Ransomware encrypts or steals data to disrupt operations and extort victims, making backups, access controls, and incident response essential.
Search across headline titles and summaries.
Background for this topic.
Ransomware is malware used to deny access to systems or data, usually by encrypting files and demanding payment for decryption. Many operations also steal sensitive information and threaten to publish it, so an attack can create both an availability crisis and a privacy or disclosure risk. Initial access may involve phishing, stolen credentials, exposed remote services, or exploitation of unpatched vulnerabilities; attackers may then move through the network before deploying the payload.
Defenses should combine vulnerability management, phishing-resistant authentication where practical, endpoint and network monitoring, and backups that are isolated from routine administrator access and regularly tested for recovery. Organizations should also limit privileges and segment critical systems to reduce the blast radius. An incident requires rapid containment, preservation of forensic evidence, restoration from known-good backups, and assessment of notification, legal, and regulatory obligations. Threat intelligence can help identify relevant criminal infrastructure or tactics, but it does not replace sound access control, patching, detection, and recovery practices.
Also: Ransomware Threats in Healthcare; the Growth of MimecastIn the latest weekly update, ISMG editors discussed the evolving disclosure responsibilities of CISOs, yet another ransomware attack targeting the healthcare sector, and Mimecast's latest strategic acquisition as part of its broader expansion efforts.
The American Radio Relay League (ARRL) paid a $1 million ransom for a decryptor that helped restore systems encrypted in a May ransomware attack [...]
Latvian Charged With Serving as Extortion Specialist for Russian-Speaking GroupA Latvian national accused of serving as a Russian-speaking ransomware group's extortion specialist appeared in a U.S. courtroom this week to face a four-count indictment filed against him. Moscow resident Deniss Zolotarjovs, 33, was recently extradited to the U.S. from the country of Georgia.
Browser credential harvesting is an unusual activity for a ransomware group
The threat actors behind a recently observed Qilin ransomware attack have stolen credentials stored in Google Chrome browsers on a small set of compromised endpoints
Also: Dangers of Malicious Code Embedded in ML Models; Is Ransomware in Decline?AI's influence on social engineering and election security has become a focal point at Black Hat. ISMG editors discuss how advanced technologies are making it easier to manipulate people and compromise security systems and offer key insights on machine learning vulnerabilities.
The Qilin ransomware group has been using a new tactic and deploys a custom stealer to steal account credentials stored in Google Chrome browser. [...]
Group Claims a NY Surgical Center and a Nevada Medical Center Among Recent VictimsU.S. authorities are warning healthcare sector entities of incidents involving Everest, a Russian-speaking ransomware group and initial access broker, which claims to have stolen sensitive patient information in recent attacks, including on two medical care providers in New York and Nevada.
Company Reportedly Instructs Staff to Not Connect to Internal IT SystemsOil services giant Halliburton is reportedly dealing with a disruption tied to a Wednesday hack attack, after which the Houston-based firm advised employees to not connect to any internal IT resources - a sign that the incident could be a ransomware attack.
A member of the Russian Karakurt ransomware group has been charged in the U.S. for money laundering, wire fraud, and extortion crimes. [...]
Whether attack slowdown continues downward trend is the million dollar question that security researchers can't answer Critical industrial organizations continued to be hammered by ransomware skids in July, while experts suggest the perps are growing in confidence that law enforcement won't intervene.…
Using the Trend Micro Vision One platform, our MDR team was able to quickly identify and contain a Play ransomware intrusion attempt.
Nearly 137,000 People Affected in 2023 Ransomware Attack on Maryland-Based HospitalA ransomware attack against Berlin, Maryland-based Atlantic General Hospital that affected the personal information of 137,000 individuals in 2023 has led to a $2.25 million preliminary settlement of a consolidated proposed federal class action lawsuit.
Taiwanese hardware vendor QNAP has added a Security Center with ransomware protection capabilities to the latest version of its QTS operating system for network-attached storage (NAS) devices. [...]
RedSense's Bohuslavskiy and Smith on How Attacks on Healthcare Show DesperationRedSense’s Yelisey Bohuslavskiy and Marley Smith believe ransomware is declining but caution that it still poses a significant threat. While attackers recycle old methods, they're taking desperate measures to target vulnerable groups such as cancer centers and to stoke fears in the marketplace.
Does That Mean Improved Defenses and Law Enforcement Disruptions Are Failing?Ransomware groups' collective profits are on track to achieve another record-breaking year, even though fewer victims overall appear to be paying a ransom, experts warn. One expert says the success comes down to a handful of high-profile attacks.
Healthcare has been the most targeted sector according to Barracuda analysis of 200 reported ransomware incidents from August 2023 to July 2024
Malwarebytes report warns security teams to be on high alert for ransomware attacks at night
The Cannon Corporation dba CannonDesign is sending notices of a data breach to more than 13,000 of its clients, informing that hackers breached and stole data from its network in an attack in early 2023. [...]
Robert Boyce on Accenture's Strategy for Assessing the Behavior of Ransomware GangsAccenture Global Cyber Resilience Lead Robert Boyce outlines why organizations must assess the stability of ransomware groups before deciding how to respond to extortion threats. He outlines how trustworthiness of ransomware gangs can affect the likelihood of receiving decryption keys after payment.