LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages A dual Russian and Israeli national has been charged in the United States for allegedly being the developer of the now-defunct LockBit ransomware-as-a-service (RaaS) operation since its inception in or around 2019 through at least February 2024. Rostislav Panev, Read more…
Black Basta Ransomware Evolves with Email Bombing, QR Codes, and Social Engineering The threat actors linked to the Black Basta ransomware have been observed switching up their social engineering tactics, distributing a different set of payloads such as Zbot and DarkGate since early October 2024. “Users within the target environment Read more…
Wanted Russian Cybercriminal Linked to Hive and LockBit Ransomware Has Been Arrested A Russian cybercriminal wanted in the U.S. in connection with LockBit and Hive ransomware operations has been arrested by law enforcement authorities in the country. According to a news report from Russian media outlet RIA Novosti, Mikhail Pavlovich Read more…
CyberVolk analysis explores ransomware, hacktivism interconnections CyberVolk, a ransomware-as-a-service (RaaS) provider and pro-Russia hacktivist group, shares several similarities and connections to other pro-Russia threat groups, revealing an intertwined network of threat actors that blur the line between politically and financially motivated cybercrime, SentinelOne’s SentinelLabs described in a report published Monday. Read more…
Free Decryptor Released for BitLocker-Based ShrinkLocker Ransomware Victims Romanian cybersecurity company Bitdefender has released a free decryptor to help victims recover data encrypted using the ShrinkLocker ransomware. The decryptor is the result of a comprehensive analysis of ShrinkLocker’s inner workings, allowing the researchers to discover a “specific window of opportunity Read more…
New Ymir Ransomware Exploits Memory for Stealthy Attacks; Targets Corporate Networks Cybersecurity researchers have flagged a new ransomware family called Ymir that was deployed in an attack two days after systems were compromised by a stealer malware called RustyStealer. “Ymir ransomware introduces a unique combination of technical features and tactics Read more…
Rhysida ransomware attack on Columbus claimed 500K victims The City of Columbus, Ohio, confirmed Nov. 1 that 500,000 people were affected by a July 18 ransomware attack that was claimed by the Rhysida gang. In a filing with Maine’s attorney general, the city said the personal information that may have Read more…
North Korean nation-state threat actor using Play ransomware A North Korean state-sponsored threat actor is suspected of collaborating with the Play ransomware gang in a September cyberattack, Palo Alto Networks Unit 42 reported Wednesday. The group tracked by Unit 42 as Jumpy Pisces, also known as Andariel, Onyx Sleet and Read more…
North Korean Group Collaborates with Play Ransomware in Significant Cyber Attack Oct 30, 2024Ravie LakshmananRansomware / Threat Intelligence Threat actors in North Korea have been implicated in a recent incident that deployed a known ransomware family called Play, underscoring their financial motivations. The activity, observed between May and September 2024, Read more…
Four REvil Ransomware Members Sentenced in Rare Russian Cybercrime Convictions Oct 26, 2024Ravie LakshmananCybercrime / Malware Four members of the now-defunct REvil ransomware operation have been sentenced to several years in prison in Russia, marking one of the rare instances where cybercriminals from the country have been convicted of hacking Read more…