Dark Reading
3 years, 5 months ago
ESXi Ransomware Update Outfoxes CISA Recovery Script
New ESXiArgs-ransomware attacks include a workaround for CISA's decryptor, researchers find.
Security news aggregator
Latest coverage for Ransomware
Ransomware encrypts or steals data to disrupt operations and extort victims, making backups, access controls, and incident response essential.
15
headlines in this view
Refine the feed
Search across headline titles and summaries.
Tag briefing
Background for this topic.
Ransomware is malware used to deny access to systems or data, usually by encrypting files and demanding payment for decryption. Many operations also steal sensitive information and threaten to publish it, so an attack can create both an availability crisis and a privacy or disclosure risk. Initial access may involve phishing, stolen credentials, exposed remote services, or exploitation of unpatched vulnerabilities; attackers may then move through the network before deploying the payload.
Defenses should combine vulnerability management, phishing-resistant authentication where practical, endpoint and network monitoring, and backups that are isolated from routine administrator access and regularly tested for recovery. Organizations should also limit privileges and segment critical systems to reduce the blast radius. An incident requires rapid containment, preservation of forensic evidence, restoration from known-good backups, and assessment of notification, legal, and regulatory obligations. Threat intelligence can help identify relevant criminal infrastructure or tactics, but it does not replace sound access control, patching, detection, and recovery practices.
Showing 15 most recent headlines
Filtered view
Info Security Magazine
3 years, 5 months ago
City of Oakland Declares State of Emergency After Ransomware Attack
Core functions are intact, but the city has taken certain non-emergency systems offline
The Hacker News
3 years, 5 months ago
ESXiArgs Ransomware Hits Over 500 New Targets in European Countries
More than 500 hosts have been newly compromised en masse by the ESXiArgs ransomware strain, most of which are located in France, Germany, the Netherlands, the U.K., and Ukraine
The Register
3 years, 5 months ago
ESXiArgs ransomware fights off Team America's data recovery script
Want a clue to what you’re dealing with? Check the ransom note That didn't take long.…
Info Security Magazine
3 years, 5 months ago
LockBit and Royal Mail Ransomware Negotiation Leaked
It shows the threat actor trying to convince Royal Mail to pay the ransom using various techniques
Info Security Magazine
3 years, 5 months ago
Crypto-Stealing Campaign Deploys MortalKombat Ransomware
The attacks mainly targeted victims in the US but also in the UK, Turkey, and the Philippines
Bleeping Computer
3 years, 5 months ago
City of Oakland declares state of emergency after ransomware attack
Oakland has declared a local state of emergency because of the impact of a ransomware attack that forced the City to take all its IT systems offline on February 8th. [...]
The Hacker News
3 years, 5 months ago
Financially Motivated Threat Actor Strikes with New Ransomware and Clipper Malware
A new financially motivated campaign that commenced in December 2022 has seen the unidentified threat actor behind it deploying a novel ransomware strain dubbed MortalKombat and a clipper malware known as Laplas
Dark Reading
3 years, 5 months ago
Oakland City Services Struggle to Recover From Ransomware Attack
Fire emergency, 911 services functioning, along with Oakland financial systems, city says.
Bleeping Computer
3 years, 5 months ago
New ‘MortalKombat’ ransomware targets systems in the U.S.
Hackers conducting a new financially motivated campaign are using a variant of the Xortist commodity ransomware named 'MortalKombat,' together with the Laplas clipper in cyberattacks. [...]
The Hacker News
3 years, 5 months ago
A CISOs Practical Guide to Storage and Backup Ransomware Resiliency
One thing is clear. The "business value" of data continues to grow, making it an organization's primary piece of intellectual property
Dark Reading
3 years, 5 months ago
Healthcare in the Crosshairs of North Korean Cyber Operations
CISA, FBI, and South Korean intelligence agencies warn that the North Korean government is sponsoring ransomware attacks to fund its cyber-espionage activities.
The Register
3 years, 5 months ago
LockBit's Royal Mail ransom deadline flies by. No data released
Also: Russian wiper malware authors turn to data theft, plus this week's critical vulns in brief The notorious LockBit ransomware gang has taken credit for an attack on the Royal Mail – but a deadline it gave for payment has come and gone with nothing exposed to the web except the group's claims.…
Bleeping Computer
3 years, 5 months ago
Ransomware hits Technion university to protest tech layoffs and Israel
A new ransomware group going by the name 'DarkBit' has hit Technion - Israel Institute of Technology, one of Israel's leading research universities. The ransom note posted by DarkBit is littered with messaging protesting tech layoffs and promoting anti-Israel rhetoric, as well as the group demanding a $1.7 million payment. [...]
Bleeping Computer
3 years, 5 months ago
Ransomware hits Technion university, protests tech layoffs and Israel
A new ransomware group going by the name 'DarkBit' has hit Technion - Israel Institute of Technology, one of Israel's leading research universities. The ransom note posted by DarkBit is littered with messaging protesting tech layoffs and promoting anti-Israel rhetoric, as well as the group demanding a $1.7 million payment. [...]