Penny Horwood reports: The ransomware attack on Southern Water approximately one year ago by the Russia-linked Black Basta group has cost the utility provider more than £4.5 million to date, according to the utility company’s annual report. An extract from the publicly available Southern Water annual report says: “..in February 2024 we announced that data from a limited part…
Category: Malware
DISA Global Solutions reports more than 3.3 million people affected by 2024 data breach, but questions remain
On February 3, DataBreaches quoted a press release by BakerHostetler about a breach update from DISA Global Solutions that DISA had issued on January 23, 2025. BakerHostetler’s release was subsequently removed from their website, although a copy still currently exists at PublicNow. Of note, in their main takeaways section, BakerHostetler quoted DISA’s update and commented:…
RansomHub sends a letter to the editor. Really.
On February 17, DataBreaches reported that the RansomHub ransomware group claimed responsibility for an attack on the Sault Ste. Marie Tribe of Chippewa Indians. RansomHub claimed to have “temporarily locked” the tribe’s infrastructure and to have acquired 119 GB of files (501, 211 files). The post included statements by RansomHub as seen on their dark…
UK: More details emerge about ransomware attack on HCRG by Medusa
In a recent report in The Register about an attack by Medusa on HCRG in the U.K., Iain Thomson reported, “For now, then, HCRG is still operational – a stark contrast to what happened in Texas last year, when the University Medical Center in Lubbock was forced to severely limit operations and turn away ambulances following…
BlackBasta Ransomware Chatlogs Leaked Online
Kevin Poireault reports: Netherlands-based threat intelligence firm Prodaft revealed on February 20 that internal chatlogs from the BlackBasta ransomware gang have been leaked online. BlackBasta is a ransomware strain that was first detected in April 2022. Early on, cyber threat intelligence experts assessed that the members of the group behind the ransomware were associated with other…
Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors
Marine Pichon and Alexis Bonnefoi of Orange Cyberdefense report: Last year, Orange Cyberdefense’s CERT investigated a series of incidents from an unknown threat actor leveraging both ShadowPad and PlugX. Tracked as Green Nailao (“Nailao” meaning “cheese” in Chinese – a topic our World Watch CTI team holds in high regard), the campaign impacted several European organizations, including in the healthcare vertical, during…