Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

August 2024

foresiet

BlackByte Ransomware Exploits VMware ESXi Vulnerability: A Critical Update

Aug 30, 2024 By Foresiet In Foresiet
In a troubling development for cybersecurity, the BlackByte ransomware group has shifted tactics by exploiting a newly discovered authentication bypass vulnerability in VMware ESXi, tracked as CVE-2024-37085. This vulnerability has allowed attackers to compromise critical infrastructure within enterprise networks, highlighting a significant shift in the threat landscape.
Read Post

The Impact of Cyber Events on Patient Care

Aug 30, 2024 By Rubrik In Rubrik
Welcome to the Data Security Decoded podcast, brought to you by Rubrik Zero Labs. In each installment, we discuss cybersecurity with thought leaders and industry experts, and get their take on trends, themes, and where they see the sector going next. This is a must-listen for organizations and individuals looking to secure their data and achieve cyber resilience. We're excited to kick off a series of special episodes featuring highlights from the recent Rubrik Zero Labs Virtual Summit. This series offers a unique look into the critical conversations happening around data security.
View Video
knowbe4

U.S. Experiences 52% Increase in the Number of Ransomware Attacks in One Year

Aug 30, 2024 By Stu Sjouwerman In KnowBe4
New analysis of current ransomware attacks shows a massive focus on U.S. organizations, with growth spread across nearly every industry. One would think there would be a slowdown in the number of ransomware attacks due to the amount of threat intelligence and best practices to mitigate this threat.
Read Post
knowbe4

Nearly Half of Mid-Market and Enterprise Organizations Have Experienced Four or More Ransomware Attacks in the Last Year

Aug 30, 2024 By Stu Sjouwerman In KnowBe4
New data exposes the reality of ransomware attacks today, including their frequency, impact, ransom payment – and the involvement of human error. It’s readily evident that ransomware is only growing as a threat. But a new infographic from ERP Cybersecurity vendor Onapsis covering the state of ransomware provides some context on just how critical the threat is right now: The most shocking stat is that in 81% of attacks, human error was involved in the successful execution of the ransomware.
Read Post
netwrix

How to Prevent Malware Attacks from Impacting Your Business

Aug 30, 2024 By Dirk Schrader In Netwrix
A robust malware prevention and detection strategy is critical to cyber security and cyber resilience today. After all, a single malware infection can inflict serious financial damage — from business disruptions and remediation costs to lasting reputational damage and customer churn. To help, this blog explains the types of malware organizations need to defend against and the common vectors for deployment.
Read Post
safebreach

US CERT Alert AA24-242A (RansomHub Ransomware)

Aug 30, 2024 By Kaustubh Jagtap In SafeBreach
On August 29, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Defense Cyber Crime Center (DC3) issued an urgent advisory warning security teams about known RansomHub ransomware IOCs and TTPs identified through FBI threat response activities and third-party reporting as recently as August 2024. Detailed information about this threat and the associated IOCs and TTPs can be seen in the advisory #StopRansomware: RansomHub Ransomware.
Read Post
foresiet

Meduza Stealer: Detailed Analysis of its Features, Capabilities, and Recent Updates on Active C2

Aug 30, 2024 By Foresiet In Foresiet
The Meduza Stealer, a malware designed for comprehensive data theft, first appeared on dark web forums on June 12, 2023. It was introduced by a mysterious actor known only as 'Meduza,' with prices ranging from $199 to $1199. Since its emergence, it has gained attention across cybercriminal communities for its potent capabilities.
Read Post
knowbe4

Fewer, High-Profile Ransomware Attacks Are Yielding Higher Ransoms

Aug 29, 2024 By Stu Sjouwerman In KnowBe4
Analysis of cryptocurrency payments made on the blockchain highlights shifts in the size and frequency of ransomware attacks and may paint a bleak picture for the remainder of the year. Each quarter, blockchain analysis company, Chainalysis, analyzes cybercriminal activity from the perspective of blockchain use to facilitate payments, crypto theft, etc.
Read Post
netskope

