From Intel471’s Malware Intelligence Team: REvil aka Sodinokibi, Sodin is a ransomware family operated as a ransomware-as-a-service (RaaS). Deployments of REvil first were observed in April 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725. REvil is highly configurable and allows operators to customize the way it behaves on the infected…
Category: Of Note
FSB Takes Down Top-Tier Marketplace, Arrests Admins
Gemini Advisory has a fascinating piece on the takedown of a top-tier marketplace and the arrest of its administrators. Stas Alforov and Christopher Thomas report that when the Russian Federal Security Service (FSB) reportedly arrested 30 members of a hacker ring that specialized in selling stolen card data, Gemini noted that a popular dark web…
Dark web hosting provider hacked again — 7,600 sites down
Catalin Cimpanu reports: Daniel’s Hosting (DH), the largest free web hosting provider for dark web services, has shut down today after getting hacked for the second time in 16 months, ZDNet has learned. Almost 7,600 dark web portals have been taken offline following the hack, during which an attacker deleted the web hosting portal’s entire database….
An old HIPAA incident rears its very ugly head again
Like other journalists who cover data breaches in the healthcare space, I routinely check HHS’s public breach disclosure tool (sometimes called “The Wall of Shame”) to see what breaches have been reported to them and with what numbers. One of the recent entries was from a “Stephan C. Dean” who listed himself as a business…
Elite hackers target WHO as coronavirus cyberattacks spike
Raphael Satter, Jack Stubbs, and Christopher Bing report: Elite hackers tried to break into the World Health Organization earlier this month, sources told Reuters, part of what a senior agency official said was a more than two-fold increase in cyberattacks. WHO Chief Information Security Officer Flavio Aggio said the identity of the hackers was unclear,…
Liar, Liar, Pants on Fire? Did Maze Team go back on its word to leave medically related facilities alone?
We also stop all activity versus all kinds of medical organizations until the stabilization of the situation with virus. — Maze Team, March 18, 2020. Three days after issuing a press release claiming that they would stop all activity against all kinds of medical organizations, Maze Team appears to have gone back on its word….