Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

REvil's new Linux version

The ransomware-as-a-service (RaaS) operation behind REvil have become one of the most prolific and successful threat groups since the ransomware first appeared in May 2019. REvil has been primarily used to target Windows systems. However, new samples have been identified targeting Linux systems. AT&T Alien Labs™ is closely monitoring the ransomware landscape and has already identified four of these samples in the wild during the last month, after receiving a tip from MalwareHuntingTeam.

Ransomware Has Evolved, And So Should Your Company

Ransomware is typically initiated via phishing or social engineering tactics, these attacks often take advantage of human error for the successful delivery of the malware. These criminal organizations are impartial to the size of your organization. They target any company with data, and if you don't pay the ransom, your information could be posted to a public forum or sold on the Dark Web for profit. Most companies unfortunately are forced to pay due to system failure and file corruption.

Yuba County Survived a Ransomware Attack and Lived to Tell the Tale

The growing threat of ransomware attacks is ubiquitous, which has been further accelerated by the pandemic. In February of 2021, Yuba County was hit by ransomware that infected critical systems. Despite the attacker’s demands for ransom, the county was able to avoid paying the hefty fee and quickly recovered with Rubrik. Listen in on the fireside chat with Paul LaValley, CIO of Yuba County as he shares intimate details of how they survived the attack and lived to tell the tale.

Estée Lauder Uses Rubrik to Manage and Protect Global Data at Scale

Leading house of prestige beauty, Estée Lauder is a collection of over 25 globally renowned beauty brands, each with its own unique set of data and unique challenges. To protect all data at scale while keeping costs low, the beauty company embarked on a digital transformation journey – to break free from legacy data protection and mobilize to the cloud.

What If You Had Advance Notice of a Ransomware Attack?

One of the worst things about ransomware attacks isn’t just the mayhem they cause as your data is encrypted by criminals and your business is put on hold — it’s not knowing when they’ll happen. But what if you had some advance notice about the next cyberattack before it hit? What if you could find out if your data was up for bid on the dark web?

Not Laughing: Malicious Office Documents using LoLBins

Attackers have long used phishing emails with malicious Microsoft Office documents, often hosted in popular cloud apps like Box and Amazon S3 to increase the chances of a successful lure. The techniques being used with Office documents are continuing to evolve. In August – September of 2020, we analyzed samples that used advanced techniques like: In January 2021, we examined samples that use obfuscation and embedded XSL scripts to download payloads.

Secure Software Development: How to Check Your Code

In May of 2021, a cybercrime organization called DarkSide successfully locked operators of the Colonial Pipeline, which supplies the east coast with 45% of its petroleum fuel, out of their own software system with a type of malware called "ransomware." True to its name, ransomware returns access to your software (in theory) if you pay a ransom. The result-fuel supplies collapsed across the eastern United States, with gas lines, price spikes, and panic. People began hoarding gasoline in states not even served by the Colonial Pipeline. The US government passed emergency legislation. Even DarkSide seemed shocked at the impact of their cyberattack.

Should Australian Businesses Pay Ransoms to Cybercriminals?

The Australian Cyber Security Center (ACSC) strongly advises against paying ransoms of any amount to cybercriminals. In some circumstances, these payments could even be illegal. The Australian government is tightening its cybersecurity regulations to align with the United State's new stance on nation-state threats. As a result, there have been significant changes to how Australian businesses are expected to respond to cyberattacks.

The Colonial Pipeline Ransomware Attack: The Fallout and Its Implications

Cybercriminals use ransomware to block organizations from accessing their critical business data to extort ransoms. Data encryption protects data wherever it resides. The encrypted data becomes obsolete as encryption makes it difficult for the ransomware to detect it and attack. A good data backup & restoration strategy and a DRM solution are the key factors when companies want to respond to ransomware attacks. These allow companies to restore the data encrypted during the attack.

How Much Damage a Ransomware Attack Can Cause

As soon as you turn on a news channel or try to read the latest broadcast from your favorite site, you can find an article on cybercriminal activity, especially ransomware-type. Ransomware, a highly crippling malware attack on businesses of all sizes and sensitive information, has been in action. You can search now and find several companies getting attacked and losing footing.