Latrodectus Rapid Evolution Continues With Latest New Payload Features

Aug 29, 2024 By Leandro Fróes In Netskope
Latrodectus is a downloader first discovered by Walmart back in October of 2023. The malware became very famous due to its similarities with the famous IcedID malware, not only in the code itself but also the infrastructure, as previously reported by Proofpoint and Team Cymru S2. The malware is usually delivered via email spam campaigns conducted by two specific threat actors: TA577 and TA578.
Read Post
Rubrik

Rubrik and Cisco to Safeguard Data Against Cyberattacks

Aug 29, 2024 By Ghazal Asif In Rubrik
A Rubrik Zero Labs report found that 66% of IT and security leaders report that data growth outpaces their ability to secure data and mitigate risk. Adversaries are noticing, increasing the sophistication of cyberattacks, and leveraging gaps in coverage to target critical data for destruction, theft, or extortion. As the volume of data continues to grow and exacerbate visibility challenges, organizations must find ways to manage and protect their constantly expanding data.
Read Post
foresiet

Tickler Malware: APT33's Latest Cyber Weapon Targets U.S. Government and Defense Sectors

Aug 29, 2024 By Foresiet In Foresiet
In a recent cybersecurity alert, the infamous Iranian hacking group APT33 (also known as Peach Sandstorm and Refined Kitten) has unleashed a new form of malware named "Tickler" to compromise the networks of various organizations across critical sectors in the United States and the United Arab Emirates. This latest campaign, observed between April and July 2024, has primarily targeted government, defense, satellite, and oil and gas industries.
Read Post
keeper

How To Tell if There Is Spyware on Your Laptop

Aug 29, 2024 By Ashley D'Andrea In Keeper
Spyware is a type of malware that can be installed on your device without your knowledge. The main goal of spyware is to spy on you and gather your private information, like passwords or credit card information. Despite spyware being elusive and undetectable at times, you can tell if there is spyware on your laptop by recognizing common signs. Some of these signs include unwanted pop-up ads, slower performance, shorter battery life and redirections on your browser.
Read Post
Rubrik

Three Misconceptions About Dealing with a Global IT Outage

Aug 28, 2024 By Michael Oglesby In Rubrik
The events of Friday the 19th 2024 had a profound impact on organizations around the globe. I suppose a widespread global IT outage has a way of clarifying the mind—and IT leaders are recognizing that resilience is crucial for maintaining operations for their consumers, customers, staff, partners, and shareholders. But much of the post-mortem analysis seems to be misunderstanding key lessons from the outage.
Read Post
keeper

Types of Spyware

Aug 28, 2024 By Ashley D'Andrea In Keeper
There are several different types of spyware, such as adware, stalkerware and keyloggers. No matter what kind of spyware is installed on your device, it is frightening to have your privacy invaded and sensitive information stolen by cybercriminals. Read more to learn what spyware is, the different types of spyware and how to protect your devices from spyware.
Read Post
bluevoyant

BlueVoyant Identifies Credential Harvesting Campaign Targeting the Manufacturing Sector

Aug 28, 2024 By BlueVoyant Threat Fusion Cell In BlueVoyant
BlueVoyant’s Threat Fusion Cell (TFC) uncovered a focused campaign targeting the advanced manufacturing sector. This campaign aims to steal Microsoft credentials, by spoofing Microsoft’s login page, to phish for potentially compromising sensitive information.
Read Post
keeper

How Do I Know if I Have Spyware?

Aug 27, 2024 By Ashley D'Andrea In Keeper
You can tell if you have spyware on your device by looking for signs such as your device’s battery draining quickly, overheating, increased pop-ups or data usage and unfamiliar apps. Spyware is a kind of malware that, once unknowingly installed on your device, allows cybercriminals to spy on you and steal your private information. This information could be used by cybercriminals or sold on the dark web to commit fraud or identity theft.
Read Post
knowbe4

Ransomware Recovery Costs Have Doubled for State and Local Governments

Aug 27, 2024 By Stu Sjouwerman In KnowBe4
Thirty-four percent of state and local government entities were hit by ransomware in 2024, a new report from Sophos has found. While this is a decrease compared to the attack rate in 2023, the mean cost of recovery for these entities has more than doubled to $2.83 million. Seventy-two percent of ransom demands made to state and local government organizations in 2024 were for $1 million or more, with 37% of demands for $5 million or more.
Read Post
tripwire

