Fridays to discuss Ransomware as a Business. Join us every Friday as we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry.
Building a Cyber Resilient Healthcare System with Anahi Santiago, CISO at ChristianaCare
Welcome to the Data Security Decoded podcast, brought to you by Rubrik Zero Labs. In each installment, we discuss cybersecurity with thought leaders and industry experts, and get their take on trends, themes, and where they see the sector going next. This is a must-listen for security and IT leaders looking to better understand trends shaping data security and how they can achieve cyber resilience.
Organizational Resiliency in Healthcare: Preparing for System Downtime #shorts #healthcare
Building organizational resilience is critical in healthcare. But it's not just about preventing cyberattacks—it's about ensuring patient care continues even when systems go down. Practicing cyber resilience through well-defined downtime procedures and understanding the critical outcomes for patients is essential. As Anahi Santiago, Chief Information Security Officer at ChristianaCare, emphasizes, knowing the path to achieve these outcomes, even in a crisis, is key to maintaining high standards of care.