Summary Note: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and various ransomware threat actors. These #StopRansomware advisories detail historically and recently observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to…
Category: Malware
New ESXiArgs ransomware version prevents VMware ESXi recovery
Lawrence Abrams reports: New ESXiArgs ransomware attacks are now encrypting more extensive amounts of data, making it much harder, if not impossible, to recover encrypted VMware ESXi virtual machines. Last Friday, a massive and widespread automated ransomware attack encrypted over 3,000 Internet-exposed VMware ESXi servers using a new ESXiArgs ransomware. Preliminary reports indicated that the devices were breached…
U.S. and U.K. sanction TrickBot and Conti ransomware operation members
Lawrence Abrams reports: The United States and the United Kingdom have sanctioned seven Russian individuals for their involvement in the TrickBot cybercrime group, whose malware was used to support attacks by the Conti and Ryuk ransomware operation. […] Today, the United States and the United Kingdom have sanctioned seven individuals for their involvement in the…
Hk: Thousands affected by Institute of Bankers data leak following ransomware incident
rthk reports: The Office of the Privacy Commissioner for Personal Data said on Thursday that it has issued an enforcement notice to the Hong Kong Institute of Bankers, following a data leak that affected more than 13,000 members and about 100,000 non-members. Speaking at a press conference, the watchdog said people’s personal information was leaked…
AmerisourceBergen MWI Animal Health hit by Lorenz; Company investigating
The Lorenz ransomware group has added AmerisourceBergen/MWI Animal Health to their leak site with what teasingly appears to be a lot of data, except there is no key to unlock the leaked files. Those who want the key will have to contact Lorenz and buy the key. Lorenz did provide a file list as a…
MA: DotHouse Health discloses data breach but has yet to send letters to patients
On or about December 10, AlphV (aka BlackCat) added DotHouse Health.org to their leak site, where they attempt to pressure victims into paying any ransom demands. In this case, the threat actors did not post any proof pack, but they claimed to have infiltrated 800 GB of data from the Massachusetts HIPAA-covered healthcare provider. On…