Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Operation Cronos: The Takedown of LockBit Ransomware Group

On February 20, 2024, the National Crime Agency (NCA) of Britain and the Federal Bureau of Investigation (FBI) announced the successful disruption of the Lockbit ransomware gang, marking a significant milestone in the fight against cybercrime. This operation, known as Operation Cronos, was a collaborative effort involving law enforcement agencies from the UK, the US, and several other countries, with support from private sector partners.

Operation Cronos: Global Law Enforcement Deals Significant Blow to LockBit Ransomware; Two Russian Nationals Indicted in the US

In a synchronized effort across multiple nations, law enforcement agencies have conducted a series of raids and arrests targeting those responsible for the LockBit ransomware attacks. Termed Operation Cronos, this initiative marks a notable victory in the ongoing battle against cybercrime. The LockBit ransomware group has been behind several high-profile cyber assaults, causing substantial financial harm and disruption to businesses and organizations globally.

Fetching data using the Rubrik Security Cloud PowerShell SDK

Already pulled down the Rubrik Security Cloud PowerShell SDK and wondering why you aren't seeing all of the fields you are used to? This video will walk you through the various methods of fetching data from the RSC platform using the SDK. You'll get a basic understanding of how the module is architected and the difference between the autogenerated core cmdlets and the handcrafted wrapper cmdlets that exist within the Rubrik Security Cloud PowerShell module.

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow won’t impact ransomware overall. As in the past, another group will pick up the slack, or LockBit itself will reform and get back into business.

Understanding and Responding to Ransomware

As cybercrime evolves, one avenue for attack has risen to prominence across the world: Ransomware. According to Arctic Wolf’s State of Cybersecurity 2023 Trends Report, 48% of organizations view ransomware as the top attack vector concern. A concern comes with just cause, as the Arctic Wolf Labs 2024 Threats Report showed 48.6% of incidents investigated by Arctic Wolf were ransomware attacks.

SSH-Snake: New Self-Modifying Worm Threatens Networks

The Sysdig Threat Research Team (TRT) discovered the malicious use of a new network mapping tool called SSH-Snake that was released on 4 January 2024. SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network. The worm automatically searches through known credential locations and shell history files to determine its next move. SSH-Snake is actively being used by threat actors in offensive operations.

Malvertising Campaign Spreads Phony Utility Bills

A widespread malvertising campaign is attempting to trick users into paying phony utility bills, according to researchers at Malwarebytes. “We discovered a prolific campaign of fraudulent ads shown to users via Google searches,” the researchers write. “To give an idea of scale, the number of ads we found exceeds what we have found in previous malvertising cases....The scam begins when a user searches for keywords related to their energy bill.

Only 7% of Organizations Can Restore Data Processes within 1-3 Days After a Ransomware Attack

New data on how organizations are able to respond to ransomware attacks also shows that paying a ransom is highly likely, despite having a policy of “Do Not Pay.” New research from security vendor Cohesity says organizations are overconfident in their ability to recover from a ransomware attack. According to the data: And even if you do have an outstanding recovery plan, when’s the last time you tested it?
Featured Post

Leveraging Threat Intelligence for Regulatory Compliance

The US Government recently announced that state-sponsored Chinese cyber group Volt Typhoon has compromised multiple critical infrastructure organisations' IT networks in the US and is preparing "disruptive or destructive cyber attacks" against communications, energy, transport, water and waste water systems. The announcement, which was supported by national cybersecurity agencies in Australia, Canada, UK, and New Zealand, is a sobering reminder that modern life relies on digital networks. From healthcare, banking, and socialising, to energy, water, local and national government - everything has a digital aspect.