Global Cyber Insurance Premiums Decline Despite Ransomware Surge

Aug 26, 2024 By Josh Breaker-Rolfe In Tripwire
Cyber insurance has a strange past: AIG first took cyber insurance to market in 1997 despite a total lack of actuarial data to inform premiums or policies. Essentially, the industry ran on guesswork. Even today, the cyber insurance market is remarkably unpredictable compared to long-established insurance policies such as those for housing or health.
Read Post
cato networks

Cato CTRL Threat Actor Profile: Yashechka

Aug 26, 2024 By Etay Maor In Cato Networks
To further raise awareness on threat actor activity in the dark web and hacking communities, today we are introducing the Cato CTRL Threat Actor Profile. This will be a blog series that profiles various threat actors and documents notable activity that we are observing. Our inaugural Cato CTRL Threat Actor Profile is on Yashechka.
Read Post
keeper

How To Mitigate the Risk of Ransomware Attacks

Aug 26, 2024 By Ashley D'Andrea In Keeper
You can mitigate the risk of ransomware attacks by regularly backing up your data, updating your device with the latest software, implementing least-privilege access, using a business password manager and educating employees about security awareness, among other things. Ransomware attacks occur when organizations are prevented from accessing files and data until they’ve paid a ransom to the cybercriminal who infected their devices with malware.
Read Post
foresiet

Advanced Android Malware Targets NFC Data for ATM Cashouts

Aug 23, 2024 By Foresiet In Foresiet
A new strain of Android malware has emerged, targeting victims' card details and utilizing near-field communication (NFC) technology to facilitate unauthorized ATM withdrawals. This sophisticated crimeware, active since March 2024, has already impacted customers of three major Czech banks.
Read Post
splunk

Common Ransomware Attack Types

Aug 22, 2024 By Guest In Splunk
When it comes to cybersecurity, ransomware is probably one of the first threats you think of. It seems like it’s everywhere — and it is. Ransomware is one of the most notorious cyber threats affecting individuals, businesses, and organizations globally. The frequency and impact of these attacks have surged in recent years, making it crucial to understand their nature and how to protect against them.
Read Post
Rubrik

Secure Databases at the Point of Data: Rubrik Support for Oracle Databases on Windows Is Now Available

Aug 22, 2024 By Justin Ruiz In Rubrik
In today's data-driven world, protecting critical business information is paramount. We're excited to announce that Rubrik support for Oracle Databases on Windows is now available. This added support enables customers to bring Rubrik Security Cloud to even more of their mission-critical Oracle environments, providing a comprehensive, efficient, and reliable data protection solution for enterprises of all sizes.
Read Post
Rubrik

Operationalizing Data Security Posture Management

Aug 21, 2024 By Filip Verloy In Rubrik
Operationalizing any new security platform begins with the process of integrating the platform with an organization’s existing infrastructure and workflows. To get the most value out of the system we need to offer an easy path to adoption if we want to crossover from theoretical security concepts into practical, day-to-day operations that protect against cyber threats. Technology change is hard, but changing the way people work is even harder.
Read Post
kroll

FOG Ransomware Targets Higher Education

Aug 20, 2024 By Kroll In Kroll
In Q2 2024, the Kroll Cyber Threat Intelligence (CTI) Team observed an increase in activity around a new ransomware group named FOG. FOG was initially observed in May 2024, and since then has been heavily targeting higher educational institutions in the U.S. by exploiting compromised VPN credentials. Kroll's review of a recent FOG binary (1.exe) found no exfiltration or persistence mechanisms directly integrated.
Read Post
Rubrik

Another Case for Cyber Resilience: A Large-Scale Extortion Campaign and Best Practices for Data Security in the Cloud

Aug 20, 2024 By Drew Russell In Rubrik
Recently, a widespread cloud extortion operation—affecting 110,000 domains and involving significant financial demands—was uncovered. Unit 42, the cybersecurity research division of Palo Alto Networks, released a report this month detailing how threat actors exploited misconfigured.env files to gain unauthorized access, steal sensitive data, and demand ransoms after deleting cloud assets.
Read Post

