XWorm is a relatively new versatile tool that was discovered in 2022. It enables attackers to carry out a variety of functions, which include accessing sensitive information, gaining remote access, and deploying additional malware. The multifaceted nature of XWorm is appealing to threat actors, as evidenced by its alleged use earlier this year by threat actors such as NullBulge and TA558. Through Netskope Threat Labs hunting efforts, we uncovered XWorm’s latest version in the wild.

The number of ransomware attacks around the world increased by 73% in 2023, according to a new report by the Institute for Security and Technology’s Ransomware Task Force (RTF). These attacks opportunistically target organizations across all industries, but the hardest-hit sectors over the past two years have been construction, hospitals and health care, government, IT services and consulting, and financial services.

Identity-based cyber attacks continue to prevail and impact organizations. Stealing credentials was the top initial action in breaches, according to Verizon. Plus, 84% of identity stakeholders surveyed said identity-related incidents directly impacted their business, resulting in reputational damages, distraction from core business, and increased recovery costs.

Rubrik Cloud Vault already provides a high level of cyber resiliency against data deletion, encryption, and exfiltration through air-gapped, immutable, access-controlled backup and archival copies stored in an isolated environment. Now, for added resilience against regional failures and natural disasters, Rubrik Cloud Vault supports Zone-redundant storage (ZRS) and Geo-redundant storage (GRS), complementing our existing Local-redundant storage (LRS) option.

Earlier this month, the U.S. Department of Justice’s Office of the Inspector General released a report on how the Department could improve its approach to combat ransomware attacks. The report included an audit and evaluated the Department’s strategy to respond and counter ransomware attacks during a two-and-a-half-year period from April 2021 through September 2023.

The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS) recently issued a joint advisory on the RansomHub ransomware. RansomHub is a ransomware-as-a-service variant, previously known as Cyclops and Knight. Since February 2024, it has encrypted and exfiltrated data from over 210 victims spanning multiple industries.

One of the more common forms of fileless malware that’s making the rounds across organizations cloud environments, is something called PyLoose. In rotation since 2014, this specific strain of malware targets the cloud workloads and enters environments through an open-source Python code execution application.

DCRat (also known as Dark Crystal RAT) is a modular remote access Trojan (RAT) which is offered as malware-as-a-service (MaaS) and has been around since 2018. It is written in C# and has typical RAT and information stealing capabilities, such as executing shell commands, logging keystrokes, exfiltrating files and credentials, among others.

Data has become organizations' lifeblood. However, with the exponential growth of data comes unprecedented challenges in securing it across both short-term and long-term storage. To make matters worse, cyber threats are evolving rapidly, and businesses need robust solutions to safeguard their critical data. We're excited to announce a groundbreaking partnership between Rubrik and Pure Storage.