Salesforce Data Protection with Rubrik Security Cloud

Aug 19, 2024 By Rubrik In Rubrik
In this demo, we will walk through Rubrik Data Protection for Salesforce. Rubrik ensures that your Salesforce data, the backbone of your revenue projections, customer service, and strategic planning, remains secure and accessible. With automated, seamless backups and rapid recovery, Rubrik takes the stress out of data management. You'll know exactly what data was affected and recover it quickly, minimizing downtime.
View Video
Rubrik

Rubrik Introduces Data Protection for Salesforce

Aug 19, 2024 By Anneka Gupta In Rubrik
According to Gartner, by 2028, 75% of enterprises will prioritize backup of SaaS applications as a critical requirement, compared with 15% in 2024. Many of the largest organizations in the world rely on Salesforce as their CRM app that powers their business operations, helping them drive revenue faster.
Read Post
knowbe4

Ransomware Group Known as 'Royal' Rebrands as BlackSuit and Is Leveraging New Attack Methods

Aug 19, 2024 By Stu Sjouwerman In KnowBe4
The ransomware threat group formerly known as "Royal" has rebranded itself as BlackSuit and updated their attack methods, warns the FBI. The latest advisory from the FBI on ransomware threat group BlackSuit, is actually an updated 18-month-old advisory originally released to warn organizations about the threat group Royal. It appears that the group has rebranded, according to the advisory, and has updated their methods of attack.
Read Post
knowbe4

The Long Road to Recovery Following a Ransomware Attack

Aug 19, 2024 By Javvad Malik In KnowBe4
When it comes to the duration of a ransomware attack and the subsequent recovery process, the numbers are staggering and vary wildly. Partly because there’s no single source which compiles all the information in a consistent manner. On average, a cyber attack can last anywhere from a few days to several weeks, with the recovery time often extending to months or even years.
Read Post
foresiet

X-FILES Infostealer: Unraveling a Potent Threat to Global Cybersecurity

Aug 16, 2024 By Foresiet In Foresiet
In the dynamic world of cyber threats, the X-FILES stealer has emerged as a particularly dangerous and sophisticated piece of malware. First discovered in March 2021, this malware gained significant attention after a second variant surfaced later that year. Known for its efficiency in targeting vulnerable systems globally, X-FILES has become a top priority for cybersecurity professionals.
Read Post
knowbe4

Ransomware Payments Decline While Data Exfiltration Payments Are On The Rise

Aug 15, 2024 By Stu Sjouwerman In KnowBe4
The latest data from Coveware shows a slowing of attack efficacy, a decrease in ransom payments being made, and a shift in initial access tactics. According to Coveware’s Q2 2024 Ransomware Quarterly Report, we see a few interesting trends: A new data point brought to light this quarter is the data exfiltration only (DXF) payment trend, which is relatively flat despite fluctuating between 53% in Q1 of 2022 when tracking began, down to a low of 23% in Q1 of this year.
Read Post
foresiet

FBI and International Partners Dismantle Dispossessor Ransomware Operation

Aug 14, 2024 By Foresiet In Foresiet
In a major breakthrough against cybercrime, the FBI, in collaboration with international partners, successfully disrupted the Dispossessor ransomware operation, seizing its servers and websites. This operation, which involved agencies from the United States, the United Kingdom, and Germany, marks a significant step forward in the global fight against ransomware.
Read Post
tripwire

Ransomware Kingpin Who Called Himself "J P Morgan" Extradited to the United States

Aug 14, 2024 By Graham Cluley In Tripwire
An investigation dating back almost ten years has seen the extradition this week to the United States of a man suspected to be the head of one the world's most prolific Russian-speaking cybercriminal gangs. The UK's National Crime Agency (NCA) says it has been investigating a cybercriminal using the online handle "J P Morgan" since 2015, alongside parallel investigations run by the United States FBI and Secret Service.
Read Post
cyberint

RansomHub: The New Kid on the Block to Know

Aug 13, 2024 By Adi Bleih In Cyberint
The ransomware group – RansomHub – has emerged as a significant player in the ransomware landscape, making bold claims and substantiating them with data leaks. It emerged after the Federal Bureau of Investigation (FBI) disrupted ALPHV’s ransomware operation on December 19, 2023. There are assumptions that RansomHub is the “spiritual successor” of ALPHV group that operates with the help of former ALPHV affiliates.
Read Post
knowbe4

Chameleon Malware Poses as CRM App

Aug 13, 2024 By Stu Sjouwerman In KnowBe4
Researchers at ThreatFabric warn that a phishing campaign is distributing the Chameleon Android malware by impersonating a Customer Relationship Management (CRM) app. The campaign is currently targeting users in Canada and Europe, but may expand to other regions. “The naming used for the dropper and the payloads clearly shows that the intended victims of the campaign are hospitality workers and potentially B2C business employees in general,” ThreatFabric says.
Read Post
keeper

Double Extortion Ransomware: What It Is and How To Avoid It

Aug 12, 2024 By Jaryeong Kim In Keeper
Double extortion ransomware is a type of cyber attack in which cybercriminals steal sensitive data and encrypt it. Then, cybercriminals threaten to release the stolen data unless the victim pays a ransom. The additional threat of exfiltration makes this type of cyber attack particularly damaging for organizations, as they face the risk of sensitive data being exposed to the public or sold on the dark web.
Read Post
keeper

The Most Recent Malware Attacks on Companies in 2024

Aug 9, 2024 By Ashley D'Andrea In Keeper
2024 has been quite the year for malware attacks. So far this year, major companies like Change Healthcare, Ticketmaster, Ascension Hospital, ABN AMRO and CDK Global have all been affected by malware attacks. Keep reading to learn more about each of these major malware attacks and how your company can protect itself from malware attacks.
Read Post
safebreach

Updated SafeBreach Coverage for US CERT Alert AA23-061A - BlackSuit (Royal) Ransomware

Aug 8, 2024 By Kaustubh Jagtap In SafeBreach
On August 7th, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) issued an update to an existing advisory (AA23-061A) highlighting new TTPs being leveraged by the recently rebranded “Royal” ransomware gang – now known as BlackSuit. Detailed information about this threat and the associated IOCs and TTPs can be seen on #StopRansomware: Blacksuit (Royal) Ransomware.
Read Post
Rubrik

Rubrik Named Five Times A Leader and Five Times Furthest in Vision: We Believe a Testament to Cyber Resilience

Aug 8, 2024 By Anneka Gupta In Rubrik
I am proud to announce that Rubrik has been recognized as a leader not just once but five consecutive times – we believe this is a testament to our vision and commitment to cyber resilience. This recognition in the Gartner Magic Quadrant for Enterprise Backup and Recovery Solutions (EBRSS)1 is a significant milestone for us, and it reaffirms our dedication to empowering organizations to navigate the complexities of data security and protect against evolving cyber threats.
Read Post
knowbe4

SEC Report Provides Insight into Key Tronic Ransomware Costs Totaling Over $17 Million

Aug 8, 2024 By Stu Sjouwerman In KnowBe4
The financial repercussions of the May 2024 ransomware attack on the electronics manufacturing services firm Key Tronic underscores just how costly these attacks are. Key Tronic makes parts for a number of sectors, including computer, telecom, medical, industrial, automotive and aerospace. They were struck in May with a ransomware attack by Black Basta, which claimed to have stolen 500 GB of data.
Read Post
Rubrik

Rubrik and Mandiant Join Forces to Bolster Cyber Resiliency Across the Whole Intrusion Lifecycle

Aug 7, 2024 By Steve Stone In Rubrik
In the ever-evolving world of cybersecurity, dealing with cyberattacks has become a daunting challenge for organizations across the globe. The aftermath of such attacks can be catastrophic, leaving organizations stymied for weeks or even months as they scramble to determine the true scope of an attack through recovering their data and systems.
Read Post
foresiet

SharpRhino RAT: Hunters International's Latest Weapon in Cyber Attacks

Aug 7, 2024 By Foresiet In Foresiet
In a notable development in the cybersecurity landscape, the emerging threat group known as Hunters International has added a novel remote access Trojan (RAT) to its arsenal. This group, which has quickly ascended the ranks of ransomware operators, is using the RAT, dubbed SharpRhino, to target IT professionals. Disguised as a legitimate network administration tool, SharpRhino facilitates initial access and persistence on targeted networks, setting the stage for ransomware attacks.
Read Post

Boost Your Cyber Resilience with DORA and NIS2

Aug 7, 2024 By Rubrik In Rubrik
In this episode of CISO Conversations: EU Data Regulations, Richard Cassidy, EMEA Field CISO at Rubrik, is joined by Jack Poller to dive further into the topic of DORA and NIS2, specifically how they help vendors build strong cyber resilience and data security strategies, effective insights for DORA and NIS2 compliance, and the balance between compliance and ransomware attacks.
View Video

What CISOs Must Consider During a Breach with Amy Bogac, CISO at Elevate Textiles

Aug 6, 2024 By Rubrik In Rubrik
Welcome to the Data Security Decoded podcast, brought to you by Rubrik Zero Labs. Each episode features senior cybersecurity leaders and other luminaries with unique perspectives about the current state of data security. We explore rising trends and themes across cybersecurity and unpack what that means for organizations looking to secure their data and achieve cyber resilience. In this episode, your host, Steve Stone, is joined by Amy Bogac, CISO at Elevate Textiles and a member of the Technical Advisory Board at Radiant Security.
View Video
knowbe4

New Malvertising Campaign Impersonates Google Authenticator

Aug 6, 2024 By Stu Sjouwerman In KnowBe4
Researchers at Malwarebytes spotted a malvertising campaign that abused Google Ads to target people searching for Google Authenticator. If someone typed “Google Authenticator” into Google, the malicious ad would be at the top of the search results. The ad copied the website description from the real Google Authenticator, but would redirect users to a phishing site. “We can follow what happens when you click on the ad by monitoring web traffic,” the researchers explain.
Read Post
foresiet

The Naver Deception: Analyzing Quasar RAT's Distribution through a Popular South Korean Platform

Aug 5, 2024 By Foresiet In Foresiet
Quasar RAT, also known as xRAT, is a malicious remote access trojan (RAT) that primarily targets Windows systems. Developed as an open-source project around 2015, it quickly garnered attention in the cybersecurity community due to its flexibility and ease of modification. Quasar RAT allows cybercriminals to gain unauthorized remote access to infected computers, making it a potent tool for espionage and theft. How Quasar RAT Operates.
Read Post
ThreatQuotient

Ransomware in the Global Healthcare Industry

Aug 2, 2024 By Leon Ward, VP, Product Management In ThreatQuotient
The World Health Organisation (The WHO) hosted a webinar on the 18th of July to discuss the critical importance of cybersecurity in the healthcare sector, highlighting the severity of the situation the industry is currently facing. Healthcare organisations are increasingly relying on digital systems to facilitate their daily workflow, but the prevalence of outdated legacy technology in the sector is rendering it vulnerable to cyber-attacks with severe consequences.
Read Post
Forescout

ICS Malware 'FrostyGoop/BUSTLEBERM': Insights Others Missed

Aug 2, 2024 By Forescout Research - Vedere Labs In Forescout
In the last few weeks, there have been a few announcements made about a new malware threat known as FrostyGoop or BUSTLEBERM (as it was originally tracked by Mandiant). It is being recognized as the first custom malware to integrate Modbus for the purpose of causing physical damage. An associated incident has been reported where the malware was used to disrupt heating in Ukrainian homes in the context of a Russian cyberattack.
Read Post
tripwire

$75 Million Record-Breaking Ransom Paid To Cybercriminals, Say Researchers

Aug 1, 2024 By Graham Cluley In Tripwire
The staggering sum of US $75 million has reportedly been paid to a ransomware gang in what is believed to be the largest known ransom payment made by a cyber attack victim since records began. Researchers at Zscaler claim in a new report that the record-breaking figure was paid by an undisclosed Fortune 50 company to the Dark Angels ransomware group.
Read Post

Emerging Technologies and Best Practices for Ransomware Prevention: Expert Insights

Aug 1, 2024 By Parablu In Parablu
In this insightful discussion, cybersecurity expert Ashok shares his valuable perspectives on the latest technologies and best practices for detecting and preventing ransomware attacks. As ransomware threats continue to evolve and pose significant risks to businesses, it's crucial for organizations to stay ahead of the curve. Ashok emphasizes that while new technologies can help with faster detection, the fundamentals of cybersecurity remain essential.
View Video

Copyright © 2024 OpsMatters™. All rights reserved.